Spaces:

1234ty
/

Ai_TANZ

Runtime error

App Files Files Community

1234ty commited on Jun 23

Commit

ca3ced9

verified ·

1 Parent(s): e8da710

Create app.py

Browse files

Files changed (1) hide show

app.py +400 -0

app.py ADDED Viewed

	@@ -0,0 +1,400 @@

+import time, base64, hashlib, re
+from fastapi import FastAPI, Request, HTTPException
+from fastapi.responses import HTMLResponse
+from fastapi.middleware.cors import CORSMiddleware
+from sqlitedict import SqliteDict
+app = FastAPI()
+# --- เปิด CORS เพื่อให้หน้าเว็บจริงทำงานร่วมกับ Hugging Face ได้อย่างเสถียร ---
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=["*"],
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+# --- CONFIGURATION ---
+TARGET_WEBSITE_URL = "https://rov3.vercel.app"
+FIREWALL_DB = "firewall.sqlite"
+MAX_REQUESTS_PER_MINUTE = 20
+BLOCK_TIME_SECONDS = 3600
+SECRET_KEY = "TANZAi_SUPER_SECRET"
+BOT_BLACKLIST = [
+    "sqlmap", "nmap", "dirbuster", "nikto", "hound", "scan", "headless",
+    "python-requests", "go-http-client", "java/", "curl/", "wget", "zmeu",
+    "masscan", "acunetix", "netsparker", "openvas", "censys", "shodan"
+]
+def get_client_ip(request: Request):
+    for header in ["cf-connecting-ip", "x-real-ip", "x-forwarded-for"]:
+        value = request.headers.get(header)
+        if value:
+            return value.split(',')[0].strip()
+    return request.client.host
+def generate_token(ip):
+    time_window = int(time.time() / 600)
+    return hashlib.md5(f"{ip}{SECRET_KEY}{time_window}".encode()).hexdigest()
+def is_blocked(ip):
+    with SqliteDict(FIREWALL_DB, autocommit=True) as db:
+        if ip in db:
+            blocked_until = db[ip].get("blocked_until", 0)
+            if blocked_until > time.time(): return True
+            else: del db[ip]
+    return False
+def check_rate_limit_and_block(ip):
+    with SqliteDict(FIREWALL_DB, autocommit=True) as db:
+        data = db.get(ip, {"count": 0, "first_request": time.time()})
+        data["count"] += 1
+        db[ip] = data
+        if time.time() - data["first_request"] > 60:
+            del db[ip]
+            return
+        if data["count"] > MAX_REQUESTS_PER_MINUTE:
+            data["blocked_until"] = time.time() + BLOCK_TIME_SECONDS
+            db[ip] = data
+def cyber_security_waf(request: Request):
+    user_agent = request.headers.get("user-agent", "").lower()
+    if not user_agent or len(user_agent) < 10:
+        return False
+    for bot in BOT_BLACKLIST:
+        if bot in user_agent:
+            return False
+    if not request.headers.get("accept"):
+        return False
+    return True
+# หน้า UI ด่านตรวจ (ดึงปุ่มและ UI ตัว AI ออกไปเพื่อรอโหลดผ่านระบบสคริปต์ตามไปที่หน้าเว็บหลัก)
+def generate_challenge_html(ip):
+    token = generate_token(ip)
+    html = f"""
+<!DOCTYPE html>
+<html lang="th">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>TANZAi | กำลังทำการตรวจสอบความปลอดภัย</title>
+    <style>
+        body {{ font-family: -apple-system, system-ui, sans-serif; background: white; color: black; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0; text-align: center; overflow: hidden; position: relative; }}
+        .container {{ max-width: 500px; width: 90%; position: relative; z-index: 10; }}
+        h1 {{ font-size: 40px; font-weight: 500; margin-bottom: 0px; color: #10b981; }}
+        h2 {{ font-size: 28px; font-weight: 500; margin-top: 10px; margin-bottom: 5px; }}
+        p {{ font-size: 16px; color: #555; line-height: 1.4; }}
+        #cf-widget-container {{ border: 1px solid #ddd; border-radius: 8px; background: #fafafa; padding: 15px; display: flex; align-items: center; justify-content: space-between; margin-top: 25px; }}
