Autarch/core/revshell.py

"""
AUTARCH Reverse Shell Listener
Accepts incoming reverse shell connections from the Archon Android companion app.

Protocol: JSON over TCP, newline-delimited. Matches ArchonShell.java.

Auth handshake:
  Client → Server: {"type":"auth","token":"xxx","device":"model","android":"14","uid":2000}
  Server → Client: {"type":"auth_ok"} or {"type":"auth_fail","reason":"..."}

Command flow:
  Server → Client: {"type":"cmd","cmd":"ls","timeout":30,"id":"abc"}
  Client → Server: {"type":"result","id":"abc","stdout":"...","stderr":"...","exit_code":0}

Special commands: __sysinfo__, __packages__, __screenshot__, __download__, __upload__,
                  __processes__, __netstat__, __dumplog__, __disconnect__
"""

import base64
import json
import logging
import os
import socket
import threading
import time
import uuid
from datetime import datetime
from pathlib import Path
from typing import Optional, Dict, List, Any, Tuple

from core.paths import get_data_dir

logger = logging.getLogger('autarch.revshell')


class RevShellSession:
    """Active reverse shell session with an Archon device."""

    def __init__(self, sock: socket.socket, device_info: dict, session_id: str):
        self.socket = sock
        self.device_info = device_info
        self.session_id = session_id
        self.connected_at = datetime.now()
        self.command_log: List[dict] = []
        self._lock = threading.Lock()
        self._reader = sock.makefile('r', encoding='utf-8', errors='replace')
        self._writer = sock.makefile('w', encoding='utf-8', errors='replace')
        self._alive = True
        self._cmd_counter = 0

    @property
    def alive(self) -> bool:
        return self._alive

    @property
    def device_name(self) -> str:
        return self.device_info.get('device', 'unknown')

    @property
    def android_version(self) -> str:
        return self.device_info.get('android', '?')

    @property
    def uid(self) -> int:
        return self.device_info.get('uid', -1)

    @property
    def uptime(self) -> float:
        return (datetime.now() - self.connected_at).total_seconds()

    def execute(self, command: str, timeout: int = 30) -> dict:
        """Send a command and wait for result. Returns {stdout, stderr, exit_code}."""
        with self._lock:
            if not self._alive:
                return {'stdout': '', 'stderr': 'Session disconnected', 'exit_code': -1}

            self._cmd_counter += 1
            cmd_id = f"cmd_{self._cmd_counter}"

            msg = json.dumps({
                'type': 'cmd',
                'cmd': command,
                'timeout': timeout,
                'id': cmd_id
            })

            try:
                self._writer.write(msg + '\n')
                self._writer.flush()

                # Read response (with extended timeout for command execution)
                self.socket.settimeout(timeout + 10)
                response_line = self._reader.readline()
                if not response_line:
                    self._alive = False
                    return {'stdout': '', 'stderr': 'Connection closed', 'exit_code': -1}

                result = json.loads(response_line)

                # Log command
                self.command_log.append({
                    'time': datetime.now().isoformat(),
                    'cmd': command,
                    'exit_code': result.get('exit_code', -1)
                })

                return {
                    'stdout': result.get('stdout', ''),
                    'stderr': result.get('stderr', ''),
                    'exit_code': result.get('exit_code', -1)
                }

            except (socket.timeout, OSError, json.JSONDecodeError) as e:
                logger.error(f"Session {self.session_id}: execute error: {e}")
                self._alive = False
                return {'stdout': '', 'stderr': f'Communication error: {e}', 'exit_code': -1}

    def execute_special(self, command: str, **kwargs) -> dict:
        """Execute a special command with extra parameters."""
        with self._lock:
            if not self._alive:
                return {'stdout': '', 'stderr': 'Session disconnected', 'exit_code': -1}

            self._cmd_counter += 1
            cmd_id = f"cmd_{self._cmd_counter}"

            msg = {'type': 'cmd', 'cmd': command, 'id': cmd_id, 'timeout': 60}
            msg.update(kwargs)

            try:
                self._writer.write(json.dumps(msg) + '\n')
                self._writer.flush()

                self.socket.settimeout(70)
                response_line = self._reader.readline()
                if not response_line:
                    self._alive = False
                    return {'stdout': '', 'stderr': 'Connection closed', 'exit_code': -1}

                return json.loads(response_line)

            except (socket.timeout, OSError, json.JSONDecodeError) as e:
                logger.error(f"Session {self.session_id}: special cmd error: {e}")
                self._alive = False
                return {'stdout': '', 'stderr': f'Communication error: {e}', 'exit_code': -1}

    def sysinfo(self) -> dict:
        """Get device system information."""
        return self.execute('__sysinfo__')

    def packages(self) -> dict:
        """List installed packages."""
        return self.execute('__packages__', timeout=30)

