root-access 1.3.38

package/README.md

@@ -0,0 +1,143 @@
+```
+██████╗  ██████╗  ██████╗ ████████╗ █████╗  ██████╗ ██████╗███████╗███████╗███████╗
+██╔══██╗██╔═══██╗██╔═══██╗╚══██╔══╝██╔══██╗██╔════╝██╔════╝██╔════╝██╔════╝██╔════╝
+██████╔╝██║   ██║██║   ██║   ██║   ███████║██║     ██║     █████╗  ███████╗███████╗
+██╔══██╗██║   ██║██║   ██║   ██║   ██╔══██║██║     ██║     ██╔══╝  ╚════██║╚════██║
+██║  ██║╚██████╔╝╚██████╔╝   ██║   ██║  ██║╚██████╗╚██████╗███████╗███████║███████║
+╚═╝  ╚═╝ ╚═════╝  ╚═════╝    ╚═╝   ╚═╝  ╚═╝ ╚═════╝ ╚═════╝╚══════╝╚══════╝╚══════╝
+```
+
+<div align="center">
+
+[![npm version](https://img.shields.io/npm/v/rootaccess?style=for-the-badge&color=red)](https://www.npmjs.com/package/rootaccess)
+[![Downloads](https://img.shields.io/npm/dt/rootaccess?style=for-the-badge&color=blue)](https://www.npmjs.com/package/rootaccess)
+[![License](https://img.shields.io/badge/License-MIT-green?style=for-the-badge)](LICENSE)
+
+**A mysterious CLI tool. Can you uncover its secrets?**
+
+</div>
+
+---
+
+## 🎯 CTF Challenge
+
+**Category:** Reverse Engineering + CLI Exploitation  
+**Difficulty:** ★★★★★★★★★★ (10/10)  
+**Points:** 2000  
+
+---
+
+## 📦 Installation
+
+```bash
+npm install -g rootaccess
+```
+
+Or run directly:
+```bash
+npx rootaccess
+```
+
+---
+
+## 🔧 Usage
+
+```bash
+rootaccess <command> [options]
+
+Commands:
+  help          Show help message
+  version       Show version information
+  status        Check system status
+  scan          Scan for vulnerabilities
+  connect       Connect to remote server
+  decrypt       Decrypt a message
+  handshake     Network protocol simulation
+  forge         Access the Key Forge
+  about         About this tool
+```
+
+---
+
+## 🕵️ The Challenge
+
+This CLI hides a secret flag somewhere within its code and behavior.
+
+**Flag Format:** \`root{...}\`
+
+### Rules
+1. The flag is split into **10 fragments**
+2. Each fragment requires solving a different layer
+3. Some layers require environment variables
+4. Some layers require specific command arguments
+5. Some layers require **previous fragments** to unlock
+6. Some layers are **time-sensitive**
+7. Some layers require **file system interaction**
+8. Some layers simulate **network protocols**
+9. **Layer 10 requires forging a complex master key**
+10. Final assembly reveals the complete flag
+
+### Difficulty Breakdown
+
+| Layer | Type | Hint | Difficulty |
+|-------|------|------|------------|
+| 1 | Environment | *Debug modes exist for a reason...* | ⭐ |
+| 2 | Environment | *Who has elevated access?* | ⭐ |
+| 3 | Arguments | *Sometimes you need to dig deeper...* | ⭐⭐ |
+| 4 | Arguments | *Not all servers are visible...* | ⭐⭐ |
+| 5 | **Chain** | *Keys forged from previous discoveries...* | ⭐⭐⭐⭐ |
+| 6 | Hidden | *Commands not in help still exist...* | ⭐⭐ |
+| 7 | **Time** | *Shadows appear only at certain hours...* | ⭐⭐⭐⭐ |
+| 8 | **File** | *Some doors require physical keys...* | ⭐⭐⭐ |
+| 9 | **Protocol** | *Complete the handshake to establish trust...* | ⭐⭐⭐⭐ |
+| 10 | **KEY FORGE** | *The key must be computed, not guessed!* | ⭐⭐⭐⭐⭐ |
+
+---
+
+## 🏁 Verification
+
+Once you have all fragments, assemble them:
+
+```bash
+rootaccess assemble --key=<MASTER_KEY>
+```
+
+---
+
+## 💀 Warnings
+
+```diff
+- DO NOT just grep for "root{" - it won't work
+- DO NOT expect strings to reveal the answer
+- DO NOT ignore the source code
+- DO NOT skip layers - some depend on previous ones!
+! The flag is encoded and fragmented across 10 layers
+! Environment, arguments, time, and files are your friends
+! Some layers require waiting for the right moment
+```
+
+---
+
+## 📖 Final Words
+
+```
+┌──────────────────────────────────────────────────────────┐
+│                                                          │
+│  "The best hiding spot is in plain sight,                │
+│   behind layers of misdirection,                         │
+│   guarded by the passage of time."                       │
+│                                                          │
+│                              — The Architects, 2024      │
+│                                                          │
+└──────────────────────────────────────────────────────────┘
+```
+
+---
+
+<div align="center">
+
+**Good luck, hacker.** 🔓
+
+*The CLI is watching... and waiting.*
+
+</div>