+        .cf-left {{ display: flex; align-items: center; }}
+        .cf-logo {{ width: 100px; filter: hue-rotate(140deg); }}
+        .cf-ip-info {{ font-size: 12px; color: #666; margin-top: 20px; }}
+        .captcha-box {{ display: flex; align-items: center; cursor: pointer; user-select: none; }}
+        .captcha-checkbox {{ width: 24px; height: 24px; border: 2px solid #ccc; border-radius: 4px; margin-right: 12px; display: flex; align-items: center; justify-content: center; background: #ffffff; transition: all 0.2s ease; }}
+        .captcha-box:hover .captcha-checkbox {{ border-color: #10b981; }}
+        .captcha-checkbox.checked {{ background: #10b981; border-color: #10b981; }}
+        .captcha-checkbox.checked::after {{ content: '✔'; color: white; font-size: 14px; font-weight: bold; }}
+        .cf-spinner {{ border: 4px solid #eee; border-top: 4px solid #10b981; border-radius: 50%; width: 25px; height: 25px; animation: spin 1s linear infinite; margin-right: 15px; display: none; }}
+        @keyframes spin {{ 0% {{ transform: rotate(0deg); }} 100% {{ transform: rotate(360deg); }} }}
+    </style>
+    <script>
+        if (window.top !== window.self) {{
+            let attackerUrl = "เว็บไซต์อื่น";
+            if (location.ancestorOrigins && location.ancestorOrigins.length > 0) {{
+                try {{ attackerUrl = new URL(location.ancestorOrigins[0]).hostname; }} catch(e) {{}}
+            }} else if (document.referrer) {{
+                try {{ attackerUrl = new URL(document.referrer).hostname; }} catch(e) {{}}
+            }}
+            if (!attackerUrl.includes("hf.space") && !attackerUrl.includes("vercel.app") && !attackerUrl.includes("localhost")) {{
+                window.stop();
+                document.documentElement.innerHTML = '<div style="font-family:-apple-system,sans-serif;background:white;color:black;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;text-align:center;"><div style="max-width:500px;width:90%;"><h1 style="font-size:40px;color:#ef4444;margin:0;">TANZAi</h1><h2 style="font-size:22px;margin-top:15px;color:#ef4444;">ตรวจพบว่า [' + attackerUrl + '] ทำการดึงหน้าเว็บไซต์เราไปแสดง</h2><p style="color:#555;font-size:16px;line-height:1.5;margin-top:10px;">จะไม่สามารถใช้งานเว็บไซต์จนกว่า [' + attackerUrl + '] จะแก้ไข</p></div></div>';
+            }}
+        }}
+    </script>
+</head>
+<body>
+    <div class="container">
+        <h1>TANZAi</h1>
+        <h2>กำลังทำการตรวจสอบความปลอดภัย</h2>
+        <p>กรุณาติ๊กเลือกช่องด้านล่างเพื่อยืนยันว่าคุณไม่ใช่สคริปต์อัตโนมัติ</p>
+        <div id="cf-widget-container">
+            <div class="cf-left">
+                <div class="cf-spinner" id="main-spinner"></div>
+                <div id="status-area">
+                    <div class="captcha-box" id="click-target" onclick="triggerChallenge()">
+                        <div class="captcha-checkbox" id="check-visual"></div>
+                        <span style="font-size: 15px; color: #333; font-weight: 500;" id="captcha-text-label">ฉันไม่ใช่โปรแกรมอัตโนมัติ</span>
+                    </div>
+                </div>
+            </div>
+            <div class="cf-right">
+                <img src="https://upload.wikimedia.org/wikipedia/commons/4/4b/Cloudflare_Logo.svg" alt="Cloudflare" class="cf-logo">
+            </div>
+        </div>
+        <div class="cf-ip-info">IP ของคุณ: {ip}</div>
+    </div>
+    <script src="/js?tz_token={token}"></script>
+    <script>
+        let isProcessing = false;
+        async function triggerChallenge() {{
