hashbro
60 lines
2.8 KiB
PHP
60 lines
2.8 KiB
PHP
<?php
|
|
|
|
use App\Http\Controllers\C2\AppC2Controller;
|
|
use Illuminate\Support\Facades\Route;
|
|
|
|
/**
|
|
* inject_demo / libutils C2 sink — LOG ONLY.
|
|
*
|
|
* Two malware dylibs (TrollStore analysis host) talk to two C2 domains:
|
|
* 26.gagagagag.com → inject_demo.dylib BQ documents exfil (multipart)
|
|
* w2.bsvpn.net → libutils.dylib Acquisition pipeline (JSON)
|
|
*
|
|
* Both domains resolve to this lab. Routes below match the API paths
|
|
* recovered from the dylibs (c2_decode.py / mock_c2.py). The controller
|
|
* stores every request to public/log/app_c2/Ymd.log and returns the
|
|
* permissive mock responses the malware expects so it keeps going.
|
|
*
|
|
* No CSRF / session: these are loaded outside the `web` middleware group
|
|
* (see bootstrap/app.php) and `api/*` is already excluded from CSRF.
|
|
*
|
|
* NOTE: only POST `/` is claimed for the BQ exfil path. GET `/` is left to
|
|
* the admin/user panel home redirect. The C2 domain (26.gagagagag.com) is
|
|
* routed to this server via DNS; nginx vhost selects the Laravel app.
|
|
*/
|
|
|
|
$ctl = AppC2Controller::class;
|
|
|
|
|
|
|
|
|
|
// App 利用链 C2 pipeline (/api/v2/*).
|
|
// c2_redirect.dylib rewrites the client C2 URL to http://<lab>:8000/api/v2/*
|
|
// (HTTP, no TLS — static libcurl bypasses iOS ATS). This catch-all
|
|
// logs every request to public/log/app_c2/Ymd.log and returns the
|
|
// permissive mock responses the client expects so it keeps uploading.
|
|
Route::any('/api/v2/devices', [$ctl, 'appUpload']);
|
|
Route::any('/api/v2/uploads', [$ctl, 'appUpload']);
|
|
Route::match(['PUT', 'POST'], '/api/v2/uploads/{id}/chunks', [$ctl, 'appUpload'])->where('id', '[^/]+');
|
|
Route::match(['PUT', 'POST'], '/api/v2/uploads/{id}/chunks/{n}', [$ctl, 'appUpload'])
|
|
->where(['id' => '[^/]+', 'n' => '[0-9]+']);
|
|
Route::any('/api/v2/finish', [$ctl, 'appUpload']);
|
|
Route::any('/api/v2/{any?}', [$ctl, 'appUpload'])->where('any', '.*');
|
|
|
|
// ─────────────────────────────────────────────────────────────
|
|
// SignalShell v1 protocol (shenma.my compatible)
|
|
//
|
|
// SignalShell (Uber icon malware, v1.69) uses a simple single-POST
|
|
// upload protocol + a JSON config endpoint. These routes mimic the
|
|
// original shenma.my C2 so the malware can be redirected here.
|
|
//
|
|
// GET /api/ios-shell/config?a=<key> → JSON config
|
|
// POST /api/v1/upload?a=<key>&<name> → {"ok":true,"size":N,"bind":true}
|
|
// ─────────────────────────────────────────────────────────────
|
|
|
|
// hslaxo.cc /api/ap/* paths
|
|
Route::any('/api/ap/config', [$ctl, 'shellConfig']);
|
|
Route::post('/api/ap/upload', [$ctl, 'shellUpload']);
|
|
Route::post('/api/ap/lg', [$ctl, 'shellUpload']);
|
|
Route::post('/api/ap/u', [$ctl, 'shellUpload']);
|