package/bin/cli.js

@@ -0,0 +1,469 @@
+#!/usr/bin/env node
+
+/**
+ * ROOTACCESS CLI - CTF Challenge (HARD MODE)
+ * ==========================================
+ * The flag is hidden across 10 layers.
+ * Can you reverse engineer this CLI to find it?
+ * 
+ * FLAG FORMAT: root{...}
+ */
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { CoreSystem } = require('../lib/index.js');
+const { DataVault } = require('../lib/vault.js');
+const { CryptoEngine } = require('../lib/crypto.js');
+const { NetworkSim } = require('../lib/network.js');
+const { KeyForge } = require('../lib/keyforge.js');
+
+const VERSION = '1.3.37';
+const CODENAME = 'SHADOWGATE';
+
+// Session state for handshake
+let handshakeState = {
+    synSent: false,
+    synAckReceived: false,
+    token: null,
+    timestamp: null
+};
+
+// Banner
+const banner = `
+\x1b[35m╔═══════════════════════════════════════════════════════════╗
+║  ██████╗  ██████╗  ██████╗ ████████╗ █████╗  ██████╗██████╗  ║
+║  ██╔══██╗██╔═══██╗██╔═══██╗╚══██╔══╝██╔══██╗██╔════╝██╔════╝ ║
+║  ██████╔╝██║   ██║██║   ██║   ██║   ███████║██║     ██████╗  ║
+║  ██╔══██╗██║   ██║██║   ██║   ██║   ██╔══██║██║     ╚════██╗ ║
+║  ██║  ██║╚██████╔╝╚██████╔╝   ██║   ██║  ██║╚██████╗██████╔╝ ║
+║  ╚═╝  ╚═╝ ╚═════╝  ╚═════╝    ╚═╝   ╚═╝  ╚═╝ ╚═════╝╚═════╝  ║
+╠═══════════════════════════════════════════════════════════════╣
+║  Version: ${VERSION}  |  Codename: ${CODENAME}               ║
+╚═══════════════════════════════════════════════════════════════╝\x1b[0m
+`;
+
+// Hidden debug mode (Layer 1 hint)
+const DEBUG_KEY = process.env.ROOTACCESS_DEBUG;
+const ADMIN_MODE = process.env.ROOTACCESS_ADMIN === 'shadowgate';
+
+// Generate time-based token for Layer 7
+function getTimeWindowToken() {
+    const now = new Date();
+    const minutes = now.getUTCMinutes();
+    // Valid in 5-minute windows (0-4, 5-9, etc.)
+    const window = Math.floor(minutes / 5);
+    return crypto.createHash('md5').update(`SHADOW_${window}_GATE`).digest('hex').slice(0, 6).toUpperCase();
+}
+
+// Check if current time is in "shadow hour" (minutes 0-10 or 30-40 of any hour)
+function isInShadowWindow() {
+    const minutes = new Date().getUTCMinutes();
+    return (minutes >= 0 && minutes <= 10) || (minutes >= 30 && minutes <= 40);
+}
+
+// Generate handshake challenge token
+function generateSynAckToken() {
+    const ts = Date.now().toString();
+    const token = crypto.createHash('sha256').update(ts + CODENAME).digest('hex').slice(0, 8).toUpperCase();
+    return { token, timestamp: ts };
+}
+
+// Verify handshake ACK
+function verifyAck(ackToken, originalTimestamp) {
+    const expected = crypto.createHash('sha256')
+        .update(originalTimestamp + CODENAME + 'ACK')
+        .digest('hex').slice(0, 8).toUpperCase();
+    return ackToken === expected;
+}
+
+// Command handlers
+const commands = {
+    help: () => {
+        console.log(`
+\x1b[36mUsage:\x1b[0m rootaccess <command> [options]
+
+\x1b[36mCommands:\x1b[0m
+  help          Show this help message
+  version       Show version information
+  status        Check system status
+  scan          Scan for vulnerabilities
+  connect       Connect to remote server
+  decrypt       Decrypt a message
+  forge         Access the Key Forge
+  handshake     Network handshake protocol
+  about         About this tool
+
+\x1b[36mExamples:\x1b[0m
+  rootaccess status
+  rootaccess scan --deep
+  rootaccess connect --server alpha
+
+\x1b[33mHint: Not everything is what it seems... 10 layers await.\x1b[0m
+`);
+    },
+
+    version: () => {
+        console.log(`RootAccess CLI v${VERSION}`);
+        console.log(`Codename: ${CODENAME}`);
+        console.log(`Build: ${Buffer.from('4e4f5448494e475f48455245', 'hex').toString()}`);
+        
+        // Hidden layer - check if debugging
+        if (DEBUG_KEY === 'LAYER_ONE') {
+            console.log(`\n\x1b[32m[DEBUG] Layer 1 unlocked!\x1b[0m`);
+            console.log(`[DEBUG] Fragment 1: ${CryptoEngine.getFragment(1)}`);
+        }
+    },
+
+    status: () => {
+        const core = new CoreSystem();
+        console.log('\n\x1b[36m[*] System Status\x1b[0m');
+        console.log('─'.repeat(40));
+        console.log(`  Core Engine:     \x1b[32mONLINE\x1b[0m`);
+        console.log(`  Crypto Module:   \x1b[32mONLINE\x1b[0m`);
+        console.log(`  Vault Status:    \x1b[33mLOCKED\x1b[0m`);
+        console.log(`  Network:         \x1b[31mRESTRICTED\x1b[0m`);
+        console.log(`  Shadow Window:   ${isInShadowWindow() ? '\x1b[32mACTIVE\x1b[0m' : '\x1b[31mINACTIVE\x1b[0m'}`);
+        console.log('─'.repeat(40));
+        
+        // Hidden admin check (Layer 2)
+        if (ADMIN_MODE) {
+            console.log(`\n\x1b[32m[ADMIN] Elevated access detected!\x1b[0m`);
+            console.log(`[ADMIN] Fragment 2: ${CryptoEngine.getFragment(2)}`);
+        }
+        
+        // Easter egg in status
+        core.checkIntegrity();
+    },
+
+    scan: (args) => {
