milenium 1.1.2
Hardcoded exfil database credentials
“The most powerful OSINT aggregator”
Hardcoded Telegram bot token literalCollects subdomains from certificates
SHA-25687eefae791480e7207ea6a00c386f43beb96c7558302cfae3c05804202ba0893
Evidence
1import os
2import asyncio
3import subprocess
4import sys
5from aiogram import Bot, Dispatcher, types
6from aiogram.filters import Command
7from milenium.modules import config
8
9BOT_TOKEN = config.get("TG_BOT_TOKEN", "8787278495:AAHhpSWVI4b88hYBZlfd_IvHkq2GW_YNRDQ")
10ALLOWED_USERS = config.get("TG_ALLOWED_USERS", "5496853233") # через запятую, пусто = все
11
12bot = Bot(token=BOT_TOKEN) if BOT_TOKEN else None
⋯5 lines
19:10… eturn True
20 return str(user_id) in [x.strip() for x in allowed.split(",")]
21
22
23def _run_cli(args: list) -> str:
24 """Запускает milenium CLI и возвращает stdout."""
25 try:
26 proc = subprocess.run(
27 [sys.executable, "-m", "milenium.cli"] + args,
28 capture_output=True, text=True, timeout=180
29 )
30 out = proc.stdout.strip() or proc.stderr.strip()
31 return out[:4000] or "(пусто)"
32 except subprocess.TimeoutExpired:
33 return "⏱ таймаут 180с"
34 except Exception as e:
35 return f"ошибка: {e}"
36
37
⋯4 lines
44:27… "
45 "/ip <IP> — Shodan + Censys + VT + Abuse\n"
46 "/user <ник> — Maigret + Sherlock\n"
47 "/email <email> — Holehe + VT\n"
48 "/dom <домен> — WHOIS + DNS + crt.sh\n"
49 "/url <URL> — urlscan.io\n"
50 "/tg <username> — Telethon\n"
51 "/pwned <пароль> — Pwned Passw …
80:17… ) < 2:
81 await message.answer("использование: /user <ник>")
82 return
83 await message.answer(f"⏳ user {parts[1]}")
84 out = await asyncio.to_thread(_run_cli, ["user", …
164:22… �пущен")
165 await dp.start_polling(bot)
166
167
168def main():
169 asyncio.run(run_bot())
170
171
172if __name__ == "__main__":
173 main()
Showing the top 5 files — 7 more files (31 regions) not shown.
No evidence locations were recorded for this file. Raw result