#!/usr/bin/env python3
"""collector.py — 轻量级 HTTP POST 数据接收器
用于在无回显 RCE 场景下接收目标回传的数据并保存到本地。

用法:
    python3 collector.py [端口，默认 8888] [保存目录，默认 ./loot]
"""

from http.server import BaseHTTPRequestHandler, HTTPServer
import os
import sys
import time

PORT = int(sys.argv[1]) if len(sys.argv) > 1 else 8888
LOOT_DIR = sys.argv[2] if len(sys.argv) > 2 else "./loot"


class LootHandler(BaseHTTPRequestHandler):
    def _save(self):
        length = int(self.headers.get("Content-Length", 0))
        data = self.rfile.read(length)
        ts = int(time.time() * 1000)
        path = self.path.strip("/").replace("/", "_") or "root"
        filename = os.path.join(LOOT_DIR, f"{ts}_{path}.bin")

        with open(filename, "wb") as f:
            f.write(data)

        client_ip = self.client_address[0]
        print(f"[+] 收到来自 {client_ip} 的回传 ({len(data)} 字节) -> {filename}")

        self.send_response(200)
        self.send_header("Content-Type", "text/plain")
        self.end_headers()
        self.wfile.write(b"OK\n")

    do_POST = _save
    do_GET = _save

    def log_message(self, format, *args):
        pass


def run_server():
    os.makedirs(LOOT_DIR, exist_ok=True)
    server = HTTPServer(("0.0.0.0", PORT), LootHandler)
    print(f"[*] HTTP 回传接收器已启动，监听 0.0.0.0:{PORT}，数据保存至 {LOOT_DIR}")
    try:
        server.serve_forever()
    except KeyboardInterrupt:
        print("\n[*] 接收器已停止。")


if __name__ == "__main__":
    run_server()