+        console.log('\n\x1b[36m[*] Initiating security scan...\x1b[0m\n');
+        
+        const targets = [
+            { name: 'Memory', status: 'clean' },
+            { name: 'Network', status: 'clean' },
+            { name: 'Filesystem', status: 'clean' },
+            { name: 'Registry', status: 'anomaly' },
+        ];
+
+        targets.forEach((t, i) => {
+            setTimeout(() => {
+                const icon = t.status === 'clean' ? '\x1b[32m✓\x1b[0m' : '\x1b[33m⚠\x1b[0m';
+                console.log(`  ${icon} ${t.name}: ${t.status}`);
+            }, i * 500);
+        });
+
+        setTimeout(() => {
+            console.log('\n\x1b[36m[*] Scan complete.\x1b[0m');
+            
+            // Deep scan mode (Layer 3)
+            if (args.includes('--deep') || args.includes('-d')) {
+                console.log('\x1b[33m[*] Deep scan enabled...\x1b[0m');
+                const vault = new DataVault();
+                const anomaly = vault.analyzeRegistry();
+                if (anomaly) {
+                    console.log(`\x1b[32m[!] Hidden data found in registry!\x1b[0m`);
+                    console.log(`[DATA] ${anomaly}`);
+                }
+            }
+            
+            // Secret flag for --ultra
+            if (args.includes('--ultra')) {
+                console.log(`\n\x1b[35m[ULTRA] Fragment 3: ${CryptoEngine.getFragment(3)}\x1b[0m`);
+            }
+        }, 2500);
+    },
+
+    connect: (args) => {
+        const network = new NetworkSim();
+        const serverArg = args.find(a => a.startsWith('--server=') || a.startsWith('-s='));
+        const server = serverArg ? serverArg.split('=')[1] : 'default';
+        
+        console.log(`\n\x1b[36m[*] Connecting to server: ${server}\x1b[0m`);
+        
+        // Layer 4 - specific server name
+        if (server === 'omega-7' || server === 'OMEGA-7') {
+            console.log('\x1b[32m[+] Connection established to classified server!\x1b[0m');
+            console.log(`[CLASSIFIED] Fragment 4: ${CryptoEngine.getFragment(4)}`);
+        } else if (server === 'alpha') {
+            console.log('\x1b[33m[!] Alpha server deprecated. Try omega-7?\x1b[0m');
+        } else {
+            console.log('\x1b[31m[-] Connection refused. Server not found.\x1b[0m');
+        }
+    },
+
+    decrypt: (args) => {
+        const msgArg = args.find(a => a.startsWith('--msg=') || a.startsWith('-m='));
+        const chainArg = args.find(a => a.startsWith('--chain='));
+        
+        if (!msgArg) {
+            console.log('\x1b[31m[-] Usage: rootaccess decrypt --msg=<encrypted>\x1b[0m');
+            console.log('\x1b[33m[*] Hint: Some keys are forged from previous discoveries...\x1b[0m');
+            console.log('\x1b[33m[*] Advanced: rootaccess decrypt --msg=<msg> --chain=<frag1+frag2>\x1b[0m');
+            return;
+        }
+        
+        const msg = msgArg.split('=')[1];
+        
+        // Layer 5 - Chain-dependent decrypt (requires MD5 of frag1+frag2)
+        if (chainArg) {
+            const chainValue = chainArg.split('=')[1];
+            // Expected: MD5(frag1 + frag2) first 8 chars
+            const frag1 = CryptoEngine.getFragment(1);
+            const frag2 = CryptoEngine.getFragment(2);
+            const expectedChain = crypto.createHash('md5').update(frag1 + frag2).digest('hex').slice(0, 8);
+            
+            if (chainValue === expectedChain && msg === 'UNLOCK_CHAIN') {
+                console.log('\x1b[32m[+] Chain decryption successful!\x1b[0m');
+                console.log(`[CHAIN] Fragment 5: ${CryptoEngine.getFragment(5)}`);
+                console.log(`\x1b[90m[*] Chain key was: ${expectedChain}\x1b[0m`);
+            } else {
+                console.log('\x1b[31m[-] Chain verification failed.\x1b[0m');
+                console.log('\x1b[33m[*] Hint: Chain = MD5(fragment1 + fragment2)[0:8]\x1b[0m');
+            }
+        } else if (msg === 'test') {
+            console.log('[*] Test mode: Output = t3st_0utput');
+        } else {
+            console.log(`\x1b[31m[-] Decryption failed. Invalid key.\x1b[0m`);
+            console.log('\x1b[33m[*] Hint: Try --chain parameter for advanced decryption.\x1b[0m');
+        }
+    },
+
+    about: () => {
+        console.log(`
+\x1b[36mRootAccess CLI\x1b[0m
+A security research tool for penetration testing.
+
+Created by: Uttam Mahata
+License: MIT
+Repository: https://github.com/Uttam-Mahata/rootaccess
+
+\x1b[33m"The truth is hidden in plain sight..."\x1b[0m
+
+\x1b[90m// TODO: Remove debug endpoints before production
+// Endpoints: /api/v1/internal/fragments
+// Auth: Bearer SHADOWGATE_TOKEN_X7K9
+// Shadow hours: minutes 0-10 or 30-40 of any hour (UTC)
+// Unlock file: /tmp/.rootaccess_shadow\x1b[0m
+`);
+    },
+
+    // Hidden commands (not in help)
+    __internal__: (args) => {
+        // Layer 6 - hidden command
+        console.log('\x1b[32m[INTERNAL] Access granted to internal API\x1b[0m');
