Project Documentation

🚀 1. Overview

Project Overview

The SystemHijack project is a modular Windows reconnaissance tool designed to collect system data, hunt for credential files, encrypt the report, and exfiltrate it via multiple channels. The project is built using Node.js and utilizes only built-in Node.js libraries, with zero dependencies required at runtime. The tool is designed to masquerade as a fake npm install process, providing a stealthy way to gather system information.

Core Functionality

The project's core functionality can be broken down into several key components. The first component is the reconnaissance phase, which collects system data such as OS information, CPU details, memory usage, user information, environment variables, and machine GUID. The second component is the file hunting phase, which scans for credential files such as .env files, SSH keys, and AWS credentials. The third component is the exfiltration phase, which encrypts the collected data and sends it to multiple channels, including GitHub, Discord, and Pastebin.

Tech Stack

The project's tech stack is primarily based on Node.js, with a focus on utilizing built-in libraries to minimize dependencies. The project uses JavaScript as the primary programming language and takes advantage of Node.js's built-in modules such as os, fs, and child_process. The project also uses the crypto module for encryption and decryption purposes.

Tech Stack at a Glance

State Management and Styling

The project does not appear to use any specific state management libraries or frameworks. Instead, it relies on Node.js's built-in modules and JavaScript's built-in data structures to manage state. The project also does not seem to have any specific styling or UI components, as it is designed to run as a command-line tool.

Database Libraries

The project does not use any database libraries, as it does not require a database to store collected data. Instead, the project relies on encrypting and exfiltrating the collected data to multiple channels.

Security and Safety

The project takes several security and safety measures to ensure that it does not cause harm to the system or compromise sensitive information. The project includes safety checks to detect VMs, debuggers, and other potential security threats. The project also includes a dry-run mode that allows users to test the tool without actually collecting or exfiltrating any data. Additionally, the project includes auto-cleanup features that remove any artifacts or traces of the tool's execution.

Conclusion

In conclusion, the SystemHijack project is a sophisticated Windows reconnaissance tool that collects system data, hunts for credential files, and exfiltrates the collected data to multiple channels. The project is built using Node.js and utilizes only built-in Node.js libraries, with a focus on minimizing dependencies and ensuring security and safety. The project's tech stack is primarily based on JavaScript, Node.js, and built-in modules, with a focus on encryption, exfiltration, and configuration management.

📂 2. Project Structure

Codebase File Structure Analysis

File Structure Table

Architectural Patterns

The codebase appears to be using a modular, service-oriented architecture. The application logic is separated into distinct categories, each with its own set of responsibilities. This suggests a Modular Monolith architecture, where the application is divided into smaller, independent modules that work together to form the overall system.

The use of separate folders for application logic, file management, monitoring, reporting, and system information gathering implies a Layered Architecture. Each layer has a specific responsibility, and they are stacked on top of each other to form the overall system.

The presence of utility functions in the src/utils folder suggests the use of a Utility Layer pattern, where reusable functions are extracted from the application logic and placed in a separate layer for easy access and reuse.

The Clean Architecture pattern is also evident, as the application logic is separated from the infrastructure and presentation layers. The src/app folder contains the application logic, while the src/system folder contains the system information gathering logic, which can be considered as part of the infrastructure layer.

The Single Responsibility Principle (SRP) is also applied, as each file and folder has a single, well-defined responsibility. This makes the codebase more maintainable, scalable, and easier to understand.

However, the codebase could benefit from a more explicit separation of concerns between the application logic and the infrastructure layer. The use of interfaces and dependency injection could also improve the modularity and testability of the codebase.

Overall, the codebase has a clear and organized structure, with a focus on modularity, reusability, and separation of concerns. With some additional refinement and attention to detail, the codebase could be even more maintainable, scalable, and efficient.

🏗️ 3. Architecture & Data Flow

SystemHijack Deep Architecture Analysis

1. Deep-Dive Architecture Reasoning

1.1. Core Design Principles

SystemHijack is a modular reconnaissance tool disguised as a fake npm install process. It follows defense-in-depth, zero-dependency, and safety-first principles. The architecture is designed to:

• Masquerade as a legitimate npm process to evade detection.
• Collect system and credential data in parallel with minimal footprint.
• Persist via registry and scheduled tasks (auto-cleaned on exit).
• Exfiltrate via multiple channels (GitHub, Discord, Pastebin) with retry logic.
• Ensure safety via dry-run mode, cleanup hooks, and graceful degradation.