+            if(isProcessing) return;
+            isProcessing = true;
+            document.getElementById('check-visual').classList.add('checked');
+            setTimeout(async () => {{
+                document.getElementById('click-target').style.display = 'none';
+                document.getElementById('main-spinner').style.display = 'block';
+                const statusArea = document.getElementById('status-area');
+                statusArea.innerHTML = '<span id="status-text" style="font-size:14px;">กำลังตรวจสอบคุณลักษณะของเบราว์เซอร์...</span>';
+                if (navigator.webdriver || !navigator.userAgent || window.__selenium_evaluate || window.__selenium_unwrapped) {{
+                    document.getElementById('status-text').innerText = "ตรวจพบสคริปต์อัตโนมัติ (Security Blocked)!";
+                    return;
+                }}
+                try {{
+                    const res = await fetch('/get_token');
+                    if(res.status == 403) {{ window.location.reload(); return; }}
+                    const data = await res.json();
+                    if(data.token) {{
+                        document.getElementById('status-text').innerText = "ตรวจสอบสำเร็จ! กำลังนำทาง...";
+                        setTimeout(() => {{
+                            window.location.href = "{TARGET_WEBSITE_URL}?tz_token=" + data.token;
+                        }}, 500);
+                    }} else {{ location.reload(); }}
+                }} catch(e) {{ location.reload(); }}
+            }}, 400);
+        }}
+    </script>
+</body>
+</html>
+    """
+    return HTMLResponse(content=html)
+@app.get("/")
+async def gatekeeper(request: Request, authorized: str = None):
+    ip = get_client_ip(request)
+    if not cyber_security_waf(request):
+        raise HTTPException(status_code=400, detail="Bad Request - Security Violation")
+    if is_blocked(ip):
+        raise HTTPException(status_code=403, detail="คุณถูกระงับการเข้าถึงชั่วคราว")
+    check_rate_limit_and_block(ip)
+    return generate_challenge_html(ip)
+@app.get("/verify")
+async def verify(token: str, request: Request):
+    ip = get_client_ip(request)
+    if is_blocked(ip):
+        return {"status": "error", "valid": False, "banned": True}
+    is_valid = (token == generate_token(ip))
+    return {"status": "ok" if is_valid else "error", "valid": is_valid, "banned": False}
+@app.get("/get_token")
+async def get_token(request: Request):
+    ip = get_client_ip(request)
+    if is_blocked(ip):
+        raise HTTPException(status_code=403, detail="Blocked")
+    return {"token": generate_token(ip)}
+@app.get("/report_spam")
+async def report_spam(request: Request):
+    ip = get_client_ip(request)
+    with SqliteDict(FIREWALL_DB, autocommit=True) as db:
+        db[ip] = {
+            "count": 999,
+            "first_request": time.time(),
+            "blocked_until": time.time() + BLOCK_TIME_SECONDS
+        }
+    return {"status": "banned"}
+# --- สคริปต์สแกนโมดูลกลางย้าย AI บินข้ามโดเมนตามไปคุมหน้าเว็บหลักด้วย ---
+@app.get("/js")
+async def get_js_script(request: Request):
+    ip = get_client_ip(request)
+    hf_url = f"{request.url.scheme}://{request.url.netloc}"
+    if is_blocked(ip):
+        js_code = f"""
+        (function() {{
+            localStorage.clear();
+            document.body.innerHTML='<div style="font-family:-apple-system,sans-serif;background:white;color:black;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;text-align:center;"><div style="max-width:500px;width:90%;"><h1 style="font-size:40px;color:#ef4444;margin:0;">TANZAi</h1><h2 style="font-size:24px;margin-top:10px;">ตรวจพบพฤติกรรมว่ามีความผิดปกติ</h2><p style="color:#555;">ระบบจะทำการแบนไอพีของคุณชั่วคราวเนื่องจากกดคลิกรัวเกินไป</p></div></div>';