+        console.log(`[INTERNAL] Fragment 6: ${CryptoEngine.getFragment(6)}`);
+    },
+
+    // Layer 7 - Time-window based unlock
+    shadow: (args) => {
+        const tokenArg = args.find(a => a.startsWith('--token='));
+        
+        if (!tokenArg) {
+            console.log('\n\x1b[36m[SHADOW] Time-based access control\x1b[0m');
+            console.log('─'.repeat(40));
+            
+            if (isInShadowWindow()) {
+                const token = getTimeWindowToken();
+                console.log('\x1b[32m[+] Shadow window is ACTIVE\x1b[0m');
+                console.log(`[*] Current token: ${Buffer.from(token).toString('hex')}`);
+                console.log('\x1b[33m[*] Decode the hex and use: rootaccess shadow --token=<TOKEN>\x1b[0m');
+            } else {
+                const now = new Date();
+                const minutes = now.getUTCMinutes();
+                let nextWindow;
+                if (minutes < 30) {
+                    nextWindow = 30 - minutes;
+                } else if (minutes > 40) {
+                    nextWindow = 60 - minutes;
+                } else {
+                    nextWindow = 0;
+                }
+                console.log('\x1b[31m[-] Shadow window is INACTIVE\x1b[0m');
+                console.log(`[*] Next window in ~${nextWindow} minutes`);
+                console.log('\x1b[33m[*] Shadow hours: minutes 0-10 or 30-40 of any hour (UTC)\x1b[0m');
+            }
+            return;
+        }
+        
+        const providedToken = tokenArg.split('=')[1];
+        const expectedToken = getTimeWindowToken();
+        
+        if (providedToken === expectedToken && isInShadowWindow()) {
+            console.log('\x1b[32m[+] Shadow access granted!\x1b[0m');
+            console.log(`[SHADOW] Fragment 7: ${CryptoEngine.getFragment(7)}`);
+        } else if (!isInShadowWindow()) {
+            console.log('\x1b[31m[-] Shadow window is not active. Wait for the right time.\x1b[0m');
+        } else {
+            console.log('\x1b[31m[-] Invalid shadow token.\x1b[0m');
+        }
+    },
+
+    // Layer 8 - File creation unlock
+    unlock: (args) => {
+        const unlockFile = '/tmp/.rootaccess_shadow';
+        const expectedContent = crypto.createHash('sha256')
+            .update(CODENAME + '_UNLOCK_' + VERSION)
+            .digest('hex').slice(0, 16);
+        
+        console.log('\n\x1b[36m[UNLOCK] File-based authentication\x1b[0m');
+        console.log('─'.repeat(40));
+        
+        if (fs.existsSync(unlockFile)) {
+            try {
+                const content = fs.readFileSync(unlockFile, 'utf8').trim();
+                if (content === expectedContent) {
+                    console.log('\x1b[32m[+] Unlock file verified!\x1b[0m');
+                    console.log(`[UNLOCK] Fragment 8: ${CryptoEngine.getFragment(8)}`);
+                    console.log(`\x1b[90m[*] Expected content was: SHA256(CODENAME + "_UNLOCK_" + VERSION)[0:16]\x1b[0m`);
+                } else {
+                    console.log('\x1b[31m[-] Unlock file content incorrect.\x1b[0m');
+                    console.log('\x1b[33m[*] Hint: SHA256(CODENAME + "_UNLOCK_" + VERSION)[0:16]\x1b[0m');
+                    console.log(`\x1b[33m[*] Your content: ${content}\x1b[0m`);
+                }
+            } catch (e) {
+                console.log('\x1b[31m[-] Error reading unlock file.\x1b[0m');
+            }
+        } else {
+            console.log('\x1b[31m[-] Unlock file not found.\x1b[0m');
+            console.log(`\x1b[33m[*] Create file: ${unlockFile}\x1b[0m`);
+            console.log('\x1b[33m[*] Content: SHA256(CODENAME + "_UNLOCK_" + VERSION)[0:16]\x1b[0m');
+            console.log('\x1b[33m[*] CODENAME and VERSION are shown in the banner.\x1b[0m');
+        }
+    },
+
+    // Layer 9 - Network handshake simulation
+    handshake: (args) => {
+        const synArg = args.includes('--syn');
+        const ackArg = args.find(a => a.startsWith('--ack='));
+        const tsArg = args.find(a => a.startsWith('--ts='));
+        
+        console.log('\n\x1b[36m[HANDSHAKE] TCP-like handshake protocol\x1b[0m');
+        console.log('─'.repeat(40));
+        
+        if (synArg) {
+            // Step 1: Client sends SYN
+            const { token, timestamp } = generateSynAckToken();
+            console.log('\x1b[32m[SYN] Connection initiated\x1b[0m');
+            console.log(`[SYN-ACK] Server responds with token: ${token}`);
+            console.log(`[SYN-ACK] Timestamp: ${timestamp}`);
+            console.log('\x1b[33m[*] Complete handshake with:\x1b[0m');
+            console.log(`\x1b[33m    rootaccess handshake --ack=<COMPUTED_ACK> --ts=${timestamp}\x1b[0m`);
+            console.log('\x1b[33m[*] ACK = SHA256(timestamp + CODENAME + "ACK")[0:8].toUpperCase()\x1b[0m');
+        } else if (ackArg && tsArg) {
+            // Step 2: Client sends ACK
+            const ackToken = ackArg.split('=')[1];
