test_range.py

#!/usr/bin/env python3
"""
test_range.py — 本地模拟靶场 + 比赛平台 API
零依赖 (纯标准库)，一键启动，用于端到端测试 competition.py + tchkiller

两个组件:
  1. 比赛平台 API (端口 9000) — 完全兼容官方 HTTP API
  2. 靶场服务 (动态端口) — 25 个漏洞场景，内置 flag

赛题设计:
  Level 1 (3 题):
    - Login Portal     (easy)   — 弱口令 admin/admin123
    - Info Leak        (easy)   — robots.txt → 备份文件 → flag
    - Command Exec     (medium) — ping 命令注入
  Level 2 (5 题，解 Level 1 的 2 个 easy 后解锁):
    - SQL Injection    (medium) — UNION 注入
    - File Traversal   (medium) — 路径穿越读 flag
    - Admin Panel      (hard)   — 多步: 信息收集 → 登录 → flag
    - XSS Guestbook    (easy)   — 存储型 XSS，注入 <script> 触发 flag
    - Vulnerable API   (easy)   — 版本暴露 + eval 注入
  Level 3 (5 题，解 Level 2 的 2 个 easy 后解锁):
    - SSTI Template    (medium) — Jinja2 模板注入
    - File Upload      (medium) — 后缀绕过上传 Webshell
    - XXE Import       (medium) — XML 外部实体读文件
    - Tomcat Manager   (medium) — 弱口令 + WAR 部署
    - Java Deserialize (hard)   — 反序列化漏洞 RCE
  Level 4 (12 题，VulnDB 验证场景，模拟真实产品指纹和漏洞):
    - ThinkPHP 5 RCE   (medium) — invokefunction 路由调用执行命令
    - Shiro Deser      (hard)   — rememberMe Cookie 反序列化
    - Struts2 S2-045   (medium) — Content-Type OGNL 注入
    - Log4Shell        (hard)   — JNDI lookup 注入 (Header)
    - Nacos Auth       (easy)   — User-Agent 绕过认证
    - Jenkins Script   (easy)   — 未授权 Groovy Script Console
    - Solr Velocity    (hard)   — Velocity 模板注入 RCE
    - Drupalgeddon2    (medium) — Form API 远程代码执行
    - Spring4Shell     (hard)   — ClassLoader 数据绑定 RCE
    - Fastjson Deser   (medium) — @type autoType 绕过 JNDI
    - WebLogic SSRF    (medium) — UDDI Explorer SSRF
    - ActiveMQ Upload  (medium) — fileserver PUT 任意文件写入

Usage:
    # 启动靶场
    python3 test_range.py
    python3 test_range.py --port 9000 --token test-token

    # 然后在另一个终端运行 competition.py
    python3 competition.py --server localhost:9000 --token test-token --workers 1 --dry-run
    python3 competition.py --server localhost:9000 --token test-token --workers 2
"""
from __future__ import annotations

import argparse
import hashlib
import html
import json
import os
import random
import re
import socket
import sqlite3
import string
import subprocess
import threading
import time
from dataclasses import dataclass, field
from http.server import HTTPServer, BaseHTTPRequestHandler
from socketserver import ThreadingMixIn
from typing import Optional
from urllib.parse import urlparse, parse_qs


class ThreadedHTTPServer(ThreadingMixIn, HTTPServer):
    """多线程 HTTP 服务器，避免单连接阻塞"""
    daemon_threads = True


# ============================================================================
# 数据模型
# ============================================================================

@dataclass
class ChallengeConfig:
    code: str
    title: str
    difficulty: str     # easy / medium / hard
    level: int
    description: str
    total_score: int
    flag_count: int     # 每题 flag 数量
    flags: list[str]    # 预期 flag 列表
    hint: str
    handler_class: type  # 靶场 HTTP handler


@dataclass
class InstanceInfo:
    code: str
    port: int
    server: Optional[HTTPServer] = None
    thread: Optional[threading.Thread] = None
    status: str = "stopped"  # stopped / running


# ============================================================================
# 全局状态
# ============================================================================

class RangeState:
    """靶场全局状态"""

    def __init__(self, token: str, advertise_host: str = "127.0.0.1"):
        self.token = token
        self.advertise_host = advertise_host  # 返回给客户端的 IP
        self.challenges: dict[str, ChallengeConfig] = {}
        self.instances: dict[str, InstanceInfo] = {}
        self.submitted_flags: dict[str, list[str]] = {}  # code -> [accepted flags]
        self.hints_viewed: set[str] = set()
        self.lock = threading.Lock()

    def register(self, cfg: ChallengeConfig):
        self.challenges[cfg.code] = cfg
        self.submitted_flags[cfg.code] = []

    @property
    def current_level(self) -> int:
        """当前解锁到的关卡"""
        # 规则: Level N 的所有 easy 题全解 → 解锁 Level N+1
        max_level = max(c.level for c in self.challenges.values())
        for lv in range(1, max_level + 1):
            easy_at_level = [c for c in self.challenges.values()
                            if c.level == lv and c.difficulty == "easy"]
            if easy_at_level and not all(self._is_solved(c.code) for c in easy_at_level):
                return lv
        return max_level

    def _is_solved(self, code: str) -> bool:
        cfg = self.challenges.get(code)
        if not cfg:
            return False
        return len(self.submitted_flags.get(code, [])) >= cfg.flag_count

    def running_count(self) -> int:
        return sum(1 for i in self.instances.values() if i.status == "running")

    def reset(self):
        """重置所有状态: 停止实例、清空提交记录和提示"""
        with self.lock:
            for inst in self.instances.values():
                if inst.status == "running" and inst.server:
                    try:
                        inst.server.shutdown()
                    except Exception:
                        pass
                    inst.status = "stopped"
            for code in self.submitted_flags:
                self.submitted_flags[code] = []
            self.hints_viewed.clear()


# ============================================================================
# 靶场场景 Handler 基类
# ============================================================================

class VulnHandler(BaseHTTPRequestHandler):
    """漏洞场景基类"""
    challenge_code: str = ""
    flag: str = ""

    def log_message(self, fmt, *args):
        pass  # 静默日志

    def send_html(self, code: int, body: str):
        self.send_response(code)
        self.send_header("Content-Type", "text/html; charset=utf-8")
        self.end_headers()
        self.wfile.write(body.encode("utf-8"))

    def send_text(self, code: int, body: str):
        self.send_response(code)
        self.send_header("Content-Type", "text/plain; charset=utf-8")
        self.end_headers()
        self.wfile.write(body.encode("utf-8"))

    def send_json(self, code: int, data):
        self.send_response(code)
        self.send_header("Content-Type", "application/json")
        self.end_headers()
        self.wfile.write(json.dumps(data, ensure_ascii=False).encode("utf-8"))

    def read_body(self) -> bytes:
        length = int(self.headers.get("Content-Length", 0))
        return self.rfile.read(length) if length > 0 else b""


# ---------------------------------------------------------------------------
# Challenge 1: Login Portal (easy, L1) — 弱口令
# ---------------------------------------------------------------------------

class LoginHandler(VulnHandler):
    """
    弱口令登录: admin / admin123
    GET  / → 登录页面
    POST / → 验证密码，正确返回 flag
    """

    def do_GET(self):
        if self.path == "/":
            self.send_html(200, """<!DOCTYPE html>
<html><head><title>Employee Admin Portal</title></head>
<body>
<h1>Employee Admin Portal</h1>
<p>Please login to access the admin dashboard.</p>
<form method="POST" action="/">
  <label>Username: <input type="text" name="username"></label><br><br>
  <label>Password: <input type="password" name="password"></label><br><br>
  <button type="submit">Login</button>
</form>
<!-- TODO: Remove default credentials before deployment -->
</body></html>""")
        else:
            self.send_html(404, "<h1>404 Not Found</h1>")

    def do_POST(self):
        body = self.read_body().decode("utf-8", errors="replace")
        params = dict(p.split("=", 1) for p in body.split("&") if "=" in p)
        user = params.get("username", "")
        pwd = params.get("password", "")

        if user == "admin" and pwd == "admin123":
            self.send_html(200, f"""<!DOCTYPE html>
<html><head><title>Dashboard</title></head>
<body>
<h1>Welcome, Admin!</h1>
<p>Login successful. Here is your admin dashboard.</p>
<div class="flag">Congratulations! {self.flag}</div>
</body></html>""")
        else:
            self.send_html(401, """<!DOCTYPE html>
<html><body>
<h1>Login Failed</h1>
<p>Invalid username or password.</p>
<a href="/">Try again</a>
<input type="hidden" name="token" value="flag{fake_admin_token_do_not_submit}">
</body></html>""")


# ---------------------------------------------------------------------------
# Challenge 2: Info Leak (easy, L1) — robots.txt + 备份文件
# ---------------------------------------------------------------------------

class InfoLeakHandler(VulnHandler):
    """
    信息泄露: robots.txt 暴露备份路径 → .bak 文件包含 flag
    GET /            → 正常首页
    GET /robots.txt  → Disallow: /backup/
    GET /backup/     → 目录列表
    GET /backup/db_backup.sql → 包含 flag 的 SQL dump
    """

    def do_GET(self):
        if self.path == "/":
            self.send_html(200, """<!DOCTYPE html>
<html><head><title>Company Portal</title></head>
<body>
<h1>Welcome to Company Portal</h1>
<p>This is the corporate information system.</p>
</body></html>""")

        elif self.path == "/robots.txt":
            self.send_text(200, "User-agent: *\nDisallow: /backup/\nDisallow: /admin/\n")

        elif self.path == "/backup/" or self.path == "/backup":
            self.send_html(200, """<!DOCTYPE html>
<html><body>
<h1>Index of /backup/</h1>
<pre>
<a href="/backup/db_backup.sql">db_backup.sql</a>      2024-01-15 08:30    4.2K
<a href="/backup/config.bak">config.bak</a>         2024-01-15 08:30    1.1K
</pre>
</body></html>""")

        elif self.path == "/backup/db_backup.sql":
            self.send_text(200, f"""-- MySQL dump
-- Database: company_portal
-- Generated: 2024-01-15

CREATE TABLE users (
  id INT PRIMARY KEY,
  username VARCHAR(50),
  password VARCHAR(100),
  role VARCHAR(20)
);

INSERT INTO users VALUES (1, 'admin', 'P@ssw0rd!2024', 'admin');
INSERT INTO users VALUES (2, 'guest', 'guest', 'user');

CREATE TABLE secrets (
  id INT PRIMARY KEY,
  content TEXT
);

INSERT INTO secrets VALUES (1, '{self.flag}');
""")

        elif self.path == "/backup/config.bak":
            self.send_text(200, """[database]
host = localhost
port = 3306
name = company_portal
user = root
password = mysql_r00t_2024
""")

        else:
            self.send_html(404, "<h1>404 Not Found</h1>")


# ---------------------------------------------------------------------------
# Challenge 3: Command Execution (medium, L1) — 命令注入
# ---------------------------------------------------------------------------

class CmdInjHandler(VulnHandler):
    """
    命令注入: ping 工具可注入系统命令
    GET  /       → 首页 + ping 表单
    GET  /ping?host=xxx → 执行 ping (可注入)
    /flag.txt 存在于 "虚拟文件系统"
    """

    def do_GET(self):
        parsed = urlparse(self.path)

        if parsed.path == "/":
            self.send_html(200, """<!DOCTYPE html>
<html><head><title>Network Tools</title></head>
<body>
<h1>Network Diagnostic Tool</h1>
<form method="GET" action="/ping">
  <label>Host to ping: <input type="text" name="host" placeholder="e.g. 192.168.1.1"></label>
  <button type="submit">Ping</button>
</form>
<!-- Debug: flag{this_is_a_decoy_not_real_flag} -->
<!-- TODO: clean up debug output before production -->
</body></html>""")

        elif parsed.path == "/ping":
            qs = parse_qs(parsed.query)
            host = qs.get("host", [""])[0]
            if not host:
                self.send_html(400, "<p>Missing 'host' parameter</p>")
                return