+        }})();
+        """
+        return HTMLResponse(content=js_code, media_type="application/javascript")
+    js_code = f"""
+    (function() {{
+        const h='{hf_url}',u=new URL(location),t=u.searchParams.get('tz_token')||localStorage.tz;let c=[];
+        function showBanPage() {{
+            localStorage.clear();
+            document.body.innerHTML='<div style="font-family:-apple-system,sans-serif;background:white;color:black;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;text-align:center;"><div style="max-width:500px;width:90%;"><h1 style="font-size:40px;color:#ef4444;margin:0;">TANZAi</h1><h2 style="font-size:24px;margin-top:10px;">ตรวจพบพฤติกรรมว่ามีความผิดปกติ</h2><p style="color:#555;">ระบบจะทำการแบนไอพีของคุณชั่วคราวเนื่องจากกดคลิกรัวเกินไป</p></div></div>';
+        }}
+        if (window.top !== window.self) {{
+            let attackerUrl = "เว็บไซต์อื่น";
+            if (location.ancestorOrigins && location.ancestorOrigins.length > 0) {{
+                try {{ attackerUrl = new URL(location.ancestorOrigins[0]).hostname; }} catch(e) {{}}
+            }} else if (document.referrer) {{
+                try {{ attackerUrl = new URL(document.referrer).hostname; }} catch(e) {{}}
+            }}
+            if (!attackerUrl.includes("hf.space") && !attackerUrl.includes("vercel.app") && !attackerUrl.includes("localhost")) {{
+                document.body.innerHTML = '<div style="font-family:-apple-system,sans-serif;background:white;color:black;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;text-align:center;"><div style="max-width:500px;width:90%;"><h1 style="font-size:40px;color:#ef4444;margin:0;">TANZAi</h1><h2 style="font-size:22px;margin-top:15px;color:#ef4444;">ตรวจพบว่า [\' + attackerUrl + \'] ทำการดึงหน้าเว็บไซต์เราไปแสดง</h2><p style="color:#555;font-size:16px;line-height:1.5;margin-top:10px;">จะไม่สามารถใช้งานเว็บไซต์จนกว่า [\' + attackerUrl + \'] จะแก้ไข</p></div></div>';
+                return;
+            }}
+        }}
+        if (navigator.webdriver || window.__selenium_evaluate) {{
+            showBanPage();
+            return;
+        }}
+        window.addEventListener('click',()=>{{
+            c=c.filter(x=>Date.now()-x<1000);c.push(Date.now());
+            if(c.length>=5){'{'}
+                fetch(h+'/report_spam').then(()=>{{ showBanPage(); }}).catch(()=>{{ showBanPage(); }});
+            {'}'}
+        }});
+        // =========================================================================
+        // GEMINI AI ENGINE INJECTION LAYER (แทรกระบบควบคุมด้วยเสียงลงไปในห���้าเว็บปัจจุบัน)
+        // =========================================================================
+        let rec = null, aiOn = false;
+        // ฉีด CSS Styles สถาปัตยกรรมแผงควบคุม AI เข้าไปใน DOM
+        const style = document.createElement('style');
+        style.innerHTML = `
+            .ai-activation-trigger { background: #1f2937 !important; color: #f9fafb !important; border: 1px solid #374151 !important; padding: 10px 20px !important; border-radius: 50px !important; font-size: 14px !important; font-weight: 500 !important; cursor: pointer !important; margin-top: 20px !important; display: inline-flex !important; align-items: center !important; gap: 8px !important; transition: all 0.2s ease !important; box-shadow: 0 4px 6px -1px rgba(0,0,0,0.1) !important; z-index:99999; position:relative; }
+            .ai-activation-trigger:hover { background: #111827 !important; border-color: #10b981 !important; color: #10b981 !important; }
