#!/usr/bin/env python3
"""
vuln_app.py - "HomeLand Controller" (ban CO LOI, dung de DAY HOC)
==================================================================
Gia lap mot thiet bi IoT dieu khien nha ("HomeLand"): nhan lenh PING qua
TCP de kiem tra mot thiet bi khac trong nha co online khong.

CO Y CAI LOI: ham handle() noi chuoi nguoi dung gui thang vao lenh shell
(os.system voi shell=True) ma KHONG kiem tra ky tu dac biet. Day la loi
"OS command injection" - OWASP Top 10, hang Injection. Chi dung de hoc,
KHONG dung lam mau cho ung dung thuc te.

Chi chay o 127.0.0.1 (chinh may ban) theo mac dinh. Muon mo cho ca mang
lab (vi du de demo giua 2 may CUA BAN, da duoc phep) thi them --lan, va
CHI lam vay trong mang rieng ban kiem soat, khong bao gio ra Internet.
"""
import argparse
import socket
import platform
import subprocess

PORT_DEFAULT = 9500


def handle(payload: str) -> str:
    """Xu ly mot dong lenh dang: PING <ten_thiet_bi>

    LOI CO Y: ghep thang chuoi nguoi dung gui vao lenh shell.
    Vi du nguoi dung gui "PING 127.0.0.1; whoami" thi shell se chay CA
    HAI lenh: ping va whoami. Day goi la command injection.
    """
    payload = payload.strip()
    if not payload.upper().startswith("PING "):
        return "LOI: chi ho tro lenh PING <dia_chi>\n"
    target = payload[5:]  # <-- KHONG duoc kiem tra, day la cho ho (lo hong)
    flags = "-n 1 -w 1000" if platform.system() == "Windows" else "-c 1 -t 1"
    cmd = f"ping {flags} {target}"  # <-- noi chuoi vao shell: NGUY HIEM
    try:
        out = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=5)
        return (out.stdout + out.stderr) or "(khong co ket qua)\n"
    except Exception as e:  # noqa: BLE001 - demo day hoc, in loi tho de de quan sat
        return f"LOI: {e}\n"


def main():
    ap = argparse.ArgumentParser(description="HomeLand Controller (demo CO LOI de day hoc)")
    ap.add_argument("--port", type=int, default=PORT_DEFAULT)
    ap.add_argument("--lan", action="store_true",
                     help="mo cho ca mang lab thay vi chi 127.0.0.1 (chi dung mang rieng ban kiem soat)")
    args = ap.parse_args()
    bind_ip = "0.0.0.0" if args.lan else "127.0.0.1"

    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        s.bind((bind_ip, args.port))
        s.listen(5)
        print(f"[HomeLand - DEMO CO LOI] dang lang nghe {bind_ip}:{args.port}")
        print("Day la ung dung CO Y GAY LOI de hoc command injection. Khong dung thuc te.")
        while True:
            conn, addr = s.accept()
            with conn:
                data = conn.recv(4096).decode("utf-8", "replace")
                print(f"[ket noi tu {addr}] nhan: {data!r}")
                conn.sendall(handle(data).encode("utf-8", "replace"))


if __name__ == "__main__":
    main()