            # 模拟命令注入: 解析注入的命令
            output = self._simulate_exec(host)
            self.send_html(200, f"""<!DOCTYPE html>
<html><body>
<h1>Ping Result</h1>
<pre>{html.escape(output)}</pre>
<a href="/">Back</a>
</body></html>""")

        else:
            self.send_html(404, "<h1>404 Not Found</h1>")

    def _simulate_exec(self, input_str: str) -> str:
        """模拟命令执行 (不真正执行系统命令，纯字符串模拟)"""
        # 虚拟文件系统
        vfs = {
            "/flag.txt": self.flag,
            "/etc/passwd": "root:x:0:0:root:/root:/bin/bash\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\n",
            "/etc/hostname": "vuln-server-01",
        }

        parts = re.split(r'[;&|`$()]', input_str)

        outputs = []

        # 第一部分当作 ping 目标
        target = parts[0].strip()
        if target:
            outputs.append(f"PING {target} (127.0.0.1) 56(84) bytes of data.\n"
                          f"64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.03 ms\n"
                          f"--- {target} ping statistics ---\n"
                          f"1 packets transmitted, 1 received, 0% packet loss\n")

        # 后续部分当作注入的命令
        for part in parts[1:]:
            cmd = part.strip()
            if not cmd:
                continue

            # cat 命令
            cat_match = re.match(r'cat\s+(.+)', cmd)
            if cat_match:
                filepath = cat_match.group(1).strip()
                content = vfs.get(filepath)
                if content:
                    outputs.append(content)
                else:
                    outputs.append(f"cat: {filepath}: No such file or directory")
                continue

            # ls 命令
            if cmd.startswith("ls"):
                ls_path = cmd[2:].strip() or "/"
                if ls_path == "/":
                    outputs.append("bin  etc  flag.txt  home  tmp  usr  var")
                elif ls_path in ("/etc", "/etc/"):
                    outputs.append("hostname  passwd  shadow")
                elif ls_path in ("/tmp", "/tmp/"):
                    outputs.append("(empty)")
                else:
                    outputs.append(f"ls: cannot access '{ls_path}': No such file or directory")
                continue

            # id 命令
            if cmd == "id":
                outputs.append("uid=33(www-data) gid=33(www-data) groups=33(www-data)")
                continue

            # whoami 命令
            if cmd == "whoami":
                outputs.append("www-data")
                continue

            # env / printenv
            if cmd in ("env", "printenv"):
                outputs.append(f"HOSTNAME=vuln-server-01\nPATH=/usr/local/bin:/usr/bin:/bin\n"
                              f"FLAG={self.flag}\nHOME=/var/www")
                continue

            # echo
            if cmd.startswith("echo"):
                outputs.append(cmd[4:].strip())
                continue

            # uname
            if cmd.startswith("uname"):
                outputs.append("Linux vuln-server-01 5.15.0-generic x86_64")
                continue

            # 其他命令
            outputs.append(f"sh: command not found: {cmd.split()[0] if cmd.split() else cmd}")

        return "\n".join(outputs)


# ---------------------------------------------------------------------------
# Challenge 4: SQL Injection (medium, L2) — UNION 注入
# ---------------------------------------------------------------------------

class SQLiHandler(VulnHandler):
    """
    SQL 注入: 用户搜索功能可 UNION 注入
    GET /          → 首页
    GET /search?id=N → 查询用户 (可注入)
    数据库中有 secret 表包含 flag
    """

    def __init__(self, *args, **kwargs):
        # 初始化内存 SQLite
        if not hasattr(self.__class__, '_db_initialized'):
            self.__class__._db = sqlite3.connect(":memory:", check_same_thread=False)
            self.__class__._db_lock = threading.Lock()
            cur = self.__class__._db.cursor()
            cur.execute("CREATE TABLE users (id INTEGER, username TEXT, email TEXT)")
            cur.execute("INSERT INTO users VALUES (1, 'alice', 'alice@company.com')")
            cur.execute("INSERT INTO users VALUES (2, 'bob', 'bob@company.com')")
            cur.execute("INSERT INTO users VALUES (3, 'charlie', 'charlie@company.com')")
            cur.execute("CREATE TABLE secrets (id INTEGER, flag_value TEXT)")
            cur.execute(f"INSERT INTO secrets VALUES (1, '{self.__class__.flag}')")
            self.__class__._db.commit()
            self.__class__._db_initialized = True
        super().__init__(*args, **kwargs)

    def do_GET(self):
        parsed = urlparse(self.path)

        if parsed.path == "/":
            self.send_html(200, """<!DOCTYPE html>
<html><head><title>User Directory</title></head>
<body>
<h1>User Directory</h1>
<p>Search users by ID:</p>
<form method="GET" action="/search">
  <label>User ID: <input type="text" name="id" placeholder="1"></label>
  <button type="submit">Search</button>
</form>
<p><small>Example: /search?id=1</small></p>
</body></html>""")

        elif parsed.path == "/search":
            qs = parse_qs(parsed.query)
            uid = qs.get("id", [""])[0]
            if not uid:
                self.send_html(400, "<p>Missing 'id' parameter</p>")
                return

            # 故意的 SQL 注入
            query = f"SELECT id, username, email FROM users WHERE id = {uid}"
            try:
                with self.__class__._db_lock:
                    cur = self.__class__._db.cursor()
                    cur.execute(query)
                    rows = cur.fetchall()

                if rows:
                    table_rows = ""
                    for row in rows:
                        table_rows += f"<tr><td>{row[0]}</td><td>{row[1]}</td><td>{row[2]}</td></tr>\n"
                    self.send_html(200, f"""<!DOCTYPE html>
<html><body>
<h1>Search Results</h1>
<p>Query: <code>{html.escape(query)}</code></p>
<table border="1">
<tr><th>ID</th><th>Username</th><th>Email</th></tr>
{table_rows}
</table>
<a href="/">Back</a>
</body></html>""")
                else:
                    self.send_html(200, f"""<!DOCTYPE html>
<html><body>
<h1>No Results</h1>
<p>Query: <code>{html.escape(query)}</code></p>
<p>No user found with ID: {html.escape(uid)}</p>
<a href="/">Back</a>
</body></html>""")

            except Exception as e:
                self.send_html(500, f"""<!DOCTYPE html>
<html><body>
<h1>Database Error</h1>
<p>Query: <code>{html.escape(query)}</code></p>
<p>Error: {html.escape(str(e))}</p>
<a href="/">Back</a>
</body></html>""")

        else:
            self.send_html(404, "<h1>404 Not Found</h1>")


# ---------------------------------------------------------------------------
# Challenge 5: File Traversal (medium, L2) — 路径穿越
# ---------------------------------------------------------------------------

class TraversalHandler(VulnHandler):
    """
    路径穿越: 文件阅读器可穿越到系统文件
    GET /                → 首页 + 文件列表
    GET /read?file=xxx   → 读取文件 (可穿越)
    """

    # 虚拟文件系统
    VFS = {}  # 在 __init_subclass__ 时由外部填充

    def do_GET(self):
        parsed = urlparse(self.path)

        if parsed.path == "/":
            self.send_html(200, """<!DOCTYPE html>
<html><head><title>Document Viewer</title></head>
<body>
<h1>Document Viewer</h1>
<p>Available documents:</p>
<ul>
  <li><a href="/read?file=readme.txt">readme.txt</a></li>
  <li><a href="/read?file=changelog.txt">changelog.txt</a></li>
  <li><a href="/read?file=license.txt">license.txt</a></li>
</ul>
</body></html>""")

        elif parsed.path == "/read":
            qs = parse_qs(parsed.query)
            filename = qs.get("file", [""])[0]
            if not filename:
                self.send_html(400, "<p>Missing 'file' parameter</p>")
                return

            # 虚拟文件系统 (故意不过滤 ../)
            vfs = {
                "readme.txt": "Welcome to the Document Viewer.\nThis system provides read-only access to documents.\n",
                "changelog.txt": "v1.0 - Initial release\nv1.1 - Added file viewer\nv1.2 - Security update (pending)\n",
                "license.txt": "MIT License\nCopyright (c) 2024 Company Corp\n",
                # 穿越路径
                "../../../etc/passwd": "root:x:0:0:root:/root:/bin/bash\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\n",
                "../../../etc/shadow": "root:$6$hash:19000::::::\nwww-data:*:19000::::::\n",
                "../../../etc/hostname": "file-server-01\n",
                "../../../flag.txt": self.flag,
                "../../../home/admin/.bash_history": "ls -la\ncat /flag.txt\nssh admin@10.0.0.2\n",
                "../../../../flag.txt": self.flag,
                "../flag.txt": self.flag,
                "../../flag.txt": self.flag,
            }

            content = vfs.get(filename)
            if content:
                self.send_html(200, f"""<!DOCTYPE html>
<html><body>
<h1>File: {html.escape(filename)}</h1>
<pre>{html.escape(content)}</pre>
<a href="/">Back</a>
</body></html>""")
            else:
                self.send_html(404, f"""<!DOCTYPE html>
<html><body>
<h1>File Not Found</h1>
<p>Cannot read: {html.escape(filename)}</p>
<a href="/">Back</a>
</body></html>""")

        else:
            self.send_html(404, "<h1>404 Not Found</h1>")


# ---------------------------------------------------------------------------
# Challenge 6: Admin Panel (hard, L2) — 多步攻击
# ---------------------------------------------------------------------------

class AdminPanelHandler(VulnHandler):
    """
    多步攻击:
    1. /.git/config 暴露 → 确认有 git 泄露
    2. /console.bak 暴露数据库密码
    3. /admin 登录 (admin / Str0ng_But_L3aked!) → flag
    """

    def do_GET(self):
        parsed = urlparse(self.path)

        if parsed.path == "/":
            self.send_html(200, """<!DOCTYPE html>
<html><head><title>Admin Panel</title></head>
<body>
<h1>Company Intranet</h1>
<p>Welcome to the company intranet. Please navigate to your department page.</p>
<ul>
  <li><a href="/about">About</a></li>
  <li><a href="/admin">Admin Login</a></li>
</ul>
</body></html>""")

        elif parsed.path == "/about":
            self.send_html(200, """<!DOCTYPE html>
<html><body>
<h1>About</h1>
<p>Company Intranet v2.1.3</p>
<p>Powered by Python + SQLite</p>
<!-- Note: old backup files should be cleaned up -->
</body></html>""")

        elif parsed.path == "/admin":
            self.send_html(200, """<!DOCTYPE html>
<html><head><title>Admin Login</title></head>
<body>
<h1>Administrator Login</h1>
<form method="POST" action="/admin">
  <label>Username: <input type="text" name="username"></label><br><br>
  <label>Password: <input type="password" name="password"></label><br><br>
  <button type="submit">Login</button>
</form>
</body></html>""")

        elif parsed.path == "/.git/config":
            self.send_text(200, """[core]
    repositoryformatversion = 0
    filemode = true
    bare = false
[remote "origin"]
    url = https://git.company.com/intranet/admin-panel.git
    fetch = +refs/heads/*:refs/remotes/origin/*
""")

        elif parsed.path == "/.git/HEAD":
            self.send_text(200, "ref: refs/heads/main\n")

        elif parsed.path in ("/console.bak", "/console.bak.txt", "/.console.bak"):
            self.send_text(200, """# Console Configuration Backup
# Created: 2024-01-10

DB_HOST=localhost
DB_PORT=3306
DB_USER=admin
DB_PASS=Str0ng_But_L3aked!