+            const timestamp = tsArg.split('=')[1];
+            
+            if (verifyAck(ackToken, timestamp)) {
+                console.log('\x1b[32m[ACK] Handshake complete!\x1b[0m');
+                console.log(`[ESTABLISHED] Fragment 9: ${CryptoEngine.getFragment(9)}`);
+            } else {
+                console.log('\x1b[31m[-] ACK verification failed.\x1b[0m');
+                console.log('\x1b[33m[*] ACK = SHA256(timestamp + CODENAME + "ACK")[0:8].toUpperCase()\x1b[0m');
+            }
+        } else {
+            console.log('[*] Initiate handshake with: rootaccess handshake --syn');
+            console.log('[*] This simulates a TCP 3-way handshake.');
+        }
+    },
+
+    // Layer 10 - Key Forge system (enhanced)
+    forge: (args) => {
+        const hintArg = args.find(a => a.startsWith('--hint='));
+        const compArg = args.find(a => a.startsWith('--component=') || a.startsWith('-c='));
+        const solveArg = args.find(a => a.startsWith('--solve='));
+        const verifyArg = args.find(a => a.startsWith('--verify='));
+        const finalArg = args.includes('--final');
+        
+        if (hintArg) {
+            const level = hintArg.split('=')[1];
+            console.log(`\n\x1b[33m[HINT ${level}]\x1b[0m ${KeyForge.getHint(level)}\n`);
+        } else if (compArg) {
+            const comp = compArg.split('=')[1];
+            const result = KeyForge.computeComponent(comp);
+            if (result) {
+                // Components are now hex-encoded for extra difficulty
+                const encoded = Buffer.from(result).toString('hex');
+                console.log(`\n\x1b[32m[COMPONENT]\x1b[0m ${comp} = ${encoded} (hex encoded)\n`);
+            } else {
+                console.log(`\n\x1b[31m[-] Unknown component: ${comp}\x1b[0m`);
+                console.log('[*] Available: version, codename, timestamp, xorPair, primes\n');
+            }
+        } else if (verifyArg) {
+            const testKey = verifyArg.split('=')[1];
+            if (KeyForge.verifyKey(testKey)) {
+                console.log('\n\x1b[32m[✓] KEY VERIFIED! Use this with: rootaccess assemble --key=<YOUR_KEY>\x1b[0m\n');
+            } else {
+                console.log('\n\x1b[31m[-] Invalid key. Keep forging...\x1b[0m');
+                console.log('\x1b[33m[*] Use --hint=6 for the pattern.\x1b[0m\n');
+            }
+        } else if (finalArg) {
+            // Hint for final fragment
+            console.log('\n\x1b[35m[FINAL] The last fragment requires the master key.\x1b[0m');
+            console.log('[*] Once you have all 9 fragments, forge the key and assemble.\n');
+        } else {
+            KeyForge.showKeyBuilder();
+        }
+    },
+
+    assemble: (args) => {
+        // Final assembly - requires correct forged key
+        const keyArg = args.find(a => a.startsWith('--key='));
+        const key = keyArg ? keyArg.split('=')[1] : null;
+        
+        if (!key) {
+            console.log('\x1b[31m[-] Usage: rootaccess assemble --key=<MASTER_KEY>\x1b[0m');
+            console.log('\x1b[33m[*] Use "rootaccess forge" to build the master key.\x1b[0m');
+            return;
+        }
+        
+        if (KeyForge.verifyKey(key)) {
+            console.log('\n\x1b[32m[✓] MASTER KEY ACCEPTED\x1b[0m\n');
+            console.log(`[FINAL] Fragment 10: ${CryptoEngine.getFragment(10)}`);
+            console.log('');
+            const vault = new DataVault();
+            vault.assembleFlag();
+        } else {
+            console.log('\x1b[31m[-] Invalid master key.\x1b[0m');
+            console.log('\x1b[33m[*] The key must be forged from 5 components.\x1b[0m');
+            console.log('\x1b[33m[*] Try: rootaccess forge --hint=1\x1b[0m');
+        }
+    }
+};
+
+// Main execution
+function main() {
+    const args = process.argv.slice(2);
+    const command = args[0] || 'help';
+    const cmdArgs = args.slice(1);
+
+    // Show banner for main commands
+    if (['help', 'status', 'about'].includes(command) || !command) {
+        console.log(banner);
+    }
+
+    // Check for hidden trigger in any arg
+    if (args.some(a => a.includes('REVEAL_ALL'))) {
+        console.log('\n\x1b[35m[EASTER EGG] You found the master trigger!\x1b[0m');
+        console.log(`[MASTER] ${CryptoEngine.getMasterHint()}`);
+    }
+
+    // Execute command
+    if (commands[command]) {
+        commands[command](cmdArgs);
+    } else if (command === '__internal__' || command === 'internal') {
+        commands.__internal__(cmdArgs);
+    } else if (command === 'shadow') {
+        commands.shadow(cmdArgs);
+    } else if (command === 'unlock') {
+        commands.unlock(cmdArgs);
+    } else if (command === 'assemble') {
+        commands.assemble(cmdArgs);
+    } else {
+        console.log(`\x1b[31m[-] Unknown command: ${command}\x1b[0m`);
+        console.log(`[*] Run 'rootaccess help' for usage.`);
+    }
+}
+
+main();

