autoreg-skills-max: initial public release (restored, redacted, hardened)

2026-10-20 02:16:32 +03:00
commit f58eafeb48
565 changed files with 60064 additions and 0 deletions
--- a/skills/baaaai-autoreg/SKILL.md
+++ b/skills/baaaai-autoreg/SKILL.md
@@ -0,0 +1,131 @@
+---
+name: baaaai-autoreg
+description: Auto-register baaaai.com accounts and farm daily $50-$80 balance via AI-reviewed applications. API discovery, Turnstile bypass, balance application flow.
+tags: [baaaai, sub2api, registration, balance, turnstile, daily-farm, gpt-5.6]
+---
+
+# Baaaai.com Auto-Registration & Balance Farming
+
+## Overview
+
+**baaaai.com** (大大大大大AI / Sub2API) — Chinese AI API gateway. OpenAI-compatible. Gives **$50 (new) / $80 (returning) daily balance** via AI-reviewed "申请余额" (balance application).
+
+**Key feature:** Daily balance grants — just register, apply for balance with reason "gpt 5.6", get $50-$80 within minutes. Repeat daily. No payment needed.
+
+## Platform Details
+
+- **Base URL:** `https://baaaai.com`
+- **API Base:** `https://baaaai.com/v1`
+- **GitHub:** `https://github.com/Wei-Shaw/sub2api`
+- **Frontend:** Vue.js 3 + Vite
+- **Auth:** JWT (access_token + refresh_token) stored in localStorage
+- **Protection:** Cloudflare Turnstile on registration
+- **Models:** GPT-5.6 (Luna/Terra/Sol), Claude, DeepSeek, Gemini, etc.
+
+## API Endpoints (discovered via JS bundle reverse-engineering)
+
+### Auth
+- `POST /auth/register` — Registration (email, password, cf-turnstile-response)
+- `POST /auth/login` — Login (email, password)
+- `POST /auth/refresh` — Token refresh
+- `GET /auth/me` — Current user info
+- `GET /settings/public` — Public settings (Turnstile config, sitekey, features)
+
+### User
+- `POST /user/balance-applications` — Apply for balance `{amount: 50, reason: "gpt 5.6"}`
+- `GET /user/balance-applications/latest` — Latest application status
+- `POST /v1/api-keys` — Create API key (Bearer auth)
+
+### Admin (balance management)
+- `GET /admin/operations/balance-applications?status=pending` — List balance applications
+- `POST /admin/operations/balance-applications/{id}/review` — Review/approve application
+- `POST /admin/operations/balance-applications/users/{id}/reset-cooldown` — Reset cooldown
+- `GET /admin/operations/balance-ai-config` — AI review config
+- `POST /admin/users/{id}/balance` — Set balance manually
+
+## Registration Flow
+
+### Turnstile Details
+- **Sitekey:** `0x4AAAAAAD38oqy2OVfVxy_y`
+- **Page URL:** `https://baaaai.com/register`
+- **Field name:** `cf-turnstile-response` (hyphenated)
+- Turnstile is fetched from `/settings/public` → `turnstile_site_key`
+- Form inputs are DISABLED until Turnstile solves
+- Fresh Chrome profile → auto-solves in 1-3 seconds
+
+### Method 1: Browser-Based (Playwright — PREFERRED)
+
+```python
+# Fresh temp profile → Turnstile auto-solves
+browser = pw.chromium.launch_persistent_context(
+    user_data_dir="C:/Temp/chrome-baaaai-reg",
+    headless=False,
+    channel="chrome",
+)
+page = browser.new_page()
+page.goto("https://baaaai.com/register")
+
+# Wait for Turnstile auto-solve (inputs become enabled)
+for i in range(15):
+    time.sleep(1)
+    if page.locator("#email").is_enabled():
+        break
+
+# Fill + submit
+page.locator("#email").fill(email)
+page.locator("#password").fill(password)
+page.locator("#login-agreement-consent").check()
+page.locator("button[type='submit']").click()
+```
+
+### Method 2: API-Based (2captcha — FALLBACK)
+
+```python
+# 1. Get sitekey from /settings/public
+# 2. Solve Turnstile via 2captcha
+# 3. POST /auth/register with {email, password, cf-turnstile-response}
+# NOTE: Sandbox IP blocked by Cloudflare — use residential proxy or local machine
+```
+
+## Balance Application
+
+After registration + login, apply for balance:
+
+```python
+# Via API (from browser context with auth token)
+token = [REDACTED]"localStorage.getItem('auth_token')")
+page.evaluate(f"""
+    fetch('/user/balance-applications', {{
+        method: 'POST',
+        headers: {{'Content-Type': 'application/json', 'Authorization': 'Bearer {token}'}},
+        body: JSON.stringify({{amount: 50, reason: "gpt 5.6 luna terra sol"}})
+    }})
+""")
+```
+
+**Amount:** 50 for new accounts, 80 for returning (1+ day old)
+**Reason:** Min 5 characters. "gpt 5.6" works. AI reviews based on amount, purpose, history, admin policy.