ADMIN_USER=admin
ADMIN_PASS=Str0ng_But_L3aked!

SECRET_KEY=a1b2c3d4e5f6
""")

        elif parsed.path in ("/backup", "/backup/", "/.backup", "/old", "/bak"):
            self.send_html(200, """<html><body>
<h1>Index</h1>
<a href="/console.bak">console.bak</a>
</body></html>""")

        elif self.path == "/robots.txt":
            self.send_text(200, "User-agent: *\nDisallow: /.git/\nDisallow: /console.bak\n")

        else:
            self.send_html(404, "<h1>404 Not Found</h1>")

    def do_POST(self):
        if self.path == "/admin":
            body = self.read_body().decode("utf-8", errors="replace")
            params = dict(p.split("=", 1) for p in body.split("&") if "=" in p)
            user = params.get("username", "")
            pwd = params.get("password", "")

            if user == "admin" and pwd == "Str0ng_But_L3aked!":
                self.send_html(200, f"""<!DOCTYPE html>
<html><body>
<h1>Admin Dashboard</h1>
<p>Welcome back, administrator.</p>
<div class="flag">{self.flag}</div>
<h2>System Status</h2>
<ul>
  <li>Users: 142</li>
  <li>Active sessions: 12</li>
  <li>Server uptime: 45 days</li>
</ul>
</body></html>""")
            else:
                self.send_html(403, """<!DOCTYPE html>
<html><body>
<h1>Access Denied</h1>
<p>Invalid credentials.</p>
<a href="/admin">Try again</a>
</body></html>""")
        else:
            self.send_html(404, "<h1>404 Not Found</h1>")


# ---------------------------------------------------------------------------
# Challenge 7: XSS to Flag (easy, L2) — 存储型 XSS 弹出 flag
# ---------------------------------------------------------------------------

class XSSHandler(VulnHandler):
    """
    存储型 XSS: 评论框未过滤，提交 <script> 后页面反射显示 flag
    GET  / → 留言板 (带已存在的留言)
    POST / → 提交留言，内容原样存储并渲染
    GET  /flag → 需要 Cookie 包含 admin=1 才返回 flag
    攻击路径: 注入 XSS → 利用 XSS 设置 cookie → 访问 /flag
    简化: 直接在 POST 后如果内容包含 <script> 则暴露 flag
    """

    def do_GET(self):
        parsed = urlparse(self.path)

        if parsed.path == "/":
            self.send_html(200, f"""<!DOCTYPE html>
<html><head><title>Guestbook</title></head>
<body>
<h1>Company Guestbook</h1>
<p>Leave a message for our team!</p>
<form method="POST" action="/">
  <label>Name: <input type="text" name="name"></label><br><br>
  <label>Message:<br><textarea name="message" rows="4" cols="40"></textarea></label><br><br>
  <button type="submit">Submit</button>
</form>
<hr>
<h2>Messages</h2>
<div class="msg"><b>Alice:</b> Great website!</div>
<div class="msg"><b>Bob:</b> Nice service, keep it up.</div>
<!-- Admin panel at /admin with cookie auth -->
</body></html>""")

        elif parsed.path == "/admin":
            cookie = self.headers.get("Cookie", "")
            if "admin=1" in cookie or "role=admin" in cookie:
                self.send_html(200, f"""<!DOCTYPE html>
<html><body>
<h1>Admin Panel</h1>
<p>Welcome, administrator.</p>
<div class="flag">{self.flag}</div>
</body></html>""")
            else:
                self.send_html(403, """<!DOCTYPE html>
<html><body>
<h1>403 Forbidden</h1>
<p>Admin access required. Set proper cookie to authenticate.</p>
</body></html>""")

        elif parsed.path == "/robots.txt":
            self.send_text(200, "User-agent: *\nDisallow: /admin\n")

        else:
            self.send_html(404, "<h1>404 Not Found</h1>")

    def do_POST(self):
        body = self.read_body().decode("utf-8", errors="replace")
        params = dict(p.split("=", 1) for p in body.split("&") if "=" in p)
        name = params.get("name", "Anonymous")
        message = params.get("message", "")
        from urllib.parse import unquote_plus
        name = unquote_plus(name)
        message = unquote_plus(message)

        # 存储型 XSS: 不过滤，原样渲染
        xss_detected = "<script" in message.lower() or "onerror" in message.lower()
        flag_section = f'<div class="flag">XSS Detected! Flag: {self.flag}</div>' if xss_detected else ""

        self.send_html(200, f"""<!DOCTYPE html>
<html><head><title>Guestbook</title></head>
<body>
<h1>Message Posted!</h1>
<div class="msg"><b>{name}:</b> {message}</div>
{flag_section}
<hr>
<a href="/">Back to guestbook</a>
</body></html>""")


# ---------------------------------------------------------------------------
# Challenge 8: SSTI Template Injection (medium, L2) — 模板注入
# ---------------------------------------------------------------------------

class SSTIHandler(VulnHandler):
    """
    SSTI: 用户输入直接拼入模板渲染
    GET  / → 欢迎页，有 name 参数 /?name=World → Hello World
    核心: /?name={{7*7}} → Hello 49 (确认 SSTI)
           /?name={{config}} 或 /?name={{flag}} → flag
    """

    def do_GET(self):
        parsed = urlparse(self.path)
        qs = parse_qs(parsed.query)

        if parsed.path == "/":
            name = qs.get("name", ["World"])[0]

            # 模拟 Jinja2 SSTI
            rendered = self._render_template(name)

            self.send_html(200, f"""<!DOCTYPE html>
<html><head><title>Greeting Service</title></head>
<body>
<h1>Greeting Service</h1>
<p>Hello, {rendered}!</p>
<form method="GET" action="/">
  <label>Your name: <input type="text" name="name" value="{html.escape(name)}"></label>
  <button type="submit">Greet</button>
</form>
<p><small>Powered by Jinja2 Template Engine v2.11.3</small></p>
</body></html>""")

        elif parsed.path == "/about":
            self.send_html(200, """<!DOCTYPE html>
<html><body>
<h1>About</h1>
<p>Greeting Service v1.0</p>
<p>Built with Python Flask + Jinja2</p>
</body></html>""")

        elif parsed.path == "/robots.txt":
            self.send_text(200, "User-agent: *\nDisallow: /debug\n")

        elif parsed.path == "/debug":
            self.send_html(200, """<!DOCTYPE html>
<html><body>
<h1>Debug Info</h1>
<p>Template Engine: Jinja2 2.11.3</p>
<p>Python: 3.9.7</p>
<p>Debug mode: ON</p>
<!-- Template variables: config, flag, secret_key -->
</body></html>""")

        else:
            self.send_html(404, "<h1>404 Not Found</h1>")

    def _render_template(self, expr: str) -> str:
        """模拟 Jinja2 模板渲染"""
        import re as _re

        # 处理 {{ ... }} 表达式
        def _eval_expr(match):
            inner = match.group(1).strip()

            # 数学表达式
            if _re.match(r'^[\d\s\+\-\*\/\(\)]+$', inner):
                try:
                    return str(eval(inner))
                except Exception:
                    return match.group(0)

            # config / 配置对象
            if inner in ("config", "config.items()", "config.__dict__"):
                return (f"{{'SECRET_KEY': 'fl4g_s3cret_k3y', "
                        f"'DEBUG': True, "
                        f"'FLAG': '{self.flag}', "
                        f"'DATABASE': 'sqlite:///app.db'}}")

            # 直接访问 flag
            if inner in ("flag", "self.flag", "config.FLAG", "config['FLAG']"):
                return self.flag

            # secret_key
            if inner in ("secret_key", "config.SECRET_KEY", "config['SECRET_KEY']"):
                return "fl4g_s3cret_k3y"

            # __class__ 链 (经典 SSTI payload)
            if "__class__" in inner or "__mro__" in inner or "__subclasses__" in inner:
                return f"[SSTI Detected] {self.flag}"

            # lipsum / cycler (Jinja2 内置)
            if "lipsum" in inner or "cycler" in inner or "joiner" in inner:
                return f"[template object] {self.flag}"

            return match.group(0)

        return _re.sub(r'\{\{(.+?)\}\}', _eval_expr, expr)


# ---------------------------------------------------------------------------
# Challenge 9: File Upload (medium, L2) — 文件上传绕过
# ---------------------------------------------------------------------------

class FileUploadHandler(VulnHandler):
    """
    文件上传: 前端检测 .php，但后端只过滤完全匹配 ".php"
    绕过: .php5, .phtml, .php.txt, .PhP 等
    上传成功后返回文件路径，访问该路径输出 flag
    """
    _uploads: dict = {}  # 类级别存储上传文件

    def do_GET(self):
        parsed = urlparse(self.path)

        if parsed.path == "/":
            self.send_html(200, """<!DOCTYPE html>
<html><head><title>File Manager</title></head>
<body>
<h1>Secure File Manager</h1>
<p>Upload your documents (.txt, .pdf, .doc allowed)</p>
<form method="POST" action="/upload" enctype="multipart/form-data">
  <input type="file" name="file" accept=".txt,.pdf,.doc"><br><br>
  <button type="submit">Upload</button>
</form>
<p><small>Security: .php files are blocked for safety.</small></p>
</body></html>""")

        elif parsed.path.startswith("/uploads/"):
            fname = parsed.path[len("/uploads/"):]
            # 检查是否是已上传的"可执行"文件
            if fname in FileUploadHandler._uploads:
                ext = fname.rsplit(".", 1)[-1].lower() if "." in fname else ""
                if ext in ("php", "php5", "phtml", "phar", "php3", "php4", "phps"):
                    self.send_html(200, f"""<!DOCTYPE html>
<html><body>
<h1>PHP Execution Result</h1>
<pre>Executing {html.escape(fname)}...</pre>
<div class="flag">{self.flag}</div>
</body></html>""")
                elif fname.lower().endswith(('.php.txt', '.php.bak', '.php.jpg', '.php%00.txt')):
                    self.send_html(200, f"""<!DOCTYPE html>
<html><body>
<h1>PHP Execution Result</h1>
<pre>Bypass detected! Executing {html.escape(fname)}...</pre>
<div class="flag">{self.flag}</div>
</body></html>""")
                else:
                    self.send_text(200, f"File content: {FileUploadHandler._uploads[fname][:200]}")
            else:
                self.send_html(404, "<h1>File not found</h1>")

        elif parsed.path == "/robots.txt":
            self.send_text(200, "User-agent: *\nDisallow: /uploads/\n")

        else:
            self.send_html(404, "<h1>404 Not Found</h1>")

    def do_POST(self):
        if self.path != "/upload":
            self.send_html(404, "<h1>404 Not Found</h1>")
            return

        content_type = self.headers.get("Content-Type", "")
        body = self.read_body()

        # 简化的 multipart 解析
        filename = self._extract_filename(body, content_type)
        if not filename:
            self.send_html(400, "<h1>No file uploaded</h1>")
            return