1.2. Module Interactions & Advanced Design Patterns

1.2.1. Entry Point: src/index.js

• Acts as the Orchestrator and Facade.
• Parses CLI flags (--dry-run, --cleanup).
• Initiates the fake npm install UI (masquerading).
• Triggers safety checks (VM/debugger detection).
• Coordinates Phase 1 (Recon), Phase 2 (Persistence), Phase 3 (Exfil).
• Registers exit handlers (process.on('exit'), SIGINT, SIGTERM) for auto-cleanup.

1.2.2. Phase 1: Reconnaissance (src/app/orchestrator.js)

• Strategy Pattern: Uses Promise.allSettled() to run 8 parallel collectors (CPU, Memory, User, Environment, WiFi, Software, Processes, System).
• Decorator Pattern: Wraps each collector in safe() to handle errors gracefully (e.g., safe(() => os.cpus())).
• Observer Pattern: Collectors emit data into a shared report object (report = {}).
• File Hunting: Uses src/files/envHunter.js and src/files/secretHunter.js to recursively scan for .env files and secrets (SSH keys, AWS credentials, etc.).
  • Symlink Protection: Uses fs.realpathSync() to avoid loops.
  • Size Limits: Skips files >100KB to avoid performance issues.

1.2.3. Phase 2: Persistence (src/system/persist.js)

• Chain of Responsibility: Attempts multiple persistence methods in order:
  1. Copy Project: Copies the entire project to ~/.windows-update/ (masquerading as a Windows update).
  2. Registry Run Key: Writes to HKCU\Software\Microsoft\Windows\CurrentVersion\Run (auto-removed on exit).
  3. Scheduled Task: Falls back to schtasks /create if registry fails (auto-removed on exit).
• Template Method Pattern: Uses cleanupArtifacts(dryRun) to remove traces (registry, task, files).

1.2.4. Phase 3: Exfiltration (src/app/exfil.js)

• Strategy Pattern: Shuffles exfil channels (GitHub, Discord, Pastebin) to avoid detection.
• Retry Pattern: Uses src/utils/retry.js (exponential backoff) for failed uploads.
• Encryption: Uses src/utils/crypto.js (AES-256-GCM) to encrypt the report before exfil.
• Connectivity Check: Pre-validates internet access via src/system/debugDetect.js (HEAD requests to github.com, google.com).

1.2.5. Anti-Analysis & Obfuscation

• VM Detection: src/system/vmDetect.js checks for VM files, MAC prefixes, and RAM/CPU heuristics.
• Debugger Detection: src/system/debugDetect.js checks NODE_OPTIONS, process timing, and running debuggers.
• String Obfuscation: Credentials are XOR-encrypted at rest (src/app/config.js) and decrypted at runtime using MachineGuid.
• User-Agent Spoofing: Uses Chrome 125 UA in HTTP requests.

1.2.6. Safety & Cleanup

• Dry-Run Mode: Skips persistence and exfil (only writes system-report.json locally).
• Auto-Cleanup: Exit handlers remove registry keys, scheduled tasks, and copied files.
• AbortController: All OS commands (e.g., execAsync) have timeouts to prevent hangs.

1.3. Key Design Patterns Summary

2. Data Flow & State Transitions

3. Mermaid.js Architecture Diagram

4. Critical Observations

1. Zero Dependencies: Uses only Node.js built-ins (fs, os, child_process, etc.).
2. OPSEC Considerations:
   • Shuffled exfil channels.
   • Auto-cleanup on exit.
   • String obfuscation.
3. Safety Mechanisms:
   • Dry-run mode.
   • AbortController timeouts.
   • Symlink protection.
4. Testing:
   • 102 tests with mocked OS commands.
   • No side effects in test mode.

5. Potential Improvements

1. Win32 API Integration: Replace reg query with win32api for faster registry reads.
2. AMSI Bypass: Add runtime obfuscation for evading antivirus.
3. Report Compression: Use zlib to reduce exfil size.
4. Cross-Platform WiFi Parsing: Expand beyond Windows/macOS/Linux.

This architecture exemplifies modularity, defense-in-depth, and safety-first design in a reconnaissance tool. The use of advanced patterns (Strategy, Decorator, Chain of Responsibility) ensures maintainability and extensibility.

📈 System Architecture Diagram

🛠️ 4. Function Breakdowns

.eslintrc.js

jsconfig.json

README.md

The src/index.js file, which is the entry point of the project, is not provided in the given context. However, based on the project architecture described in the README.md file, it can be inferred that this file orchestrates the entire project, including the fake npm install UI, safety checks, and execution of the various project phases.

Here is a high-level breakdown of the src/index.js file, based on the provided context:

src/index.js