03-05-26, 07:53 PM
Hello DarkForums Community,
Today I am releasing the full source of a Chinese public-security criminal investigation Telegram bot (刑侦机器人) after the operator failed to make final payment.
What this tool does:
Target Info:
- Platform: Telegram Bot API (t.me)
- Bot Type: Inline-image criminal investigation query frontend
- Country: China (PRC)
- Purpose: Police internal database lookup interface disguised as a photo-menu Telegram bot
- Vulnerability: Hardcoded bot token + leaked image-based command structure revealing police backend query categories
Hardcoded Credentials:
[+] Telegram Bot Token: 7591728641:AAGDhSEA3jnyqJErS2HKU_19UT8F3ffHMLE
Capabilities:
- Menu 1 (Criminal Scene Investigation Queries):
- Query by investigator (按勘察人员查询)
- Query by material submission status (按材料上交情况查询)
- Query by case jurisdiction (按发案辖区查询)
- Query by case category (按案件类别查询)
- Query by report time (按接报时间查询)
- Statistics by case category (按案件类别统计)
- Statistics by case jurisdiction (案发辖区统计)
- Statistics by investigator (按勘察人员统计)
- Menu 2 (Forensic / examination Queries):
- Query by acceptance category (按受理类别查询)
- Query by examiner (按检验人员查询)
- Query by appraisal organization (按鉴定机构查询)
- Query by submitting unit (按送检单位查询)
- Query by acceptance time (按受理时间查询)
- Statistics by acceptance category (按受理类别统计)
- Statistics by examiner (按检验人员统计)
- Statistics by submitting unit (按送检单位统计)
- Statistics by acceptance time (按受理时间统计)
- Menu 3 (Switch Mode - PNG overlay):
- Household registration info (户籍信息)
- Household head members (户主成员)
- Identity settings (身份设置)
- Health status settings (健康状况设置)
Architecture:
- Image-based navigation system (5 JPG + 2 PNG overlay menus)
- Inline keyboard callbacks map to police DB query categories
- No auth or user validation -- open menu to anyone who starts the bot
- Uses python-telebot with polling loop
- All query logic is frontend-only in this release (backend connector stripped or not included)
Use Case:
- Map police internal query categories for red-team reconnaissance
- Take over the bot via leaked token to hijack the channel or phish officers
- Clone the UI for a fake police bot to harvest credentials
- Understand PRC law enforcement database query structure
- Build compatible backend connectors for each menu category
Deliverables Included:
[+] 123456789.py - Full original source
[+] 1.jpg - 5.jpg - Criminal investigation menu images
[+] 1.png - 2.png - Registration/health overlay images
Note:
- Bot token is live -- take over immediately or burn the webhook
- No backend API endpoints present in this leak (frontend/menu layer only)
- Images contain classified query categories used by Chinese police
- Operator scammed the dev for final payment -- source released in retaliation
- For research and OSINT purposes only
Download:
Files: https://t.me/+Lv3LYdpVyJc5ZTM0
Vouch center: https://t.me/+wuOFH81f2us1YmQ0
Website: https://xorcat.deals/ (I have permission and am authorized to perform this pentest)
Today I am releasing the full source of a Chinese public-security criminal investigation Telegram bot (刑侦机器人) after the operator failed to make final payment.
What this tool does:
Target Info:
- Platform: Telegram Bot API (t.me)
- Bot Type: Inline-image criminal investigation query frontend
- Country: China (PRC)
- Purpose: Police internal database lookup interface disguised as a photo-menu Telegram bot
- Vulnerability: Hardcoded bot token + leaked image-based command structure revealing police backend query categories
Hardcoded Credentials:
[+] Telegram Bot Token: 7591728641:AAGDhSEA3jnyqJErS2HKU_19UT8F3ffHMLE
Capabilities:
- Menu 1 (Criminal Scene Investigation Queries):
- Query by investigator (按勘察人员查询)
- Query by material submission status (按材料上交情况查询)
- Query by case jurisdiction (按发案辖区查询)
- Query by case category (按案件类别查询)
- Query by report time (按接报时间查询)
- Statistics by case category (按案件类别统计)
- Statistics by case jurisdiction (案发辖区统计)
- Statistics by investigator (按勘察人员统计)
- Menu 2 (Forensic / examination Queries):
- Query by acceptance category (按受理类别查询)
- Query by examiner (按检验人员查询)
- Query by appraisal organization (按鉴定机构查询)
- Query by submitting unit (按送检单位查询)
- Query by acceptance time (按受理时间查询)
- Statistics by acceptance category (按受理类别统计)
- Statistics by examiner (按检验人员统计)
- Statistics by submitting unit (按送检单位统计)
- Statistics by acceptance time (按受理时间统计)
- Menu 3 (Switch Mode - PNG overlay):
- Household registration info (户籍信息)
- Household head members (户主成员)
- Identity settings (身份设置)
- Health status settings (健康状况设置)
Architecture:
- Image-based navigation system (5 JPG + 2 PNG overlay menus)
- Inline keyboard callbacks map to police DB query categories
- No auth or user validation -- open menu to anyone who starts the bot
- Uses python-telebot with polling loop
- All query logic is frontend-only in this release (backend connector stripped or not included)
Use Case:
- Map police internal query categories for red-team reconnaissance
- Take over the bot via leaked token to hijack the channel or phish officers
- Clone the UI for a fake police bot to harvest credentials
- Understand PRC law enforcement database query structure
- Build compatible backend connectors for each menu category
Deliverables Included:
[+] 123456789.py - Full original source
[+] 1.jpg - 5.jpg - Criminal investigation menu images
[+] 1.png - 2.png - Registration/health overlay images
Note:
- Bot token is live -- take over immediately or burn the webhook
- No backend API endpoints present in this leak (frontend/menu layer only)
- Images contain classified query categories used by Chinese police
- Operator scammed the dev for final payment -- source released in retaliation
- For research and OSINT purposes only
Download:
Files: https://t.me/+Lv3LYdpVyJc5ZTM0
Vouch center: https://t.me/+wuOFH81f2us1YmQ0
Website: https://xorcat.deals/ (I have permission and am authorized to perform this pentest)