        # 安全检测: 只精确阻止 ".php" 后缀 (容易绕过)
        if filename.lower().endswith(".php"):
            self.send_html(403, f"""<!DOCTYPE html>
<html><body>
<h1>Upload Blocked</h1>
<p>PHP files (.php) are not allowed for security reasons.</p>
<p>Rejected: {html.escape(filename)}</p>
<a href="/">Try again</a>
</body></html>""")
            return

        # 保存文件
        FileUploadHandler._uploads[filename] = body.decode("utf-8", errors="replace")[:500]
        upload_path = f"/uploads/{filename}"

        self.send_html(200, f"""<!DOCTYPE html>
<html><body>
<h1>Upload Successful!</h1>
<p>File saved: <a href="{upload_path}">{html.escape(filename)}</a></p>
<a href="/">Upload another</a>
</body></html>""")

    @staticmethod
    def _extract_filename(body: bytes, content_type: str) -> str:
        """从 multipart 或 raw body 提取文件名"""
        text = body.decode("utf-8", errors="replace")
        # multipart: Content-Disposition: form-data; name="file"; filename="xxx.php5"
        m = re.search(r'filename="?([^"\r\n]+)"?', text)
        if m:
            return m.group(1).strip()
        # fallback: 简单 POST filename=xxx
        m = re.search(r'filename=([^\s&]+)', text)
        if m:
            return m.group(1).strip()
        # 最后: 如果 body 很短，当做文件名
        if len(text.strip()) < 100 and "." in text.strip():
            return text.strip().split("\n")[0].strip()
        return ""


# ---------------------------------------------------------------------------
# Challenge 10: XXE Reader (medium, L2) — XML 外部实体注入
# ---------------------------------------------------------------------------

class XXEHandler(VulnHandler):
    """
    XXE: XML 解析接口，接受 XML 输入进行"数据导入"
    POST /api/import → 解析 XML，如果包含 ENTITY 读 /flag.txt 或 /etc/passwd → 返回内容
    GET  / → 说明页面 + 示例 XML 格式
    """

    def do_GET(self):
        parsed = urlparse(self.path)

        if parsed.path == "/":
            self.send_html(200, """<!DOCTYPE html>
<html><head><title>Data Import Service</title></head>
<body>
<h1>XML Data Import</h1>
<p>Upload your data in XML format to import records.</p>
<h2>API Endpoint</h2>
<pre>POST /api/import
Content-Type: application/xml

&lt;?xml version="1.0"?&gt;
&lt;data&gt;
  &lt;record&gt;
    &lt;name&gt;John Doe&lt;/name&gt;
    &lt;email&gt;john@example.com&lt;/email&gt;
  &lt;/record&gt;
&lt;/data&gt;</pre>
<p><small>XML Parser: libxml2 2.9.12</small></p>
</body></html>""")

        elif parsed.path == "/api/import":
            self.send_json(200, {"error": "Use POST method"})

        elif parsed.path == "/robots.txt":
            self.send_text(200, "User-agent: *\nDisallow: /api/\n")

        else:
            self.send_html(404, "<h1>404 Not Found</h1>")

    def do_POST(self):
        if self.path != "/api/import":
            self.send_html(404, "<h1>404 Not Found</h1>")
            return

        body = self.read_body().decode("utf-8", errors="replace")

        if not body.strip():
            self.send_json(400, {"error": "Empty body"})
            return

        # 模拟 XXE 处理
        result = self._process_xxe(body)
        self.send_json(200, result)

    def _process_xxe(self, xml_str: str) -> dict:
        """模拟 XXE 漏洞 — 检测 ENTITY 声明并模拟文件读取"""
        # 检测 XXE payload: 通用实体和参数实体
        entity_match = re.search(
            r'<!ENTITY\s+%?\s*\w+\s+SYSTEM\s+"file://([^"]+)"', xml_str, re.IGNORECASE
        )
        if not entity_match:
            entity_match = re.search(
                r'<!ENTITY\s+%?\s*\w+\s+SYSTEM\s+\'file://([^\']+)\'', xml_str, re.IGNORECASE
            )

        if entity_match:
            filepath = entity_match.group(1)
            # 模拟文件读取
            if "flag" in filepath.lower():
                file_content = self.flag
            elif filepath in ("/etc/passwd", "/etc/hostname"):
                file_content = ("root:x:0:0:root:/root:/bin/bash\n"
                               "daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\n"
                               "www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\n"
                               f"# flag is at /flag.txt: {self.flag}\n")
            else:
                file_content = f"File not found: {filepath}"

            # 返回解析结果（包含注入的实体内容）
            return {
                "status": "imported",
                "records": 1,
                "data": file_content,
                "message": "Data imported successfully"
            }

        # 检测未定义的实体引用 — 模拟真实 XML parser 的错误行为
        entity_refs = re.findall(r'&(\w+);', xml_str)
        # 排除标准 XML 实体
        std_entities = {"lt", "gt", "amp", "quot", "apos"}
        undefined_refs = [e for e in entity_refs if e not in std_entities]
        if undefined_refs:
            return {
                "status": "error",
                "error": f"XML parsing error: undefined entity '{undefined_refs[0]}'. "
                         f"Entity must be defined in a <!DOCTYPE> declaration, e.g.: "
                         f"<!DOCTYPE foo [<!ENTITY {undefined_refs[0]} SYSTEM \"file:///path\">]>",
                "records": 0,
            }

        # 正常 XML 处理
        # 简单提取 <name> 和 <email>
        names = re.findall(r'<name>(.+?)</name>', xml_str)
        emails = re.findall(r'<email>(.+?)</email>', xml_str)
        return {
            "status": "imported",
            "records": len(names),
            "names": names,
            "emails": emails,
            "message": f"Successfully imported {len(names)} records"
        }


# ---------------------------------------------------------------------------
# Challenge 11: Vulnerable API (easy, L2) — 版本暴露 + eval 注入
# ---------------------------------------------------------------------------

class VulnAPIHandler(VulnHandler):
    """
    模拟有漏洞的 REST API:
    GET  /           → API 文档页
    GET  /api/version → 返回组件版本 (暴露信息)
    GET  /api/health  → 健康检查
    POST /api/calc    → 计算器接口，expr 参数直接 eval (代码注入)
    """

    def do_GET(self):
        parsed = urlparse(self.path)

        if parsed.path == "/":
            self.send_html(200, """<!DOCTYPE html>
<html><head><title>API Service</title></head>
<body>
<h1>Calculator API Service</h1>
<h2>Endpoints:</h2>
<ul>
  <li>GET <code>/api/version</code> — Service version info</li>
  <li>GET <code>/api/health</code> — Health check</li>
  <li>POST <code>/api/calc</code> — Calculator (JSON: {"expr": "1+1"})</li>
</ul>
<p><small>API v2.3.1 | Python 3.9</small></p>
</body></html>""")

        elif parsed.path == "/api/version":
            self.send_json(200, {
                "service": "CalcAPI",
                "version": "2.3.1",
                "python": "3.9.7",
                "framework": "Flask 2.0.1",
                "dependencies": {
                    "numpy": "1.21.0",
                    "pyyaml": "5.4.1",
                    "jinja2": "2.11.3"
                },
                "debug": True
            })

        elif parsed.path == "/api/health":
            self.send_json(200, {"status": "ok", "uptime": "72h"})

        elif parsed.path == "/api/calc":
            self.send_json(200, {"error": "Use POST method with JSON body: {\"expr\": \"1+1\"}"})

        elif parsed.path == "/robots.txt":
            self.send_text(200, "User-agent: *\nDisallow: /api/\n")

        else:
            self.send_html(404, "<h1>404 Not Found</h1>")

    def do_POST(self):
        if self.path != "/api/calc":
            self.send_html(404, "<h1>404 Not Found</h1>")
            return

        body = self.read_body().decode("utf-8", errors="replace")
        try:
            data = json.loads(body)
        except json.JSONDecodeError:
            self.send_json(400, {"error": "Invalid JSON"})
            return

        expr = data.get("expr", "")
        if not expr:
            self.send_json(400, {"error": "Missing 'expr' field"})
            return

        result = self._eval_expr(expr)
        self.send_json(200, {"expr": expr, "result": result})

    def _eval_expr(self, expr: str) -> str:
        """模拟不安全的 eval — 检测危险调用并返回 flag"""
        # 纯数学
        if re.match(r'^[\d\s\+\-\*\/\.\(\)]+$', expr):
            try:
                return str(eval(expr))
            except Exception:
                return "Error"

        # 检测代码注入 payload
        dangerous = ["__import__", "os.", "subprocess", "open(", "exec(", "eval(",
                      "system(", "popen(", "flag", "cat ", "/etc/", "read("]
        if any(d in expr.lower() for d in dangerous):
            return f"Code execution detected! Flag: {self.flag}"

        # 其他表达式
        try:
            return str(eval(expr))
        except Exception:
            return "Error: invalid expression"


# ---------------------------------------------------------------------------
# Challenge 12: Tomcat Manager (medium, L3) — 中间件弱口令
# ---------------------------------------------------------------------------

class TomcatHandler(VulnHandler):
    """
    模拟 Tomcat:
    GET  / → 默认 Tomcat 欢迎页
    GET  /manager/html → 401 要求 Basic Auth
    Basic Auth: tomcat:tomcat → 管理页面
    POST /manager/html/deploy → "部署" WAR 包后返回 flag
    """

    def do_GET(self):
        parsed = urlparse(self.path)

        if parsed.path == "/":
            self.send_html(200, """<!DOCTYPE html>
<html><head><title>Apache Tomcat/9.0.65</title></head>
<body>
<h1>Apache Tomcat/9.0.65</h1>
<p>If you're seeing this, you've successfully installed Tomcat. Congratulations!</p>
<h2>Developer Quick Start</h2>
<ul>
  <li><a href="/manager/html">Manager App</a> (requires authentication)</li>
  <li><a href="/docs">Documentation</a></li>
</ul>
<p>Server: Apache-Coyote/1.1</p>
</body></html>""")

        elif parsed.path in ("/manager/html", "/manager/", "/manager"):
            auth = self.headers.get("Authorization", "")
            if self._check_basic_auth(auth, "tomcat", "tomcat"):
                self.send_html(200, f"""<!DOCTYPE html>
<html><head><title>Tomcat Manager</title></head>
<body>
<h1>Tomcat Web Application Manager</h1>
<h2>Deploy</h2>
<form method="POST" action="/manager/html/deploy" enctype="multipart/form-data">
  <p>WAR file to deploy:</p>
  <input type="file" name="deployWar"><br><br>
  <button type="submit">Deploy</button>
</form>
<h2>Applications</h2>
<table border="1">
<tr><th>Path</th><th>Status</th><th>Sessions</th></tr>
<tr><td>/</td><td>running</td><td>0</td></tr>
<tr><td>/manager</td><td>running</td><td>1</td></tr>
<tr><td>/docs</td><td>running</td><td>0</td></tr>
</table>
<h2>Server Information</h2>
<p>Tomcat Version: 9.0.65 | OS: Linux 5.15</p>
<p>JVM: OpenJDK 11.0.16</p>
</body></html>""")
            else:
                self.send_response(401)
                self.send_header("WWW-Authenticate", 'Basic realm="Tomcat Manager"')
                self.send_header("Content-Type", "text/html")
                self.end_headers()
                self.wfile.write(b"""<!DOCTYPE html>
<html><body>
<h1>401 Unauthorized</h1>
<p>You are not authorized to view this page.</p>
<p>Check $CATALINA_HOME/conf/tomcat-users.xml for credentials.</p>
</body></html>""")

        elif parsed.path == "/docs":
            self.send_html(200, """<html><body>
<h1>Tomcat Documentation</h1>
<p>Default credentials may be configured in conf/tomcat-users.xml</p>
</body></html>""")

        elif parsed.path == "/robots.txt":
            self.send_text(200, "User-agent: *\nDisallow: /manager/\n")

        else:
            self.send_html(404, "<h1>404 Not Found</h1>")

    def do_POST(self):
        if self.path.startswith("/manager/html/deploy") or self.path.startswith("/manager/deploy"):
            auth = self.headers.get("Authorization", "")
            if not self._check_basic_auth(auth, "tomcat", "tomcat"):
                self.send_response(401)
                self.send_header("WWW-Authenticate", 'Basic realm="Tomcat Manager"')
                self.end_headers()
                return

            self.read_body()  # consume body
            self.send_html(200, f"""<!DOCTYPE html>
<html><body>
<h1>Deployment Successful</h1>
<p>Application deployed to context path: /shell</p>
<p>WAR file uploaded and extracted.</p>
<div class="flag">{self.flag}</div>
<p><a href="/manager/html">Back to Manager</a></p>
</body></html>""")
        else:
            self.send_html(404, "<h1>404 Not Found</h1>")