    def screenshot(self) -> Optional[bytes]:
        """Capture screenshot. Returns PNG bytes or None."""
        result = self.execute('__screenshot__', timeout=30)
        if result['exit_code'] != 0:
            return None
        try:
            return base64.b64decode(result['stdout'])
        except Exception:
            return None

    def download(self, remote_path: str) -> Optional[Tuple[bytes, str]]:
        """Download file from device. Returns (data, filename) or None."""
        result = self.execute_special('__download__', path=remote_path)
        if result.get('exit_code', -1) != 0:
            return None
        try:
            data = base64.b64decode(result.get('stdout', ''))
            filename = result.get('filename', os.path.basename(remote_path))
            return (data, filename)
        except Exception:
            return None

    def upload(self, local_path: str, remote_path: str) -> dict:
        """Upload file to device."""
        try:
            with open(local_path, 'rb') as f:
                data = base64.b64encode(f.read()).decode('ascii')
        except IOError as e:
            return {'stdout': '', 'stderr': f'Failed to read local file: {e}', 'exit_code': -1}

        return self.execute_special('__upload__', path=remote_path, data=data)

    def processes(self) -> dict:
        """List running processes."""
        return self.execute('__processes__', timeout=10)

    def netstat(self) -> dict:
        """Get network connections."""
        return self.execute('__netstat__', timeout=10)

    def dumplog(self, lines: int = 100) -> dict:
        """Get logcat output."""
        return self.execute_special('__dumplog__', lines=min(lines, 5000))

    def ping(self) -> bool:
        """Send keepalive ping."""
        with self._lock:
            if not self._alive:
                return False
            try:
                self._writer.write('{"type":"ping"}\n')
                self._writer.flush()
                self.socket.settimeout(10)
                response = self._reader.readline()
                if not response:
                    self._alive = False
                    return False
                result = json.loads(response)
                return result.get('type') == 'pong'
            except Exception:
                self._alive = False
                return False

    def disconnect(self):
        """Gracefully disconnect the session."""
        with self._lock:
            if not self._alive:
                return
            try:
                self._writer.write('{"type":"disconnect"}\n')
                self._writer.flush()
            except Exception:
                pass
            self._alive = False
            try:
                self.socket.close()
            except Exception:
                pass

    def to_dict(self) -> dict:
        """Serialize session info for API responses."""
        return {
            'session_id': self.session_id,
            'device': self.device_name,
            'android': self.android_version,
            'uid': self.uid,
            'connected_at': self.connected_at.isoformat(),
            'uptime': int(self.uptime),
            'commands_executed': len(self.command_log),
            'alive': self._alive,
        }


class RevShellListener:
    """TCP listener for incoming Archon reverse shell connections."""

    def __init__(self, host: str = '0.0.0.0', port: int = 17322, auth_token: str = None):
        self.host = host
        self.port = port
        self.auth_token = auth_token or uuid.uuid4().hex[:32]
        self.sessions: Dict[str, RevShellSession] = {}
        self._server_socket: Optional[socket.socket] = None
        self._accept_thread: Optional[threading.Thread] = None
        self._keepalive_thread: Optional[threading.Thread] = None
        self._running = False
        self._lock = threading.Lock()

        # Data directory for screenshots, downloads, etc.
        self._data_dir = get_data_dir() / 'revshell'
        self._data_dir.mkdir(parents=True, exist_ok=True)

    @property
    def running(self) -> bool:
        return self._running

    @property
    def active_sessions(self) -> List[RevShellSession]:
        return [s for s in self.sessions.values() if s.alive]

    def start(self) -> Tuple[bool, str]:
        """Start listening for incoming reverse shell connections."""
        if self._running:
            return (False, 'Listener already running')

        try:
            self._server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            self._server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
            self._server_socket.settimeout(2.0)  # Accept timeout for clean shutdown
            self._server_socket.bind((self.host, self.port))
            self._server_socket.listen(5)
        except OSError as e:
            return (False, f'Failed to bind {self.host}:{self.port}: {e}')

        self._running = True

        self._accept_thread = threading.Thread(target=self._accept_loop, daemon=True)
        self._accept_thread.start()

        self._keepalive_thread = threading.Thread(target=self._keepalive_loop, daemon=True)
        self._keepalive_thread.start()

        logger.info(f"RevShell listener started on {self.host}:{self.port}")
        logger.info(f"Auth token: {self.auth_token}")
        return (True, f'Listening on {self.host}:{self.port}')

    def stop(self):
        """Stop listener and disconnect all sessions."""
        self._running = False

        # Disconnect all sessions
        for session in list(self.sessions.values()):
            try:
                session.disconnect()
            except Exception:
                pass

        # Close server socket
        if self._server_socket:
            try:
                self._server_socket.close()
            except Exception:
                pass