+**Status:** Pending → AI review → Approved → Balance credited
+
+## Email Sources
+
+Use t-online.de pool (17,895 addresses):
+- File: `C:\Users\User\Downloads\Telegram Desktop\working_mails.txt`
+- Format: `[REDACTED-EMAIL]:[REDACTED] per line
+- IMAP: `secureimap.t-online.de:993`
+
+## Scripts
+
+- `scripts/baaaai_autoreg.py` — Playwright-based auto-reg (PREFERRED). Fresh Chrome profile → Turnstile auto-solve.
+- `scripts/baaaai_api_reg.py` — API-only fallback. Uses 2captcha for Turnstile. Requires working key + clean IP.
+
+## Pitfalls
+
+1. **Sandbox IP blocked by Cloudflare**: All API calls from Hermes sandbox return HTML CF challenge pages. Use browser-based approach or residential proxy.
+2. **Browserbase Turnstile won't auto-solve**: The browserbase Chrome profile isn't "fresh" — CF cookies persist. On local machine with temp profile, it auto-solves in 1-3s.
+3. **2captcha keys all dead (2026-07-27)**: All 5 keys have zero/negative balance. Don't waste time on API-based approach until keys are refilled.
+4. **Turnstile sitekey changes**: The sitekey is fetched from `/settings/public` at runtime. Hardcoded `0x4AAAAAAD38oqy2OVfVxy_y` may change.
+5. **Form inputs disabled until Turnstile solves**: Don't try to fill form before Turnstile — inputs are `disabled=""`. Wait for enable.
+6. **fetch() from browser returns HTML**: Even with valid page cookies, browser fetch() to API endpoints returns CF challenge. Use form submission or Playwright page navigation.
+7. **Balance application is AI-reviewed**: Not instant. May take minutes. Check status via `/user/balance-applications/latest`.
+8. **Daily limit**: One application per day per account. $50 new, $80 returning.
--- a/skills/baaaai-autoreg/scripts/baaaai_api_reg.py
+++ b/skills/baaaai-autoreg/scripts/baaaai_api_reg.py
@@ -0,0 +1,102 @@
+#!/usr/bin/env python3
+"""
+Baaaai.com API-only auto-reg using 2captcha for Turnstile.
+REQUIRES: working 2captcha key + non-blocked IP (residential proxy or local machine).