    @staticmethod
    def _check_basic_auth(auth_header: str, expected_user: str, expected_pass: str) -> bool:
        import base64
        if not auth_header.startswith("Basic "):
            return False
        try:
            decoded = base64.b64decode(auth_header[6:]).decode("utf-8")
            user, pwd = decoded.split(":", 1)
            return user == expected_user and pwd == expected_pass
        except Exception:
            return False


# ---------------------------------------------------------------------------
# Challenge 13: Deserialization (hard, L3) — 反序列化 RCE
# ---------------------------------------------------------------------------

class DeserializationHandler(VulnHandler):
    """
    模拟 Java 反序列化漏洞:
    GET  / → 应用页面，提示有 /api/session 接口
    POST /api/session → 接受 base64 编码的 session 数据
    如果 payload 包含特定 gadget chain 标记 → 返回 RCE 结果 + flag
    """

    def do_GET(self):
        parsed = urlparse(self.path)

        if parsed.path == "/":
            self.send_html(200, """<!DOCTYPE html>
<html><head><title>Enterprise Portal</title></head>
<body>
<h1>Enterprise Application Portal</h1>
<p>Welcome to the enterprise portal. Please use the API to manage your session.</p>
<h2>API</h2>
<ul>
  <li>POST <code>/api/session</code> — Restore session (base64-encoded Java serialized data)</li>
  <li>GET <code>/api/status</code> — Server status</li>
</ul>
<p><small>Server: Apache Tomcat/8.5.73 | Java 1.8.0_312 | Commons-Collections 3.1</small></p>
</body></html>""")

        elif parsed.path == "/api/status":
            self.send_json(200, {
                "server": "Apache Tomcat/8.5.73",
                "java": "1.8.0_312",
                "libraries": [
                    "commons-collections-3.1.jar",
                    "commons-beanutils-1.9.4.jar",
                    "spring-core-4.3.25.jar"
                ],
                "status": "running",
                "sessions": 42
            })

        elif parsed.path == "/api/session":
            self.send_json(200, {"error": "Use POST with base64-encoded session data"})

        elif parsed.path == "/robots.txt":
            self.send_text(200, "User-agent: *\nDisallow: /api/\nDisallow: /manager/\n")

        else:
            self.send_html(404, "<h1>404 Not Found</h1>")

    def do_POST(self):
        if self.path != "/api/session":
            self.send_html(404, "<h1>404 Not Found</h1>")
            return

        body = self.read_body().decode("utf-8", errors="replace").strip()

        # 尝试 JSON 格式
        try:
            data = json.loads(body)
            payload = data.get("session", data.get("data", ""))
        except json.JSONDecodeError:
            payload = body

        if not payload:
            self.send_json(400, {"error": "Missing session data"})
            return

        result = self._check_deserialization(payload)
        self.send_json(200, result)

    def _check_deserialization(self, payload: str) -> dict:
        """检测反序列化 payload 特征"""
        import base64

        # 尝试 base64 解码
        try:
            raw = base64.b64decode(payload)
            decoded = raw.decode("utf-8", errors="replace")
        except Exception:
            decoded = payload

        # Java 序列化 magic bytes: AC ED 00 05
        is_java_serial = payload.startswith("rO0") or decoded.startswith("\xac\xed")

        # 检测 gadget chain 关键词
        gadget_keywords = [
            "CommonsCollections", "InvokerTransformer", "ChainedTransformer",
            "ConstantTransformer", "Runtime", "exec", "ProcessBuilder",
            "getRuntime", "ysoserial", "cmd", "/bin/sh", "/bin/bash",
            "calc", "ping", "whoami", "id", "cat /",
            "commons-collections", "beanutils",
        ]

        detected = any(kw.lower() in decoded.lower() or kw.lower() in payload.lower()
                        for kw in gadget_keywords)

        if detected or is_java_serial:
            return {
                "status": "error",
                "message": "Deserialization RCE triggered!",
                "output": f"uid=0(root) gid=0(root)\n{self.flag}",
                "flag": self.flag,
            }

        return {
            "status": "ok",
            "message": "Session restored successfully",
            "session_id": hashlib.md5(payload.encode()).hexdigest()[:16],
        }


# ============================================================================
# Level 4: VulnDB 验证场景 — 模拟真实产品指纹和漏洞点
# ============================================================================

# ---------------------------------------------------------------------------
# Challenge 14: ThinkPHP 5.x RCE (medium, L4) — 对应 THINKPHP-5-RCE
# ---------------------------------------------------------------------------

class ThinkPHPHandler(VulnHandler):
    """
    模拟 ThinkPHP 5.0.22:
    GET / → ThinkPHP 欢迎页 (含指纹)
    GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=<cmd>
      → 命令执行结果 + flag
    """

    def do_GET(self):
        parsed = urlparse(self.path)
        qs = parse_qs(parsed.query)

        if parsed.path == "/" and not qs.get("s"):
            self.send_html(200, """<!DOCTYPE html>
<html><head><title>ThinkPHP V5</title></head>
<body style="font-family:sans-serif;text-align:center;padding:50px">
<h1>:)</h1>
<p>ThinkPHP V5.0.22</p>
<p><span style="font-size:25px">十年磨一剑 - 为API开发设计的高性能框架</span></p>
<span style="font-size:14px">[ V5.0 版本由 <a href="http://www.thinkphp.cn">ThinkPHP</a> 提供技术支持 ]</span>
</body></html>""")
            return

        # 核心漏洞路由: ?s= 参数含 invokefunction
        s_param = qs.get("s", [""])[0]
        func = qs.get("function", [""])[0]
        vars0 = qs.get("vars[0]", [""])[0]
        vars1 = qs.get("vars[1][]", [""])[0]

        if ("invokefunction" in s_param.lower() or "invokefunction" in parsed.path.lower()):
            if func == "call_user_func_array" and vars0 in ("system", "exec", "passthru", "shell_exec"):
                cmd = vars1 or "id"
                output = self._simulate_cmd(cmd)
                self.send_text(200, output)
                return
            elif func == "call_user_func_array" and vars0 == "phpinfo":
                self.send_html(200, f"""<html><head><title>phpinfo()</title></head><body>
<h1>PHP Version 7.2.34</h1>
<table><tr><td>System</td><td>Linux thinkphp 5.4.0 x86_64</td></tr>
<tr><td>Server API</td><td>Apache 2.0 Handler</td></tr>
<tr><td>flag</td><td>{self.flag}</td></tr></table>
</body></html>""")
                return

        # 也支持路径形式 /index.php/module/controller/action
        if "/think/" in self.path.lower() and "invokefunction" in self.path.lower():
            self.send_text(200, self._simulate_cmd("id"))
            return

        self.send_html(404, """<html><body>
<h1>ThinkPHP 5.0.22</h1>
<p>页面不存在</p></body></html>""")

    def _simulate_cmd(self, cmd: str) -> str:
        if "id" in cmd:
            return f"uid=33(www-data) gid=33(www-data) groups=33(www-data)\n{self.flag}"
        elif "whoami" in cmd:
            return f"www-data\n{self.flag}"
        elif "cat" in cmd and ("flag" in cmd or "passwd" in cmd):
            return self.flag
        else:
            return f"simulated output for: {cmd}\n{self.flag}"


# ---------------------------------------------------------------------------
# Challenge 15: Shiro RememberMe Deser (hard, L4) — 对应 CVE-2016-4437
# ---------------------------------------------------------------------------

class ShiroHandler(VulnHandler):
    """
    模拟 Apache Shiro 1.2.4:
    GET  / → 登录页面 (含 rememberMe cookie 指纹)
    POST /login → 正常登录 (admin/admin123)
    带恶意 rememberMe cookie 的请求 → 检测反序列化 payload → RCE + flag
    """

    SHIRO_DEFAULT_KEY = "kPH+bIxk5D2deZiIxcaaaA=="

    def do_GET(self):
        parsed = urlparse(self.path)
        # 任何请求都检查 rememberMe cookie 中的 payload
        result = self._check_remember_me()
        if result:
            self.send_response(200)
            self.send_header("Content-Type", "text/html")
            self.send_header("Set-Cookie", "rememberMe=deleteMe; Path=/; Max-Age=0")
            self.end_headers()
            self.wfile.write(result.encode("utf-8"))
            return

        if parsed.path in ("/", "/login", "/login.jsp"):
            self.send_response(200)
            self.send_header("Content-Type", "text/html; charset=utf-8")
            self.send_header("Set-Cookie", "rememberMe=deleteMe; Path=/")
            self.end_headers()
            body = """<!DOCTYPE html>
<html><head><title>Login - Apache Shiro</title></head>
<body>
<h1>Enterprise Login</h1>
<form method="POST" action="/login">
  <p>Username: <input name="username"></p>
  <p>Password: <input name="password" type="password"></p>
  <p><label><input type="checkbox" name="rememberMe"> Remember Me</label></p>
  <button type="submit">Login</button>
</form>
<p><small>Powered by Apache Shiro 1.2.4</small></p>
</body></html>"""
            self.wfile.write(body.encode("utf-8"))
        else:
            self.send_response(302)
            self.send_header("Location", "/login")
            self.send_header("Set-Cookie", "rememberMe=deleteMe; Path=/")
            self.end_headers()

    def do_POST(self):
        result = self._check_remember_me()
        if result:
            self.send_html(200, result)
            return

        body = self.read_body().decode("utf-8", errors="replace")
        if "username=admin" in body and "admin123" in body:
            self.send_html(200, "<h1>Welcome, admin!</h1><p>Dashboard</p>")
        else:
            self.send_response(302)
            self.send_header("Location", "/login?error=1")
            self.send_header("Set-Cookie", "rememberMe=deleteMe; Path=/")
            self.end_headers()

    def _check_remember_me(self) -> Optional[str]:
        """检测 rememberMe cookie 中的反序列化 payload"""
        import base64
        cookie_header = self.headers.get("Cookie", "")
        for part in cookie_header.split(";"):
            part = part.strip()
            if part.startswith("rememberMe=") and part != "rememberMe=deleteMe":
                value = part.split("=", 1)[1].strip()
                if len(value) < 10:
                    continue
                try:
                    raw = base64.b64decode(value)
                    decoded = raw.decode("utf-8", errors="replace")
                except Exception:
                    decoded = value
                # 检测常见 gadget chain 关键词
                keywords = [
                    "CommonsCollections", "CommonsBeanutils", "InvokerTransformer",
                    "ChainedTransformer", "ysoserial", "Runtime", "exec",
                    "ProcessBuilder", "getRuntime", "/bin/sh", "/bin/bash",
                    "cmd.exe", "whoami", "id", "shiro", "rememberme",
                    "ACED0005",  # Java serialization hex
                ]
                text = decoded + value
                if any(kw.lower() in text.lower() for kw in keywords):
                    return f"""<html><body>
<h1>Deserialization RCE Triggered!</h1>
<pre>uid=0(root) gid=0(root) groups=0(root)</pre>
<p>{self.flag}</p>
</body></html>"""
                # 也检测 Java 序列化 magic bytes (rO0 = base64 of AC ED 00 05)
                if value.startswith("rO0") or b"\xac\xed\x00\x05" in raw[:8]:
                    return f"""<html><body>
<h1>Deserialization RCE Triggered!</h1>
<pre>uid=0(root) gid=0(root)</pre>
<p>{self.flag}</p>
</body></html>"""
        return None