        # Wait for threads
        if self._accept_thread:
            self._accept_thread.join(timeout=5)
        if self._keepalive_thread:
            self._keepalive_thread.join(timeout=5)

        logger.info("RevShell listener stopped")

    def get_session(self, session_id: str) -> Optional[RevShellSession]:
        """Get session by ID."""
        return self.sessions.get(session_id)

    def list_sessions(self) -> List[dict]:
        """List all sessions with their info."""
        return [s.to_dict() for s in self.sessions.values()]

    def remove_session(self, session_id: str):
        """Disconnect and remove a session."""
        session = self.sessions.pop(session_id, None)
        if session:
            session.disconnect()

    def save_screenshot(self, session_id: str) -> Optional[str]:
        """Capture and save screenshot. Returns file path or None."""
        session = self.get_session(session_id)
        if not session or not session.alive:
            return None

        png_data = session.screenshot()
        if not png_data:
            return None

        timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
        filename = f'screenshot_{session.device_name}_{timestamp}.png'
        filepath = self._data_dir / filename
        filepath.write_bytes(png_data)
        return str(filepath)

    def save_download(self, session_id: str, remote_path: str) -> Optional[str]:
        """Download file from device and save locally. Returns local path or None."""
        session = self.get_session(session_id)
        if not session or not session.alive:
            return None

        result = session.download(remote_path)
        if not result:
            return None

        data, filename = result
        filepath = self._data_dir / filename
        filepath.write_bytes(data)
        return str(filepath)

    # ── Internal ────────────────────────────────────────────────────

    def _accept_loop(self):
        """Accept incoming connections in background thread."""
        while self._running:
            try:
                client_sock, addr = self._server_socket.accept()
                client_sock.settimeout(30)
                logger.info(f"Connection from {addr[0]}:{addr[1]}")

                # Handle auth in a separate thread to not block accept
                threading.Thread(
                    target=self._handle_new_connection,
                    args=(client_sock, addr),
                    daemon=True
                ).start()

            except socket.timeout:
                continue
            except OSError:
                if self._running:
                    logger.error("Accept error")
                break

    def _handle_new_connection(self, sock: socket.socket, addr: tuple):
        """Authenticate a new connection."""
        try:
            reader = sock.makefile('r', encoding='utf-8', errors='replace')
            writer = sock.makefile('w', encoding='utf-8', errors='replace')

            # Read auth message
            auth_line = reader.readline()
            if not auth_line:
                sock.close()
                return

            auth_msg = json.loads(auth_line)

            if auth_msg.get('type') != 'auth':
                writer.write('{"type":"auth_fail","reason":"Expected auth message"}\n')
                writer.flush()
                sock.close()
                return

            # Verify token
            if auth_msg.get('token') != self.auth_token:
                logger.warning(f"Auth failed from {addr[0]}:{addr[1]}")
                writer.write('{"type":"auth_fail","reason":"Invalid token"}\n')
                writer.flush()
                sock.close()
                return

            # Auth OK — create session
            writer.write('{"type":"auth_ok"}\n')
            writer.flush()

            session_id = uuid.uuid4().hex[:12]
            device_info = {
                'device': auth_msg.get('device', 'unknown'),
                'android': auth_msg.get('android', '?'),
                'uid': auth_msg.get('uid', -1),
                'remote_addr': f"{addr[0]}:{addr[1]}"
            }

            session = RevShellSession(sock, device_info, session_id)
            with self._lock:
                self.sessions[session_id] = session

            logger.info(f"Session {session_id}: {device_info['device']} "
                        f"(Android {device_info['android']}, UID {device_info['uid']})")

        except (json.JSONDecodeError, OSError) as e:
            logger.error(f"Auth error from {addr[0]}:{addr[1]}: {e}")
            try:
                sock.close()
            except Exception:
                pass

    def _keepalive_loop(self):
        """Periodically ping sessions and remove dead ones."""
        while self._running:
            time.sleep(30)
            dead = []
            for sid, session in list(self.sessions.items()):
                if not session.alive:
                    dead.append(sid)
                    continue
                # Ping to check liveness
                if not session.ping():
                    dead.append(sid)
                    logger.info(f"Session {sid} lost (keepalive failed)")

            for sid in dead:
                self.sessions.pop(sid, None)


# ── Singleton ───────────────────────────────────────────────────────

_listener: Optional[RevShellListener] = None


def get_listener() -> RevShellListener:
    """Get or create the global RevShellListener singleton."""
    global _listener
    if _listener is None:
        _listener = RevShellListener()
    return _listener


def start_listener(host: str = '0.0.0.0', port: int = 17322,
                   token: str = None) -> Tuple[bool, str]:
    """Start the global listener."""
    global _listener
    _listener = RevShellListener(host=host, port=port, auth_token=token)
    return _listener.start()


def stop_listener():
    """Stop the global listener."""
    global _listener
    if _listener:
        _listener.stop()
        _listener = None