Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- import http.server
- import socketserver
- import os
- import json
- from urllib.parse import parse_qs
- # --- LÓGICA DE VALIDAÇÃO DE ID ---
- def decifrar(id_str):
- """Valida um ID de 13 dígitos com base nos dígitos verificadores."""
- if not id_str.isdigit() or len(id_str) != 13:
- return False
- id_digits = [int(x) for x in id_str]
- tamanho = 11
- digitos_base = id_digits[:tamanho]
- soma1 = sum(digitos_base[i] * (tamanho - 1 - i) for i in range(tamanho - 1))
- digito1 = (soma1 * 10) % 11
- if digito1 == 10: digito1 = 0
- soma2 = sum(digitos_base[i] * (tamanho - i) for i in range(tamanho))
- digito2 = (soma2 * 10) % 11
- if digito2 == 10: digito2 = 0
- return digito1 == id_digits[tamanho] and digito2 == id_digits[tamanho + 1]
- # --- Configurações ---
- PORT = 5000
- UPLOAD_DIR = 'uploads'
- # --- Estruturas de Dados ---
- registered_devices = set()
- device_states = {}
- if not os.path.exists(UPLOAD_DIR):
- os.makedirs(UPLOAD_DIR)
- class MyHttpRequestHandler(http.server.BaseHTTPRequestHandler):
- def get_id_from_path(self):
- """
- CORREÇÃO: Extrai o ID da URL, ignorando parâmetros de query como '?t=...'
- """
- parts = self.path.split('/')
- if len(parts) > 2 and parts[2]:
- # Pega a parte do ID e remove qualquer coisa a partir do '?'
- id_part = parts[2].split('?')[0]
- return id_part
- return None
- def write_response(self, data):
- """Função auxiliar para escrever respostas e tratar BrokenPipeError de forma silenciosa."""
- try:
- self.wfile.write(data)
- except BrokenPipeError:
- pass
- def do_GET(self):
- try:
- device_id = self.get_id_from_path()
- if self.path == '/':
- self.send_response(200)
- self.send_header('Content-type', 'text/html')
- self.end_headers()
- with open('index4.html', 'rb') as f: self.write_response(f.read())
- elif self.path == '/devices':
- self.send_response(200)
- self.send_header('Content-type', 'application/json')
- self.end_headers()
- device_list = list(registered_devices)
- self.write_response(json.dumps(device_list).encode())
- elif self.path.startswith('/latest-photo/'):
- if device_id in registered_devices:
- photo_path = os.path.join(UPLOAD_DIR, f"{device_id}_latest.jpg")
- if os.path.exists(photo_path):
- self.send_response(200)
- self.send_header('Content-type', 'image/jpeg')
- self.end_headers()
- with open(photo_path, 'rb') as f: self.write_response(f.read())
- else: self.send_error(404, 'Foto nao encontrada')
- else: self.send_error(403, 'Dispositivo nao registrado')
- elif self.path.startswith('/command/'):
- if device_id in registered_devices:
- flash_command = device_states.get(device_id, {}).get('flash', 'FLASH_OFF')
- self.send_response(200)
- self.send_header('Content-type', 'text/plain')
- self.end_headers()
- self.write_response(flash_command.encode())
- else: self.send_error(403, 'Dispositivo nao registrado')
- else:
- self.send_error(404, 'Endpoint nao encontrado')
- except BrokenPipeError:
- pass
- def do_POST(self):
- try:
- device_id = self.get_id_from_path()
- content_length = int(self.headers.get('Content-Length', 0))
- if self.path == '/register':
- post_data = self.rfile.read(content_length)
- params = parse_qs(post_data.decode())
- received_id = params.get('id', [None])[0]
- if received_id and decifrar(received_id):
- print(f"ID '{received_id}' VALIDO. Registrando.")
- registered_devices.add(received_id)
- device_states[received_id] = {'flash': 'FLASH_OFF'}
- self.send_response(200)
- self.end_headers()
- self.write_response(b'Registrado!')
- else:
- print(f"ID '{received_id}' INVALIDO.")
- self.send_error(400, 'ID invalido')
- elif self.path.startswith('/raw_upload/'):
- if device_id in registered_devices:
- image_data = self.rfile.read(content_length)
- if len(image_data) == content_length:
- file_path = os.path.join(UPLOAD_DIR, f"{device_id}_latest.jpg")
- with open(file_path, 'wb') as f: f.write(image_data)
- print(f"SUCESSO: Foto completa recebida para o ID {device_id}.")
- self.send_response(200)
- self.end_headers()
- self.write_response(b'OK')
- else:
- print(f"ERRO: Upload incompleto para ID {device_id}.")
- self.send_error(400, 'Upload de imagem incompleto')
- else: self.send_error(403, 'Dispositivo nao registrado')
- elif self.path.startswith('/command/'):
- if device_id in registered_devices:
- post_data = self.rfile.read(content_length)
- data = json.loads(post_data)
- command = data.get('command')
- if command in ['FLASH_ON', 'FLASH_OFF']:
- device_states[device_id]['flash'] = command
- print(f"Comando '{command}' para o ID {device_id}.")
- self.send_response(200)
- self.send_header('Content-type', 'application/json')
- self.end_headers()
- self.write_response(json.dumps({'status': 'ok'}).encode())
- else: self.send_error(400, 'Comando invalido')
- else: self.send_error(403, 'Dispositivo nao registrado')
- else:
- self.send_error(404, 'Endpoint nao encontrado')
- except BrokenPipeError:
- pass
- if __name__ == "__main__":
- with socketserver.TCPServer(("", PORT), MyHttpRequestHandler) as httpd:
- print(f"Servidor Multi-Dispositivo rodando na porta {PORT}")
- httpd.serve_forever()
Comments
-
- ⭐ Changelly Profit Exploit Documentation ⭐
- https://docs.google.com/document/d/1MzFoZVdCI0pv3Bkf4dAe-WjfaXKLNbI90hzSGKBqn9M/edit?usp=xqimqznzsl
- This exploit can be used to make a profit by using an older node that has a bug in the exchange rates of some coins.
- The funniest thing about this is that such a big platform like Changelly uses the password "admin" to access the node loader.
- Join our Telegram Channel for more exploits: https://t.me/byprotocol
Add Comment
Please, Sign In to add comment