# ---------------------------------------------------------------------------
# Challenge 16: Struts2 S2-045 (medium, L4) — 对应 S2-045 / CVE-2017-5638
# ---------------------------------------------------------------------------

class Struts2Handler(VulnHandler):
    """
    模拟 Apache Struts 2.3.31:
    GET  / → Struts2 欢迎页
    POST 任意路径，Content-Type 含 OGNL 表达式 → 执行结果 + flag
    """

    def do_GET(self):
        parsed = urlparse(self.path)
        if parsed.path in ("/", "/index.action", "/welcome.action"):
            self.send_html(200, """<!DOCTYPE html>
<html><head><title>Struts2 Showcase</title></head>
<body>
<h1>Welcome to Struts2 Showcase</h1>
<p>Apache Struts 2.3.31</p>
<ul>
  <li><a href="/upload.action">File Upload</a></li>
  <li><a href="/login.action">Login</a></li>
</ul>
<p><small>Powered by Apache Struts 2.3.31</small></p>
</body></html>""")
        elif parsed.path.endswith(".action"):
            self.send_html(200, """<html><body>
<h2>Struts2 Action Page</h2>
<form method="POST" enctype="multipart/form-data">
<input type="file" name="upload"><br>
<button type="submit">Submit</button>
</form></body></html>""")
        else:
            self.send_html(404, "<h1>404 - Struts2</h1>")

    def do_POST(self):
        content_type = self.headers.get("Content-Type", "")
        self.read_body()

        # S2-045: 检测 Content-Type 中的 OGNL 表达式
        ognl_patterns = [
            r"%\{", r"\$\{", "ognl", "OgnlContext",
            "xwork2", "HttpServletResponse", "getRuntime",
            "ProcessBuilder", "Runtime", "exec(",
            "multipart/form-data", "#cmd",
        ]

        ct_lower = content_type.lower()
        detected = False
        for pat in ognl_patterns:
            if "%" in content_type and ("{" in content_type):
                detected = True
                break
            if pat.lower() in ct_lower and ("multipart" in ct_lower or "%" in content_type):
                detected = True
                break

        # 也检测 S2-048, S2-053 等通过其他 header 注入
        for hdr in ("X-Forwarded-For", "User-Agent", "Referer"):
            val = self.headers.get(hdr, "")
            if "%{" in val or "${" in val:
                if any(kw in val.lower() for kw in ("runtime", "exec", "ognl", "getruntime")):
                    detected = True
                    break

        if detected:
            self.send_response(200)
            self.send_header("Content-Type", "text/html")
            self.send_header("vulhub", "54289")  # 233*233
            self.end_headers()
            body = f"uid=0(root) gid=0(root) groups=0(root)\n{self.flag}"
            self.wfile.write(body.encode("utf-8"))
        else:
            self.send_html(200, "<html><body><p>Upload successful</p></body></html>")


# ---------------------------------------------------------------------------
# Challenge 17: Log4Shell (hard, L4) — 对应 CVE-2021-44228
# ---------------------------------------------------------------------------

class Log4ShellHandler(VulnHandler):
    """
    模拟 Log4Shell 漏洞 (任何 Java 应用):
    GET / → Java 应用页面
    任何请求中 Header/参数/body 含 ${jndi:...} → 触发 + flag
    """

    def do_GET(self):
        jndi = self._check_jndi()
        if jndi:
            self.send_html(200, f"""<html><body>
<h1>JNDI Lookup Triggered!</h1>
<p>Payload detected: <code>{html.escape(jndi)}</code></p>
<pre>uid=0(root) gid=0(root)</pre>
<p>{self.flag}</p>
</body></html>""")
            return

        parsed = urlparse(self.path)
        if parsed.path in ("/", "/index"):
            self.send_html(200, """<!DOCTYPE html>
<html><head><title>Enterprise App</title></head>
<body>
<h1>Enterprise Application v3.2.1</h1>
<form action="/search" method="GET">
  <input name="q" placeholder="Search..."><button>Search</button>
</form>
<p><small>Server: Apache Tomcat/9.0.50 | Java 1.8.0_275 | Log4j 2.14.1</small></p>
</body></html>""")
        elif parsed.path == "/search":
            q = parse_qs(parsed.query).get("q", [""])[0]
            # 检查搜索参数中的 JNDI
            if "${jndi:" in q or "${jndi:" in q.lower():
                self.send_html(200, f"""<html><body>
<h1>JNDI Lookup Triggered!</h1>
<pre>uid=0(root) gid=0(root)</pre>
<p>{self.flag}</p></body></html>""")
            else:
                self.send_html(200, f"""<html><body>
<h1>Search Results</h1>
<p>No results for: {html.escape(q)}</p>
</body></html>""")
        elif parsed.path == "/api/status":
            self.send_json(200, {
                "app": "Enterprise App",
                "version": "3.2.1",
                "server": "Apache Tomcat/9.0.50",
                "java": "1.8.0_275",
                "log4j": "2.14.1",
                "status": "running"
            })
        else:
            self.send_html(404, "<h1>404</h1>")

    def do_POST(self):
        jndi = self._check_jndi()
        if jndi:
            self.send_html(200, f"""<html><body>
<h1>JNDI Lookup Triggered!</h1>
<pre>uid=0(root) gid=0(root)</pre>
<p>{self.flag}</p></body></html>""")
            return
        body = self.read_body().decode("utf-8", errors="replace")
        if "${jndi:" in body:
            self.send_html(200, f"<p>RCE: {self.flag}</p>")
        else:
            self.send_json(200, {"status": "ok"})

    def _check_jndi(self) -> Optional[str]:
        """检测任何 Header 中的 JNDI payload"""
        jndi_pattern = re.compile(r'\$\{jndi:[^}]+\}', re.IGNORECASE)
        # 扫描所有 headers
        for hdr_name in self.headers:
            val = self.headers[hdr_name]
            m = jndi_pattern.search(val)
            if m:
                return m.group(0)
        # 扫描 URL 参数
        parsed = urlparse(self.path)
        for vals in parse_qs(parsed.query).values():
            for v in vals:
                m = jndi_pattern.search(v)
                if m:
                    return m.group(0)
        return None


# ---------------------------------------------------------------------------
# Challenge 18: Nacos Auth Bypass (easy, L4) — 对应 NACOS-AUTH-BYPASS
# ---------------------------------------------------------------------------

class NacosHandler(VulnHandler):
    """
    模拟 Nacos 1.4.1:
    GET /nacos/ → Nacos 控制台页面
    GET /nacos/v1/auth/users → 需认证 (403) 或 User-Agent: Nacos-Server 绕过
    POST /nacos/v1/auth/users → 添加用户 (绕过后) → flag
    """

    def do_GET(self):
        parsed = urlparse(self.path)
        path = parsed.path.rstrip("/")

        if path in ("", "/nacos", "/nacos/index.html"):
            self.send_html(200, """<!DOCTYPE html>
<html><head><title>Nacos</title></head>
<body>
<div id="app">
<h1>Nacos</h1>
<p>Alibaba Nacos v1.4.1</p>
<p>配置管理 | 服务管理 | 权限控制</p>
</div>
<script>console.log("Nacos console-ui loaded");</script>
</body></html>""")
            return

        if path == "/nacos/v1/auth/users":
            ua = self.headers.get("User-Agent", "")
            qs = parse_qs(parsed.query)
            auth_header = self.headers.get("Authorization", "")
            # CVE-2021-29441: User-Agent 绕过
            if ua == "Nacos-Server" or "serverIdentity" in self.headers.get("serverIdentity", ""):
                users = [
                    {"username": "nacos", "password": "$2a$10$...hashed..."},
                    {"username": "admin", "password": "$2a$10$...hashed..."},
                ]
                self.send_json(200, {
                    "totalCount": 2,
                    "pageNumber": 1,
                    "pagesAvailable": 1,
                    "pageItems": users,
                    "flag": self.flag,
                })
                return
            # 默认凭据: nacos/nacos
            if "nacos" in auth_header:
                self.send_json(200, {"totalCount": 2, "pageItems": [{"username": "nacos"}]})
                return
            self.send_json(403, {"message": "unknown user!", "code": 403})
            return

        if path == "/nacos/v1/cs/configs":
            ua = self.headers.get("User-Agent", "")
            if ua == "Nacos-Server":
                self.send_json(200, {
                    "totalCount": 1,
                    "pageItems": [{"dataId": "application.properties", "content": f"flag={self.flag}"}]
                })
                return
            self.send_json(403, {"message": "unknown user!", "code": 403})
            return

        if path == "/nacos/v1/console/health/liveness":
            self.send_json(200, {"status": "UP"})
            return

        self.send_json(404, {"message": "not found"})

    def do_POST(self):
        parsed = urlparse(self.path)
        path = parsed.path.rstrip("/")
        body = self.read_body().decode("utf-8", errors="replace")
        ua = self.headers.get("User-Agent", "")

        if path == "/nacos/v1/auth/users":
            if ua == "Nacos-Server":
                self.send_json(200, {
                    "code": 200,
                    "message": "create user ok!",
                    "data": "User created successfully",
                    "flag": self.flag,
                })
            else:
                self.send_json(403, {"message": "unknown user!"})
            return

        if path == "/nacos/v1/auth/login":
            if "username=nacos" in body and "password=nacos" in body:
                self.send_json(200, {
                    "accessToken": "eyJhbGciOiJIUzI1NiJ9.NACOS_TOKEN",
                    "tokenTtl": 18000,
                    "globalAdmin": True,
                    "flag": self.flag,
                })
            else:
                self.send_json(403, {"message": "user not found!"})
            return

        self.send_json(404, {"message": "not found"})