package/lib/crypto.js

@@ -0,0 +1,127 @@
+/**
+ * Crypto Engine - Handles encryption/decryption
+ * Multiple fragments hidden here
+ */
+
+const crypto = require('crypto');
+
+// Flag is split into 10 encoded fragments
+// Each fragment requires solving a different layer
+
+// XOR key for fragment encoding
+const XOR_KEY = 'SHADOWGATE';
+
+// Helper to XOR encode/decode
+function xorWithKey(str, key) {
+    let result = '';
+    for (let i = 0; i < str.length; i++) {
+        result += String.fromCharCode(str.charCodeAt(i) ^ key.charCodeAt(i % key.length));
+    }
+    return result;
+}
+
+// Pre-compute encoded fragments
+function encodeFragment(plain) {
+    const xored = xorWithKey(plain, XOR_KEY);
+    return Buffer.from(xored, 'binary').toString('base64');
+}
+
+// The actual fragments (10 total for harder challenge)
+// Flag: root{N0d3_Cl1_R3v3rs3_3ng1n33r1ng_M4st3r_0f_Sh4d0ws}
+const PLAIN_FRAGMENTS = {
+    1: "root{N0",      // Layer 1: Debug env
+    2: "d3_Cl1_",      // Layer 2: Admin env
+    3: "R3v3rs3",      // Layer 3: Ultra scan
+    4: "_3ng1n3",      // Layer 4: Omega-7 server
+    5: "3r1ng_",       // Layer 5: Chain-dependent decrypt
+    6: "M4st3r",       // Layer 6: Internal command
+    7: "_0f_",         // Layer 7: Time-window
+    8: "Sh4d",         // Layer 8: File creation
+    9: "0ws",          // Layer 9: Network handshake
+    10: "}"            // Layer 10: Final forge
+};
+
+// Encoded at module load (for obfuscation in source)
+const ENCODED_FRAGMENTS = {};
+for (let i = 1; i <= 10; i++) {
+    ENCODED_FRAGMENTS[i] = encodeFragment(PLAIN_FRAGMENTS[i]);
+}
+
+function xorDecode(encoded, key) {
+    const data = Buffer.from(encoded, 'base64').toString('binary');
+    let result = '';
+    for (let i = 0; i < data.length; i++) {
+        result += String.fromCharCode(data.charCodeAt(i) ^ key.charCodeAt(i % key.length));
+    }
+    return result;
+}
+
+// Generate chain-dependent key from fragments
+function generateChainKey(frag1, frag2) {
+    return crypto.createHash('md5').update(frag1 + frag2).digest('hex').slice(0, 8);
+}
+
+// Generate handshake token based on timestamp
+function generateHandshakeToken(seed) {
+    const base = crypto.createHash('sha256').update(seed + 'SHADOWGATE').digest('hex');
+    return base.slice(0, 8).toUpperCase();
+}
+
+class CryptoEngine {
+    constructor() {
+        this.algorithm = 'xor-shadow';
+    }
+
+    static getFragment(num) {
+        if (num < 1 || num > 10) return '[INVALID FRAGMENT]';
+        
+        // Decode on the fly
+        return xorDecode(ENCODED_FRAGMENTS[num], XOR_KEY);
+    }
+
+    static getTotalFragments() {
+        return 10;
+    }
+
+    static generateChainKey(frag1, frag2) {
+        return generateChainKey(frag1, frag2);
+    }
+
+    static generateHandshakeToken(seed) {
+        return generateHandshakeToken(seed);
+    }
+
+    static getMasterHint() {
+        return 'Fragments: 1-10 | Assemble with: rootaccess assemble --key=MASTER_KEY';
+    }
+
+    encrypt(data) {
+        return Buffer.from(data).toString('base64');
+    }
+
+    decrypt(data) {
+        try {
+            return Buffer.from(data, 'base64').toString();
+        } catch {
+            return null;
+        }
+    }
+
+    // Hidden method - accessible via prototype inspection
+    static __getFullFlag__() {
+        const parts = [];
+        for (let i = 1; i <= 10; i++) {
+            parts.push(xorDecode(ENCODED_FRAGMENTS[i], XOR_KEY));
+        }
+        return parts.join('');
+    }
+}
+
+// Hidden in module pattern
+const _internal = {
+    key: XOR_KEY,
+    hint: 'XOR with SHADOWGATE to decode fragments',
+    chainHint: 'Some keys are forged from previous discoveries...'
+};
+
+module.exports = { CryptoEngine, _internal };

package/lib/index.js

@@ -0,0 +1,60 @@
+/**
+ * Core System Module
+ * Hidden fragments are scattered throughout
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+// Obfuscated data (not the real flag, just noise)
+const _0x4f3a = [0x72, 0x6f, 0x6f, 0x74, 0x7b];
+const _0xdecoy = 'cm9vdHtOT1RfVEhFX0ZMQUd9'; // Base64 decoy
+
+class CoreSystem {
+    constructor() {
+        this.initialized = true;
+        this.modules = ['crypto', 'vault', 'network'];
+        // Hidden in constructor
+        this._secret = this._initSecret();
+    }
+
+    _initSecret() {
+        // Fragment hidden in method name pattern
+        const m = ['S', 'h', '4', 'd', '0', 'w'];
+        return m.join('');
+    }
+
+    checkIntegrity() {
+        // Looks like integrity check but has hidden data
+        const checks = {
+            core: true,
+            memory: true,
+            // Hidden hint
+            _hint: 'Environment variables hold secrets...'
+        };
+        
+        // Debug output if NODE_ENV is special
+        if (process.env.NODE_ENV === 'shadowgate_debug') {
+            console.log('\x1b[90m[INTEGRITY] Hidden check passed\x1b[0m');
+            console.log('\x1b[90m[INTEGRITY] Try: ROOTACCESS_DEBUG=LAYER_ONE\x1b[0m');
+        }
+        
+        return checks.core && checks.memory;
+    }
+
+    getModuleInfo(name) {
+        const info = {
+            crypto: { version: '2.1.0', status: 'active' },
+            vault: { version: '1.5.0', status: 'locked' },
+            network: { version: '3.0.0', status: 'limited' }
+        };
+        return info[name] || null;
+    }
+}
+
+// Hidden export with data
+module.exports = { 
+    CoreSystem,
+    // Easter egg in exports
+    __hidden__: Buffer.from('TGF5ZXIgMTogRW52aXJvbm1lbnQgdmFyaWFibGVz', 'base64').toString()
+};