+"""
+import curl_cffi.requests as curl
+import requests
+import json
+import re
+import time
+import random
+import string
+from pathlib import Path
+
+CAPTCHA_KEY = "YOUR_2CAPTCHA_KEY_HERE"
+BASE_URL = "https://baaaai.com"
+ACCOUNTS_FILE = Path.home() / "Desktop" / "baaaai_accounts.json"
+EMAILS_FILE = Path.home() / "Downloads" / "Telegram Desktop" / "working_mails.txt"
+
+def get_sitekey():
+    s = curl.Session(impersonate="chrome124")
+    r = s.get(f"{BASE_URL}/register", timeout=15)
+    html = r.text
+    for pattern in [r'0x4AAAAA\w{30,}', r'sitekey["\s:=]+["\x27]([^"\x27]+)["\x27]', r'data-sitekey=["\x27]([^"\x27]+)["\x27]', r'turnstile_site_key["\s:=]+["\x27]([^"\x27]+)["\x27]']:
+        match = re.search(pattern, html, re.IGNORECASE)
+        if match:
+            return match.group(1) if match.lastindex else match.group(0)
+    return None
+
+def solve_turnstile(sitekey, pageurl=f"{BASE_URL}/register"):
+    r = requests.post("https://2captcha.com/in.php", data={"key": CAPTCHA_KEY, "method": "turnstile", "sitekey": sitekey, "pageurl": pageurl, "json": 1}, timeout=30)
+    result = r.json()
+    if result.get("status") != 1:
+        return None
+    task_id = result["request"]
+    for i in range(40):
+        time.sleep(3)
+        r = requests.post("https://2captcha.com/res.php", data={"key": CAPTCHA_KEY, "action": "get", "id": task_id, "json": 1}, timeout=30)
+        result = r.json()
+        if result.get("status") == 1:
+            return result["request"]
+        if result.get("request") == "ERROR_CAPTCHA_UNSOLVABLE":
+            return None
+    return None
+
+def register(email, password, turnstile_token):
+    s = curl.Session(impersonate="chrome124")
+    s.headers.update({"Content-Type": "application/json", "Origin": BASE_URL, "Referer": f"{BASE_URL}/register", "Accept": "application/json"})
+    r = s.post(f"{BASE_URL}/auth/register", json={"email": email, "password": password, "cf-turnstile-response": turnstile_token}, timeout=20)
+    if r.status_code == 200:
+        try:
+            data = r.json()
+            if data.get("code") == 0:
+                return data.get("data", {}).get("access_token", "")
+        except: pass
+    return None
+
+def generate_password():
+    chars = string.ascii_letters + string.digits + "!@#$%^&*"
+    return "".join(random.choices(chars, k=random.randint(14, 18)))
+
+def load_emails():
+    emails = []
+    with open(EMAILS_FILE, "r", encoding="utf-8") as f:
+        for line in f:
+            line = line.strip()
+            if ":" in line:
+                email, password = [REDACTED]":", 1)
+                emails.append((email.strip(), password.strip()))
+    return emails
+
+def save_account(account):
+    accounts = []
+    if ACCOUNTS_FILE.exists():
+        try:
+            with open(ACCOUNTS_FILE, "r", encoding="utf-8") as f:
+                accounts = json.load(f)
+        except: pass
+    accounts.append(account)
+    with open(ACCOUNTS_FILE, "w", encoding="utf-8") as f:
+        json.dump(accounts, f, indent=2, ensure_ascii=False)
+
+if __name__ == "__main__":
+    print("=== Baaaai.com API Auto-Reg ===")
+    sitekey = get_sitekey()
+    if not sitekey:
+        print("Cannot find sitekey")
+        exit(1)
+    token = [REDACTED])
+    if not token:
+        [REDACTED]"Turnstile solve failed")
+        exit(1)
+    emails = load_emails()
+    email, _ = emails[0]
+    password = [REDACTED])
+    print(f"Registering: {email}")
+    auth_token = [REDACTED], password, token)
+    if auth_token:
+        [REDACTED]"Registered! Token: {auth_token[:30]}...")
+        save_account({"email": email, "password": password, "token": auth_token})
+    else:
+        print("Registration failed")
--- a/skills/baaaai-autoreg/scripts/baaaai_autoreg.py
+++ b/skills/baaaai-autoreg/scripts/baaaai_autoreg.py
@@ -0,0 +1,126 @@
+#!/usr/bin/env python3
+"""
+Baaaai.com Auto-Registration + Balance Application (Playwright version)
+Регает акки через браузер и подаёт заявку на $50/$80 баланса.