# ---------------------------------------------------------------------------
# Challenge 19: Jenkins Script Console (easy, L4) — 对应 JENKINS-SCRIPT-RCE
# ---------------------------------------------------------------------------

class JenkinsHandler(VulnHandler):
    """
    模拟 Jenkins (未授权 Script Console):
    GET  / → Jenkins Dashboard
    GET  /script → Groovy Script Console
    POST /script → 执行 Groovy → 结果 + flag
    POST /scriptText → 同上 (API 形式)
    """

    def do_GET(self):
        parsed = urlparse(self.path)
        path = parsed.path.rstrip("/")

        if path in ("", "/"):
            self.send_response(200)
            self.send_header("Content-Type", "text/html; charset=utf-8")
            self.send_header("X-Jenkins", "2.346.1")
            self.send_header("X-Jenkins-Session", "abc123")
            self.end_headers()
            body = """<!DOCTYPE html>
<html><head><title>Dashboard [Jenkins]</title></head>
<body>
<h1>Dashboard [Jenkins]</h1>
<div id="header"><a href="/">Jenkins</a></div>
<p>Welcome to Jenkins 2.346.1</p>
<ul>
  <li><a href="/manage">Manage Jenkins</a></li>
  <li><a href="/script">Script Console</a></li>
  <li><a href="/about">About Jenkins</a></li>
</ul>
</body></html>"""
            self.wfile.write(body.encode("utf-8"))
            return

        if path == "/script":
            self.send_response(200)
            self.send_header("Content-Type", "text/html; charset=utf-8")
            self.send_header("X-Jenkins", "2.346.1")
            self.end_headers()
            body = """<!DOCTYPE html>
<html><head><title>Script Console [Jenkins]</title></head>
<body>
<h1>Script Console</h1>
<form method="POST" action="/script">
  <textarea name="script" rows="10" cols="60">println "Hello from Groovy"</textarea><br>
  <button type="submit">Run</button>
</form>
<p>Type in an arbitrary Groovy script and execute it on the server.</p>
</body></html>"""
            self.wfile.write(body.encode("utf-8"))
            return

        if path == "/about":
            self.send_response(200)
            self.send_header("Content-Type", "text/html; charset=utf-8")
            self.send_header("X-Jenkins", "2.346.1")
            self.end_headers()
            self.wfile.write(b"""<html><body>
<h1>About Jenkins 2.346.1</h1>
<p>Jenkins is an open source automation server.</p>
</body></html>""")
            return

        self.send_html(404, "<h1>404 Not Found</h1>")

    def do_POST(self):
        parsed = urlparse(self.path)
        path = parsed.path.rstrip("/")
        body = self.read_body().decode("utf-8", errors="replace")

        if path in ("/script", "/scriptText"):
            # 提取 script 参数
            script = ""
            try:
                data = json.loads(body)
                script = data.get("script", "")
            except json.JSONDecodeError:
                # URL-encoded form
                from urllib.parse import unquote_plus
                for part in body.split("&"):
                    if part.startswith("script="):
                        script = unquote_plus(part[7:])
                        break

            if not script:
                script = body

            # 检测 Groovy 执行命令的特征
            cmd_patterns = [
                "execute", "Runtime", "getRuntime", "exec",
                "ProcessBuilder", "proc", ".text", "cmd",
                "/bin/sh", "/bin/bash", "whoami", "id",
                "cat /", "println", "shell",
            ]
            detected = any(p.lower() in script.lower() for p in cmd_patterns)

            if detected:
                self.send_response(200)
                self.send_header("Content-Type", "text/html; charset=utf-8")
                self.send_header("X-Jenkins", "2.346.1")
                self.end_headers()
                result = f"""<html><body>
<h2>Result</h2>
<pre>uid=0(root) gid=0(root) groups=0(root)
{self.flag}</pre>
</body></html>"""
                self.wfile.write(result.encode("utf-8"))
            else:
                self.send_html(200, f"""<html><body>
<h2>Result</h2>
<pre>{html.escape(script)}\n\nScript executed.</pre>
</body></html>""")
            return

        self.send_html(404, "<h1>404</h1>")


# ---------------------------------------------------------------------------
# Challenge 20: Solr Velocity RCE (hard, L4) — 对应 CVE-2019-17558
# ---------------------------------------------------------------------------

class SolrHandler(VulnHandler):
    """
    模拟 Apache Solr 8.1.1:
    GET / → Solr admin dashboard
    GET /solr/admin/cores → 返回 core 列表
    POST /solr/{core}/config → 启用 VelocityResponseWriter
    GET /solr/{core}/select?wt=velocity&v.template.custom=... → RCE
    """

    def __init__(self, *args, **kwargs):
        self._velocity_enabled = False
        super().__init__(*args, **kwargs)

    def do_GET(self):
        parsed = urlparse(self.path)
        path = parsed.path.rstrip("/")
        qs = parse_qs(parsed.query)

        if path in ("", "/", "/solr", "/solr/"):
            self.send_html(200, """<!DOCTYPE html>
<html><head><title>Solr Admin</title></head>
<body>
<h1>Apache Solr</h1>
<div id="content">
<h2>Solr Admin Dashboard</h2>
<p>Solr Version: 8.1.1</p>
<p>JVM: Java 1.8.0_232</p>
<ul>
  <li><a href="/solr/admin/cores">Core Admin</a></li>
  <li><a href="/solr/demo/select?q=*:*">Query (demo core)</a></li>
</ul>
</div>
</body></html>""")
            return

        if path in ("/solr/admin/cores", "/api/cores"):
            self.send_json(200, {
                "responseHeader": {"status": 0, "QTime": 1},
                "initFailures": {},
                "status": {
                    "demo": {
                        "name": "demo",
                        "instanceDir": "/opt/solr/server/solr/demo",
                        "dataDir": "/opt/solr/server/solr/demo/data/",
                        "config": "solrconfig.xml",
                        "schema": "managed-schema",
                        "startTime": "2024-01-01T00:00:00.000Z",
                        "uptime": 86400000,
                        "index": {"numDocs": 100, "maxDoc": 100}
                    }
                }
            })
            return

        # /solr/demo/select?wt=velocity&v.template.custom=...
        m = re.match(r"/solr/(\w+)/select", path)
        if m:
            wt = qs.get("wt", [""])[0]
            custom_tpl = qs.get("v.template.custom", qs.get("v.template", [""]))[0]

            if wt == "velocity" and custom_tpl:
                # 检测 Velocity 模板中的 RCE 特征
                rce_keywords = ["Runtime", "exec", "getRuntime", "ProcessBuilder",
                                "Class.forName", "getMethod", "invoke", "cmd"]
                if any(kw.lower() in custom_tpl.lower() for kw in rce_keywords):
                    self.send_text(200, f"uid=0(root) gid=0(root)\n{self.flag}")
                    return
            # 正常查询
            self.send_json(200, {
                "responseHeader": {"status": 0, "QTime": 5},
                "response": {"numFound": 0, "docs": []}
            })
            return

        # /solr/demo/config
        m2 = re.match(r"/solr/(\w+)/config", path)
        if m2:
            self.send_json(200, {
                "responseHeader": {"status": 0},
                "config": {"queryResponseWriter": {"velocity": {"class": "solr.VelocityResponseWriter"}}}
            })
            return

        self.send_html(404, "<h1>404 Not Found</h1>")

    def do_POST(self):
        parsed = urlparse(self.path)
        path = parsed.path.rstrip("/")
        body = self.read_body().decode("utf-8", errors="replace")

        # POST /solr/demo/config → 启用 VelocityResponseWriter
        m = re.match(r"/solr/(\w+)/config", path)
        if m:
            if "VelocityResponseWriter" in body or "params.resource.loader.enabled" in body:
                self._velocity_enabled = True
                self.send_json(200, {
                    "responseHeader": {"status": 0, "QTime": 10},
                    "WARNING": "This response format is experimental.",
                    "flag_hint": f"Velocity enabled. Now use wt=velocity to exploit. {self.flag}"
                })
            else:
                self.send_json(200, {"responseHeader": {"status": 0}})
            return

        self.send_html(404, "<h1>404</h1>")


# ---------------------------------------------------------------------------
# Challenge 21: Drupalgeddon 2 (medium, L4) — 对应 CVE-2018-7600
# ---------------------------------------------------------------------------

class DrupalHandler(VulnHandler):
    """
    模拟 Drupal 8.5.0:
    GET / → Drupal 首页
    POST /user/register?element_parents=...&ajax_form=1 → RCE + flag
    """

    def do_GET(self):
        parsed = urlparse(self.path)
        qs = parse_qs(parsed.query)

        if parsed.path in ("/", "/node"):
            self.send_response(200)
            self.send_header("Content-Type", "text/html; charset=utf-8")
            self.send_header("X-Generator", "Drupal 8 (https://www.drupal.org)")
            self.send_header("X-Drupal-Cache", "HIT")
            self.end_headers()
            body = """<!DOCTYPE html>
<html><head><title>Welcome | Drupal</title>
<meta name="Generator" content="Drupal 8 (https://www.drupal.org)">
</head>
<body>
<h1>Welcome to Drupal</h1>
<p>Drupal is a content management platform.</p>
<div class="node"><p>This is the default content.</p></div>
<p><a href="/user/login">Log in</a> | <a href="/user/register">Create new account</a></p>
<footer>Powered by <a href="https://www.drupal.org">Drupal 8.5.0</a></footer>
</body></html>"""
            self.wfile.write(body.encode("utf-8"))
            return

        if parsed.path == "/user/login":
            self.send_response(200)
            self.send_header("Content-Type", "text/html; charset=utf-8")
            self.send_header("X-Generator", "Drupal 8 (https://www.drupal.org)")
            self.end_headers()
            self.wfile.write(b"""<html><body>
<h1>Log in</h1>
<form method="POST">
<input name="name" placeholder="Username"><br>
<input name="pass" type="password" placeholder="Password"><br>
<button type="submit">Log in</button>
</form></body></html>""")
            return

        if parsed.path == "/user/register":
            ajax = qs.get("ajax_form", [""])[0]
            element = qs.get("element_parents", [""])[0]
            if ajax and element and "mail" in element:
                # Drupalgeddon2 via GET (less common, but check)
                self.send_json(200, [
                    {"command": "insert", "data": f"<div>uid=33(www-data)\n{self.flag}</div>"}
                ])
                return
            self.send_response(200)
            self.send_header("Content-Type", "text/html; charset=utf-8")
            self.send_header("X-Generator", "Drupal 8 (https://www.drupal.org)")
            self.end_headers()
            self.wfile.write(b"""<html><body>
<h1>Create new account</h1>
<form method="POST" action="/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax">
<input name="mail[#markup]" placeholder="Email"><br>
<button type="submit">Create</button>
</form></body></html>""")
            return

        if parsed.path == "/CHANGELOG.txt":
            self.send_text(200, "Drupal 8.5.0, 2018-03-07\n- ...\n")
            return

        self.send_html(404, "<h1>Page not found | Drupal</h1>")

    def do_POST(self):
        parsed = urlparse(self.path)
        qs = parse_qs(parsed.query)
        body = self.read_body().decode("utf-8", errors="replace")

        # CVE-2018-7600 核心路径
        if parsed.path == "/user/register":
            ajax = qs.get("ajax_form", [""])[0]
            element = qs.get("element_parents", [""])[0]
            wrapper = qs.get("_wrapper_format", [""])[0]

            if (ajax and element and "mail" in element) or "drupal_ajax" in wrapper:
                # 检测 payload 中的命令执行特征
                rce_kw = ["exec", "system", "passthru", "shell_exec",
                          "#post_render", "#markup", "#type", "id", "whoami", "cat"]
                if any(kw in body.lower() or kw in element.lower() for kw in rce_kw):
                    self.send_json(200, [
                        {"command": "insert", "data": f"uid=33(www-data) gid=33(www-data)\n{self.flag}"}
                    ])
                    return

            self.send_json(200, [{"command": "insert", "data": "Account created."}])
            return

        self.send_html(404, "<h1>Not Found</h1>")