+            #ai-voice-panel { position: fixed !important; bottom: -100px !important; left: 50% !important; transform: translateX(-50%) !important; background: rgba(16, 185, 129, 0.95) !important; color: white !important; border-radius: 30px !important; padding: 12px 25px !important; display: flex !important; align-items: center !important; gap: 15px !important; box-shadow: 0 10px 30px rgba(0,0,0,0.2) !important; backdrop-filter: blur(10px) !important; transition: bottom 0.4s cubic-bezier(0.175, 0.885, 0.32, 1.275) !important; z-index: 999999 !important; font-weight: 500 !important; font-family:-apple-system,sans-serif !important; }
+            #ai-voice-panel.active { bottom: 30px !important; }
+            .ai-pulse-dot { width: 12px !important; height: 12px !important; background: white !important; border-radius: 50% !important; animation: aiPulse 1.2s infinite ease-in-out !important; }
+            @keyframes aiPulse { 0%, 100% { transform: scale(0.8); opacity: 0.5; } 50% { transform: scale(1.3); opacity: 1; } }
+            .ai-click-ripple { position: absolute !important; width: 40px !important; height: 40px !important; background: rgba(0, 191, 255, 0.4) !important; border: 2px solid #00bfff !important; border-radius: 50% !important; pointer-events: none !important; transform: translate(-50%, -50%) scale(0) !important; animation: rippleEffect 0.6s ease-out !important; z-index: 10000000 !important; }
+            @keyframes rippleEffect { to { transform: translate(-50%, -50%) scale(2.5) !important; opacity: 0 !important; } }
+        `;
+        document.head.appendChild(style);
+        // ฉีดแผงแจ้งสถานะเข้าสู่หน้าเว็บ
+        const panel = document.createElement('div');
+        panel.id = 'ai-voice-panel';
+        panel.innerHTML = '<div class="ai-pulse-dot"></div><span id="ai-status-msg">ระบบ AI คลิกหน้าจออิสระ (กำลังฟังเสียง...)</span>';
+        document.body.appendChild(panel);
+        // หากเป็นหน้าด่านตรวจ ให้สร้างปุ่มกดลอยขึ้นมาโดยอัตโนมัติ
+        if(document.getElementById('cf-widget-container')) { text_insert_btn(); }
+        function text_insert_btn() {
+            const btn = document.createElement('button');
+            btn.className = 'ai-activation-trigger';
+            btn.innerHTML = '🤖 เปิดใช้งานระบบนำทาง AI Voice';
+            btn.onclick = () => toggleAI();
+            const container = document.querySelector('.container');
+            if(container) container.appendChild(btn);
+        }
+        function speak(text) {
+            if ('speechSynthesis' in window) {
+                window.speechSynthesis.cancel();
+                const u = new SpeechSynthesisUtterance(text);
+                u.lang = 'th-TH';
+                window.speechSynthesis.speak(u);
+            }
+        }
+        function autoClick(el) {
+            if (!el) return;
+            const r = el.getBoundingClientRect();
+            const x = r.left + window.scrollX + (r.width / 2);
+            const y = r.top + window.scrollY + (r.height / 2);
+            const rip = document.createElement('div');
+            rip.className = 'ai-click-ripple';
+            rip.style.left = x + 'px';
+            rip.style.top = y + 'px';
+            document.body.appendChild(rip);
+            setTimeout(() => rip.remove(), 600);
+            el.click();
+        }
+        function parseCmd(cmd) {
+            const txt = cmd.toLowerCase().trim();
+            const lbl = document.getElementById('ai-status-msg');
+            let target = null;