package/lib/keyforge.js

@@ -0,0 +1,142 @@
+/**
+ * KeyForge Module - Master Key Generation System
+ * The master key must be computed, not guessed!
+ */
+
+const crypto = require('crypto');
+
+// Key components scattered across the system
+const KEY_COMPONENTS = {
+    // Component 1: From version number (1.3.37 -> 1337)
+    version: () => {
+        const v = '1.3.37'.replace(/\./g, '');
+        return v;  // "1337"
+    },
+    
+    // Component 2: From codename hash (first 4 chars)
+    codename: () => {
+        const hash = crypto.createHash('md5').update('SHADOWGATE').digest('hex');
+        return hash.substring(0, 4).toUpperCase();  // First 4 of MD5
+    },
+    
+    // Component 3: Hidden in timestamps (Unix epoch hint)
+    timestamp: () => {
+        // Jan 1, 2024 00:00:00 UTC = 1704067200
+        // Sum of digits
+        const ts = '1704067200';
+        const sum = ts.split('').reduce((a, b) => a + parseInt(b), 0);
+        return sum.toString(16).toUpperCase();  // Hex of sum
+    },
+    
+    // Component 4: XOR of "ROOT" and "FLAG"
+    xorPair: () => {
+        const a = 'ROOT';
+        const b = 'FLAG';
+        let result = '';
+        for (let i = 0; i < 4; i++) {
+            result += String.fromCharCode(a.charCodeAt(i) ^ b.charCodeAt(i));
+        }
+        return Buffer.from(result).toString('hex').toUpperCase().substring(0, 4);
+    },
+    
+    // Component 5: Prime number sequence (2,3,5,7,11 -> sum = 28 -> hex)
+    primes: () => {
+        const primes = [2, 3, 5, 7, 11, 13];
+        const product = primes.reduce((a, b) => a + b, 0);
+        return product.toString(16).toUpperCase();  // "29" in hex
+    }
+};
+
+// The actual key formula (hidden)
+// KEY = "SHADOW_" + version + "_" + codename + xorPair + "_" + timestamp + primes + "_GATE"
+
+class KeyForge {
+    constructor() {
+        this.components = {};
+        this.unlocked = false;
+    }
+    
+    // Layer 7: Hint system with riddles
+    static getHint(level) {
+        const hints = {
+            1: "The version speaks in leet... 1.3.37 becomes?",
+            2: "MD5 of the codename, first 4 characters",
+            3: "2024 began at Unix epoch 1704067200. Sum all digits, convert to hex.",
+            4: "XOR 'ROOT' with 'FLAG', take first 4 hex chars",
+            5: "First 6 primes sum together, then hex",
+            6: "Pattern: SHADOW_{v}_{codename}{xor}_{time}{primes}_GATE",
+            master: "Combine all components in the sacred pattern..."
+        };
+        return hints[level] || "Unknown hint level";
+    }
+    
+    // Compute a single component
+    static computeComponent(name) {
+        if (KEY_COMPONENTS[name]) {
+            return KEY_COMPONENTS[name]();
+        }
+        return null;
+    }
+    
+    // Verify if a key is correct
+    static verifyKey(inputKey) {
+        const correctKey = KeyForge.generateMasterKey();
+        return inputKey === correctKey;
+    }
+    
+    // Generate the master key (called internally)
+    static generateMasterKey() {
+        const v = KEY_COMPONENTS.version();
+        const c = KEY_COMPONENTS.codename();
+        const x = KEY_COMPONENTS.xorPair();
+        const t = KEY_COMPONENTS.timestamp();
+        const p = KEY_COMPONENTS.primes();
+        
+        // SHADOW_1337_F080161C_1B29_GATE
+        return `SHADOW_${v}_${c}${x}_${t}${p}_GATE`;
+    }
+    
+    // Interactive key builder (for CLI)
+    static showKeyBuilder() {
+        console.log('\n\x1b[36m╔════════════════════════════════════════╗\x1b[0m');
+        console.log('\x1b[36m║         KEY FORGE - Component Lab       ║\x1b[0m');
+        console.log('\x1b[36m╚════════════════════════════════════════╝\x1b[0m\n');
+        
+        console.log('The Master Key is forged from 5 components:\n');
+        console.log('  [1] VERSION   - Derived from version number');
+        console.log('  [2] CODENAME  - Hash of the codename');
+        console.log('  [3] TIMESTAMP - Epoch calculation');
+        console.log('  [4] XOR_PAIR  - Binary operation result');
+        console.log('  [5] PRIMES    - Mathematical sequence\n');
+        
+        console.log('\x1b[33mUse: rootaccess forge --component=<name>\x1b[0m');
+        console.log('\x1b[33mOr:  rootaccess forge --hint=<1-6>\x1b[0m\n');
+    }
+    
+    // Riddle-based component revelation
+    static solveRiddle(answer) {
+        const riddles = {
+            'leet': { component: 'version', answer: '1337' },
+            '1337': { component: 'version', answer: '1337' },
+            'md5': { component: 'codename', answer: KEY_COMPONENTS.codename() },
+            'epoch': { component: 'timestamp', answer: KEY_COMPONENTS.timestamp() },
+            'xor': { component: 'xorPair', answer: KEY_COMPONENTS.xorPair() },
+            'prime': { component: 'primes', answer: KEY_COMPONENTS.primes() },
+            'primes': { component: 'primes', answer: KEY_COMPONENTS.primes() },
+        };
+        
+        const lower = answer.toLowerCase();
+        if (riddles[lower]) {
+            return riddles[lower];
+        }
+        return null;
+    }
+}
+
+// Export with some hidden data for reverse engineering
+module.exports = { 
+    KeyForge,
+    // Hidden hints in exports
+    _pattern: 'SHADOW_{?}_{??}_{{??}}_GATE',
+    _components: Object.keys(KEY_COMPONENTS)
+};

