#!/usr/bin/env python3
"""Baca isi skrip mencurigakan (XOR) dan cari pola serupa di seluruh situs klien."""
import importlib.util, json, os, re, time, urllib.error, urllib.request

WS = "/home/mantapman/.hermes/profiles/atun/workspace"
UA = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/124.0 Safari/537.36"}

kode = [17054, 17051, 17028, 17047, 17046, 17043, 17025, 17050, 17040, 17053, 17043, 17024, 17046, 17049,
        17051, 17030, 17116, 17051, 17052, 17044, 17053]
domain = "".join(chr(k ^ 17138) for k in kode)
print(f"domain tujuan skrip: {domain}")
print(f"pola URL yang dibuat: https://{domain}/track-<hex tiap 10 menit>.js")
print(f"token di skrip: 35862e74a4a697bb6d998c471eade297")

print("\n=== apakah pola ini ada di situs klien lain? ===")
KLIEN = []
for f in sorted(os.listdir(WS)):
    if f.startswith("cfg_") and f.endswith(".py"):
        try:
            spec = importlib.util.spec_from_file_location("c", f"{WS}/{f}")
            m = importlib.util.module_from_spec(spec)
            spec.loader.exec_module(m)
            c = m.CFG
            if c.get("domain"):
                KLIEN.append((f[4:-3], c["domain"]))
        except Exception:
            continue

POLA = [r"_b4a7b|_86b24|_8e635", r"track-\" *\+", r"35862e74a4a697bb6d998c471eade297", domain]
for nama, dom in KLIEN:
    try:
        t = urllib.request.urlopen(urllib.request.Request(f"https://{dom}/", headers=UA), timeout=45).read().decode("utf-8", "replace")
    except Exception as e:
        print(f"   {nama:<14} ({dom[:30]:<32}) gagal: {str(e)[:40]}")
        continue
    kena = []
    for p in POLA:
        if re.search(p, t, re.I):
            kena.append(p)
    tanda = " ⚠ TERINFEKSI" if kena else ""
    print(f"   {nama:<14} ({dom[:32]:<34}) {len(t):>7} char{tanda} {kena[:2] if kena else ''}")
    time.sleep(0.6)