#!/usr/bin/env python3
"""
Decrypt CamelSoft/Zytoon platform_settings encrypted values.
AES-256-GCM: key=SHA-256(VAULT_MASTER_KEY), IV(12)||ct+tag, Base64.
"""
import hashlib, base64, sys, subprocess

MASTER_KEY = "E_hOyMw-Eh--3PW_JYKRs3UwT_3ADjt4DiUeHnVn"
key_bytes = hashlib.sha256(MASTER_KEY.encode("utf-8")).digest()
print("[*] AES-256 key: " + key_bytes.hex(), file=sys.stderr)

# Fetch via SSH — use | as delimiter, -A (unaligned), -t (tuples only)
CMD = [
    "ssh", "-i", "/root/ir-assessment/redteam/camelsoft/ssh_keys/huna-server_root_ed25519",
    "-o", "StrictHostKeyChecking=no", "-o", "BatchMode=yes",
    "root@188.245.117.146",
    """PGPASSWORD=camelsoft psql -U camelsoft -h 127.0.0.1 -d ordrat -t -A -F'|' -c "SELECT category, key_name, encrypted_value FROM platform_settings WHERE encrypted_value IS NOT NULL AND encrypted_value != '' ORDER BY category, key_name" """
]

print("[*] Fetching encrypted platform_settings via SSH...", file=sys.stderr)
result = subprocess.run(CMD, capture_output=True, text=True, timeout=30)
if result.returncode != 0:
    print("ERROR: " + result.stderr, file=sys.stderr)
    sys.exit(1)

from cryptography.hazmat.primitives.ciphers.aead import AESGCM
aesgcm = AESGCM(key_bytes)

lines = result.stdout.strip().split("\n")
print("[*] Got " + str(len(lines)) + " encrypted settings\n", file=sys.stderr)

decrypted = []
for line in lines:
    parts = line.split("|")
    if len(parts) < 3:
        continue
    category, key_name, encrypted = parts[0], parts[1], parts[2]
    try:
        combined = base64.b64decode(encrypted)
        iv = combined[:12]
        ct_tag = combined[12:]
        plaintext = aesgcm.decrypt(iv, ct_tag, None).decode("utf-8")
        decrypted.append((category, key_name, plaintext))
    except Exception as e:
        print("[FAIL] " + category + "/" + key_name + ": " + str(e), file=sys.stderr)
        decrypted.append((category, key_name, "DECRYPT_FAILED: " + str(e)))

# Print + save
for cat, key, val in decrypted:
    # Truncate very long values (Apple cert P12 is 5900+ chars) for display
    disp = val if len(val) <= 120 else val[:120] + "... [" + str(len(val)) + " chars total]"
    print("[" + cat + "] " + key + " = " + disp)

with open("platform_settings_decrypted.txt", "w") as f:
    for cat, key, val in decrypted:
        f.write("[" + cat + "] " + key + " = " + val + "\n")
print("\n[*] Saved " + str(len(decrypted)) + " decrypted settings to platform_settings_decrypted.txt", file=sys.stderr)