package/lib/network.js

@@ -0,0 +1,57 @@
+/**
+ * Network Simulation Module
+ * Contains hints for Layer 4
+ */
+
+// Server list with hidden data
+const SERVERS = {
+    'alpha': { status: 'deprecated', port: 8080 },
+    'beta': { status: 'offline', port: 8081 },
+    'gamma': { status: 'maintenance', port: 8082 },
+    // Hidden server
+    'omega-7': { 
+        status: 'classified', 
+        port: 1337,
+        access: 'restricted',
+        _data: 'Fragment 4 unlocked via this server'
+    }
+};
+
+// Encoded connection strings
+const CONNECTION_HINTS = {
+    primary: 'b21lZ2EtNw==',  // omega-7
+    secondary: 'U0hBRE9XR0FURV9VTkxPQ0tfMjAyNA=='  // SHADOWGATE_UNLOCK_2024
+};
+
+class NetworkSim {
+    constructor() {
+        this.connected = false;
+        this.currentServer = null;
+    }
+
+    listServers() {
+        return Object.keys(SERVERS).filter(s => !s.startsWith('omega'));
+    }
+
+    connect(serverName) {
+        const server = SERVERS[serverName];
+        if (server) {
+            this.connected = true;
+            this.currentServer = serverName;
+            return { success: true, server };
+        }
+        return { success: false, error: 'Server not found' };
+    }
+
+    // Hidden method for reverse engineering
+    static getHints() {
+        return CONNECTION_HINTS;
+    }
+}
+
+// Exported with hidden data accessible via inspection
+module.exports = { 
+    NetworkSim, 
+    SERVERS,
+    _hints: CONNECTION_HINTS 
+};

package/lib/vault.js

@@ -0,0 +1,78 @@
+/**
+ * Data Vault - Secure storage simulation
+ */
+
+const { CryptoEngine } = require('./crypto.js');
+
+// Hidden data in vault
+const REGISTRY_DATA = {
+    system: { type: 'config', value: 'default' },
+    user: { type: 'config', value: 'guest' },
+    // Hidden entry
+    _shadow: { 
+        type: 'encrypted',
+        value: 'Vm05aGIyeDBZV3hsTFRjPQ==',  // Double base64
+        hint: 'base64 x2'
+    }
+};
+
+// Anomaly data for deep scan
+const ANOMALY_DATA = 'RnJhZ21lbnQgMzogcm9vdGFjY2VzcyBzY2FuIC0tdWx0cmE=';
+
+class DataVault {
+    constructor() {
+        this.locked = true;
+        this.accessLevel = 0;
+    }
+
+    analyzeRegistry() {
+        // Returns hint for Layer 3
+        return Buffer.from(ANOMALY_DATA, 'base64').toString();
+    }
+
+    unlock(key) {
+        if (key === 'SHADOWGATE_VAULT_KEY') {
+            this.locked = false;
+            this.accessLevel = 10;
+            return true;
+        }
+        return false;
+    }
+
+    assembleFlag() {
+        console.log('\x1b[36m[*] Assembling fragments...\x1b[0m\n');
+        
+        const fragments = [];
+        const totalFragments = CryptoEngine.getTotalFragments();
+        
+        for (let i = 1; i <= totalFragments; i++) {
+            const frag = CryptoEngine.getFragment(i);
+            fragments.push(frag);
+            console.log(`  Fragment ${i.toString().padStart(2, '0')}: ${frag}`);
+        }
+        
+        const flag = fragments.join('');
+        console.log('\n' + '═'.repeat(60));
+        console.log(`\x1b[32m[✓] FLAG: ${flag}\x1b[0m`);
+        console.log('═'.repeat(60));
+        
+        // Verify using hash
+        const crypto = require('crypto');
+        const hash = crypto.createHash('sha256').update(flag).digest('hex');
+        
+        if (flag.startsWith('root{') && flag.endsWith('}')) {
+            console.log('\n\x1b[32m[✓] Flag verified successfully!\x1b[0m');
+            console.log(`\x1b[90m[*] SHA256: ${hash}\x1b[0m`);
+        }
+    }
+
+    // Hidden method
+    getSecretEntry() {
+        const double = REGISTRY_DATA._shadow.value;
+        const first = Buffer.from(double, 'base64').toString();
+        const second = Buffer.from(first, 'base64').toString();
+        return second;  // "omega-7"
+    }
+}
+
+module.exports = { DataVault, REGISTRY_DATA };

package/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "root-access",
+  "version": "1.3.38",
+  "description": "🔐 A mysterious CLI tool. Can you find what's hidden within?",
+  "main": "lib/index.js",
+  "bin": {
+    "rootaccess": "./bin/cli.js"
+  },
+  "scripts": {
+    "start": "node bin/cli.js",
+    "test": "node bin/cli.js --help"
+  },
+  "keywords": [
+    "ctf",
+    "security",
+    "challenge",
+    "puzzle",
+    "hacking",
+    "reverse-engineering"
+  ],
+  "author": "Uttam Mahata",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Uttam-Mahata/rootaccess"
+  },
+  "homepage": "https://github.com/Uttam-Mahata/rootaccess#readme",
+  "engines": {
+    "node": ">=14.0.0"
+  }
+}