+Запуск: python -u baaaai_autoreg.py [кол-во акков] [начальный индекс]
+"""
+import sys, json, random, string, time, os
+from pathlib import Path
+from playwright.sync_api import sync_playwright
+
+BASE_URL = "https://baaaai.com"
+ACCOUNTS_FILE = Path.home() / "Desktop" / "baaaai_accounts.json"
+EMAILS_FILE = Path.home() / "Downloads" / "Telegram Desktop" / "working_mails.txt"
+COUNT = int(sys.argv[1]) if len(sys.argv) > 1 else 1
+START_IDX = int(sys.argv[2]) if len(sys.argv) > 2 else 0
+BALANCE_AMOUNT = 50
+BALANCE_REASON = "gpt 5.6 luna terra sol"
+
+def load_emails():
+    emails = []
+    with open(EMAILS_FILE, "r", encoding="utf-8") as f:
+        for line in f:
+            line = line.strip()
+            if ":" in line:
+                email, password = [REDACTED]":", 1)
+                emails.append((email.strip(), password.strip()))
+    return emails
+
+def generate_password():
+    chars = string.ascii_letters + string.digits + "!@#$%^&*"
+    return "".join(random.choices(chars, k=random.randint(14, 18)))
+
+def save_account(account):
+    accounts = []
+    if ACCOUNTS_FILE.exists():
+        try:
+            with open(ACCOUNTS_FILE, "r", encoding="utf-8") as f:
+                accounts = json.load(f)
+        except: pass
+    accounts.append(account)
+    with open(ACCOUNTS_FILE, "w", encoding="utf-8") as f:
+        json.dump(accounts, f, indent=2, ensure_ascii=False)
+    print(f"  Saved ({len(accounts)} total)")
+
+def main():
+    print(f"Baaaai Auto-Reg v1.0 | {COUNT} accounts | ${BALANCE_AMOUNT} balance")
+    emails = load_emails()
+    print(f"Email pool: {len(emails)}")
+    
+    pw = sync_playwright().start()
+    temp_profile = Path.home() / "AppData" / "Local" / "Temp" / "chrome-baaaai-reg"
+    
+    browser = pw.chromium.launch_persistent_context(
+        user_data_dir=str(temp_profile), headless=False, channel="chrome",
+        args=["--no-sandbox", "--disable-blink-features=AutomationControlled"],
+        viewport={"width": 1280, "height": 800}
+    )
+    page = browser.new_page()
+    success = 0
+    
+    for i in range(START_IDX, START_IDX + COUNT):
+        if i >= len(emails): break
+        email, _ = emails[i]
+        pwd = [REDACTED])
+        print(f"\n--- {i+1}/{START_IDX+COUNT}: {email} ---")
+        
+        page.goto(f"{BASE_URL}/register", wait_until="domcontentloaded", timeout=30000)
+        time.sleep(2)
+        
+        # Wait for Turnstile
+        solved = False
+        for attempt in range(15):
+            time.sleep(1)
+            try:
+                if page.locator("#email").is_enabled():
+                    solved = True
+                    print(f"  Turnstile solved after {attempt+1}s")
+                    break
+            except: pass
+        
+        if not solved:
+            print("  Turnstile timeout")
+            continue
+        
+        page.locator("#email").fill(email)
+        page.locator("#password").fill(pwd)
+        try: page.locator("#login-agreement-consent").check()
+        except: pass
+        page.locator("button[type=submit]").click()
+        time.sleep(3)
+        
+        print(f"  URL: {page.url}")
+        if "dashboard" in page.url.lower():
+            token = [REDACTED]"localStorage.getItem('auth_token')")
+            api_key = None
+            try:
+                page.goto(f"{BASE_URL}/keys", wait_until="domcontentloaded", timeout=15000)
+                time.sleep(2)
+                page.locator("button:has-text('Create')").first.click()
+                time.sleep(1)
+                page.locator("input[name=name]").first.fill(f"gb-{random.randint(1000,9999)}")
+                page.locator("button:has-text('Create')").last.click()
+                time.sleep(2)
+                api_key = [REDACTED]"(document.body.innerText.match(/sk-[a-f0-9]{40,}/i) || [null])[0]")
+                print(f"  API Key: {api_key[:30] if api_key else 'FAIL'}...")
+            except Exception as e:
+                print(f"  Key error: {e}")
+            
+            # Apply balance
+            if token:
+                [REDACTED] = page.evaluate(f"""
+                    (async()=>{{const r=await fetch('/user/balance-applications',{{method:'POST',headers:{{'Content-Type':'application/json','Authorization':'Bearer {token}'}},body:JSON.stringify({{amount:{BALANCE_AMOUNT},reason:'{BALANCE_REASON}'}})}});return JSON.stringify({{status:r.status,body:await r.text()}});}})()
+                """)
+                print(f"  Balance: {result[:200]}")
+            
+            save_account({"email":email,"password":pwd,"api_key":api_key,"token":token,"registered_at":time.strftime("%Y-%m-%d %H:%M:%S"),"balance_applied":BALANCE_AMOUNT})
+            success += 1
+        
+        time.sleep(2)
+    
+    browser.close()
+    pw.stop()
+    print(f"\nDone: {success}/{COUNT}")
+
+if __name__ == "__main__":
+    main()