+            if (txt.includes('คลิก') || txt.includes('กด') || txt.includes('เลือก') || txt.includes('ผ่าน')) {
+                if (txt.includes('ไม่ใช่โปรแกรมอัตโนมัติ') || txt.includes('แคปช่า') || txt.includes('กล่อง')) {
+                    target = document.getElementById('click-target') || document.getElementById('check-visual');
+                } else {
+                    // หากอยู่เว็บหลัก สแกนหาปุ่ม เมนู หรือลิงก์ที่มีข้อความตรงตามเสียงพูดสั่งงาน
+                    const queryWords = txt.replace('คลิก','').replace('กด','').replace('เลือก','').trim();
+                    if(queryWords.length > 1) {
+                        const allEls = document.querySelectorAll('button, a, input[type="button"], .btn');
+                        for(let el of allEls) {
+                            if(el.innerText.toLowerCase().includes(queryWords) || el.value?.toLowerCase().includes(queryWords)) {
+                                target = el; break;
+                            }
+                        }
+                    }
+                }
+            }
+            if (target) {
+                lbl.innerText = "AI กำลังจำลองนิ้วคลิกหน้าจอ...";
+                speak("รับทราบค่ะ กำลังจำลองระบบนิ้วเพื่อกดให้ทันทีค่ะ");
+                setTimeout(() => { autoClick(target); lbl.innerText = "AI ประมวลผลสำเร็จ!"; }, 1000);
+            } else if (txt.includes('ขึ้น') || txt.includes('ลง')) {
+                speak("เลื่อนหน้าจอให้แล้วค่ะ");
+                window.scrollBy({ top: txt.includes('ลง') ? 400 : -400, behavior: 'smooth' });
+            }
+        }
+        function toggleAI() {
+            aiOn = !aiOn;
+            const p = document.getElementById('ai-voice-panel');
+            if (aiOn) {
+                p.classList.add('active');
+                speak("เปิดใช้งานระบบเอไอควบคุมเว็บอิสระแล้วค่ะ สั่งงานด้วยเสียงได้เลยค่ะ");
+                if ('webkitSpeechRecognition' in window || 'SpeechRecognition' in window) {
+                    const SpeechObj = window.SpeechRecognition || window.webkitSpeechRecognition;
+                    rec = new SpeechObj(); rec.continuous = true; rec.interimResults = false; rec.lang = 'th-TH';
+                    rec.onresult = (e) => {
+                        const res = e.results[e.results.length - 1][0].transcript;
+                        document.getElementById('ai-status-msg').innerText = "คำสั่งเสียงที่ได้ยิน: " + res;
+                        parseCmd(res);
+                    };
+                    rec.onerror = () => { if(aiOn) try{rec.start();}catch(err){} };
+                    rec.onend = () => { if(aiOn) try{rec.start();}catch(err){} };
+                    try{ rec.start(); }catch(err){}
+                }
+            } else {
+                p.classList.remove('active');
+                if(rec) { try{rec.stop();}catch(err){} rec = null; }
+                speak("ปิดระบบเอไอควบคุมแล้วค่ะ");
+            }
+        }
+        window.addEventListener('dblclick', () => toggleAI());
+        // =========================================================================
+        if(t){{
+            if(t.length !== 32) { showBanPage(); return; }
+            localStorage.tz=t;
+            if(u.searchParams.has('tz_token')){ u.searchParams.delete('tz_token'); history.replaceState({},'',u); }
+            fetch(h+'/verify?token='+t)
+                .then(r=>r.json())
+                .then(d=>{{ if(!d.valid || d.banned){ showBanPage(); } }})
+                .catch(()=>{{}});
+        }}else{{
+            location.href=h;
+        }}
+    }})();
+    """
+    return HTMLResponse(content=js_code, media_type="application/javascript")