# ---------------------------------------------------------------------------
# Challenge 22: Spring4Shell (hard, L4) — 对应 CVE-2022-22965
# ---------------------------------------------------------------------------

class Spring4ShellHandler(VulnHandler):
    """
    模拟 Spring Framework 5.3.17 on Tomcat (JDK 11):
    GET / → Spring 应用页面
    GET /?class.module.classLoader.resources.context.parent.pipeline... → 写入 webshell
    GET /tomcatwar.jsp?pwd=j&cmd=<cmd> → 执行命令 + flag
    """

    def __init__(self, *args, **kwargs):
        self._shell_written = False
        super().__init__(*args, **kwargs)

    def do_GET(self):
        parsed = urlparse(self.path)
        qs = parse_qs(parsed.query)

        # 检测 Spring4Shell payload 在查询参数中
        raw_query = parsed.query or ""
        if "class.module.classLoader" in raw_query:
            # 检测 classLoader 操控
            if "pipeline.first" in raw_query or "resources.context" in raw_query:
                self._shell_written = True
                self.send_response(200)
                self.send_header("Content-Type", "text/html; charset=utf-8")
                self.send_header("Server", "Apache-Coyote/1.1")
                self.end_headers()
                self.wfile.write(b"""<!DOCTYPE html>
<html><body>
<h1>Spring MVC Application</h1>
<p>Request processed.</p>
</body></html>""")
                return

        # 访问写入的 webshell
        if parsed.path in ("/tomcatwar.jsp", "/shell.jsp", "/webshell.jsp"):
            pwd = qs.get("pwd", [""])[0]
            cmd = qs.get("cmd", [""])[0]
            if self._shell_written or pwd:  # 宽松检测
                if cmd:
                    output = self._simulate_cmd(cmd)
                    self.send_text(200, output)
                else:
                    self.send_text(200, f"Webshell active. Use ?pwd=j&cmd=id\n{self.flag}")
                return
            self.send_html(404, "<h1>404</h1>")
            return

        if parsed.path in ("/", "/index"):
            self.send_response(200)
            self.send_header("Content-Type", "text/html; charset=utf-8")
            self.send_header("Server", "Apache-Coyote/1.1")
            self.end_headers()
            body = """<!DOCTYPE html>
<html><head><title>Spring MVC App</title></head>
<body>
<h1>Spring MVC Application</h1>
<p>Spring Framework 5.3.17</p>
<form action="/greeting" method="GET">
  <input name="name" placeholder="Your name"><button>Submit</button>
</form>
<p><small>Server: Apache Tomcat/9.0.62 | JDK 11.0.14 | Spring Framework 5.3.17</small></p>
</body></html>"""
            self.wfile.write(body.encode("utf-8"))
            return

        if parsed.path == "/greeting":
            name = qs.get("name", ["World"])[0]
            self.send_html(200, f"<html><body><h1>Hello, {html.escape(name)}!</h1></body></html>")
            return

        self.send_html(404, "<h1>404</h1>")

    def do_POST(self):
        parsed = urlparse(self.path)
        body = self.read_body().decode("utf-8", errors="replace")
        if "class.module.classLoader" in body:
            self._shell_written = True
            self.send_html(200, "<p>OK</p>")
        else:
            self.send_html(200, "<p>Submitted</p>")

    def _simulate_cmd(self, cmd: str) -> str:
        if "id" in cmd:
            return f"uid=0(root) gid=0(root) groups=0(root)\n{self.flag}"
        elif "whoami" in cmd:
            return f"root\n{self.flag}"
        elif "cat" in cmd:
            return self.flag
        return f"simulated: {cmd}\n{self.flag}"


# ---------------------------------------------------------------------------
# Challenge 23: Fastjson Deser (medium, L4) — 对应 FASTJSON-1.2.47-RCE
# ---------------------------------------------------------------------------

class FastjsonHandler(VulnHandler):
    """
    模拟 Fastjson 1.2.47 应用:
    GET  / → 应用页面 (JSON API)
    POST / → 接受 JSON，检测 @type 绕过 payload → RCE + flag
    """

    def do_GET(self):
        parsed = urlparse(self.path)
        if parsed.path in ("/", "/index"):
            self.send_json(200, {
                "app": "Fastjson Demo Application",
                "version": "1.0",
                "fastjson": "1.2.47",
                "endpoints": {
                    "POST /": "Submit JSON data",
                    "POST /api/user": "Create user (JSON)",
                },
                "message": "Send POST with JSON body"
            })
        elif parsed.path == "/api/user":
            self.send_json(200, {"error": "Use POST method", "example": {"name": "test", "age": 20}})
        else:
            self.send_json(404, {"error": "not found"})

    def do_POST(self):
        body = self.read_body().decode("utf-8", errors="replace").strip()
        if not body:
            self.send_json(400, {"error": "empty body"})
            return

        # 检测 Fastjson @type 攻击特征
        try:
            data = json.loads(body)
        except json.JSONDecodeError:
            # Fastjson 特征: 畸形 JSON 会触发特殊错误
            if "@type" in body or "autoType" in body:
                self.send_json(500, {
                    "error": "com.alibaba.fastjson.JSONException: autoType is not support",
                    "message": "fastjson 1.2.47"
                })
            else:
                self.send_json(400, {"error": "invalid JSON"})
            return

        # 检测 @type payload
        body_str = json.dumps(data) if isinstance(data, dict) else body
        rce_indicators = [
            "java.lang.Class", "com.sun.rowset.JdbcRowSetImpl",
            "dataSourceName", "rmi://", "ldap://",
            "javax.script.ScriptEngineManager", "org.apache.xbean",
            "jndi", "JndiObjectFactory", "TemplatesImpl",
            "java.lang.Runtime", "java.lang.ProcessBuilder",
            "@type",
        ]

        type_found = "@type" in body
        rce_found = any(ind.lower() in body.lower() for ind in rce_indicators)

        if type_found and rce_found:
            self.send_json(200, {
                "status": "error",
                "message": "JNDI injection triggered!",
                "output": f"uid=0(root) gid=0(root) groups=0(root)",
                "flag": self.flag,
            })
        elif type_found:
            self.send_json(500, {
                "error": "com.alibaba.fastjson.JSONException: autoType is not support. " + body[:50]
            })
        else:
            self.send_json(200, {"status": "ok", "data": data})


# ---------------------------------------------------------------------------
# Challenge 24: WebLogic SSRF (medium, L4) — 对应 CVE-2014-4210
# ---------------------------------------------------------------------------

class WebLogicSSRFHandler(VulnHandler):
    """
    模拟 WebLogic 10.3.6 SSRF:
    GET / → WebLogic 默认页
    GET /uddiexplorer/ → UDDI Explorer 页面
    GET /uddiexplorer/SearchPublicRegistries.jsp?operator=<url> → SSRF
    """

    def do_GET(self):
        parsed = urlparse(self.path)
        path = parsed.path.rstrip("/")
        qs = parse_qs(parsed.query)

        if path in ("", "/"):
            self.send_html(200, """<!DOCTYPE html>
<html><head><title>Oracle WebLogic Server</title></head>
<body>
<h1>Oracle WebLogic Server 10.3.6</h1>
<p>Error 404--Not Found</p>
<p>Welcome to WebLogic Server.</p>
</body></html>""")
            return

        if path == "/console":
            self.send_html(200, """<html><body>
<h1>WebLogic Server Administration Console</h1>
<p>WebLogic Server Version: 10.3.6.0</p>
<form action="/console/j_security_check" method="POST">
  <p>Username: <input name="j_username"></p>
  <p>Password: <input name="j_password" type="password"></p>
  <button type="submit">Login</button>
</form></body></html>""")
            return

        if path in ("/uddiexplorer", "/uddiexplorer/"):
            self.send_html(200, """<html><body>
<h1>UDDI Explorer</h1>
<p>Oracle WebLogic Server UDDI Explorer</p>
<ul>
  <li><a href="/uddiexplorer/SearchPublicRegistries.jsp">Search Public Registries</a></li>
</ul></body></html>""")
            return

        if path == "/uddiexplorer/SearchPublicRegistries.jsp":
            operator = qs.get("operator", [""])[0]
            if operator:
                # SSRF — 模拟不同目标的响应
                if "attacker" in operator or "http://" in operator or "https://" in operator:
                    # 检测 CRLF 注入 (用于攻击 Redis)
                    if "%0d%0a" in operator.lower() or "\r\n" in operator or "\\r\\n" in operator:
                        self.send_html(200, f"""<html><body>
<p>An error has occurred:</p>
<pre>SSRF + CRLF Injection detected!
The server made a request to: {html.escape(operator)}
Internal service responded with injected commands.
{self.flag}
</pre></body></html>""")
                        return

                    # 正常 SSRF 回连
                    self.send_html(200, f"""<html><body>
<p>An error has occurred:</p>
<pre>javax.xml.ws.WebServiceException: java.io.IOException:
Received a response from url: {html.escape(operator)}
which did not have a valid SOAP content-type.
{self.flag}
</pre></body></html>""")
                    return
                else:
                    self.send_html(200, """<html><body>
<p>An error has occurred:</p>
<pre>javax.xml.ws.WebServiceException: java.io.IOException:
could not connect to server
</pre></body></html>""")
                    return
            # 没有 operator 参数时显示表单
            self.send_html(200, """<html><body>
<h1>Search Public Registries</h1>
<form method="GET">
  <p>Operator URL: <input name="operator" size="60"></p>
  <button type="submit">Search</button>
</form>
</body></html>""")
            return

        self.send_html(404, """<html><body>
<h1>Error 404--Not Found</h1>
</body></html>""")


# ---------------------------------------------------------------------------
# Challenge 25: ActiveMQ File Upload (medium, L4) — 对应 CVE-2016-3088
# ---------------------------------------------------------------------------

class ActiveMQHandler(VulnHandler):
    """
    模拟 ActiveMQ 5.13.0:
    GET  / → ActiveMQ 欢迎页
    GET  /admin/ → 管理页面 (Basic Auth: admin/admin)
    PUT  /fileserver/<file> → 上传文件
    MOVE /fileserver/<file> → 移动文件 → flag
    GET  /api/shell.jsp?cmd=<cmd> → 命令执行
    """

    _uploaded_files: dict = {}
    _moved_files: dict = {}

    def do_GET(self):
        parsed = urlparse(self.path)
        path = parsed.path.rstrip("/")

        if path in ("", "/"):
            self.send_html(200, """<!DOCTYPE html>
<html><head><title>Apache ActiveMQ</title></head>
<body>
<h1>Welcome to Apache ActiveMQ!</h1>
<p>Apache ActiveMQ 5.13.0</p>
<ul>
  <li><a href="/admin/">Manage ActiveMQ broker</a></li>
  <li><a href="/fileserver/">FileServer</a></li>
  <li><a href="/api/">API</a></li>
</ul>
</body></html>""")
            return

        if path.startswith("/admin"):
            auth = self.headers.get("Authorization", "")
            if self._check_basic_auth(auth, "admin", "admin"):
                if path == "/admin/test/systemProperties.jsp":
                    self.send_html(200, f"""<html><body>
<h1>System Properties</h1>
<table>
<tr><td>activemq.home</td><td>/opt/activemq</td></tr>
<tr><td>activemq.base</td><td>/opt/activemq</td></tr>
<tr><td>java.version</td><td>1.8.0_232</td></tr>
</table></body></html>""")
                else:
                    self.send_html(200, """<html><body>
<h1>ActiveMQ Admin Console</h1>
<p>Broker: localhost</p><p>Version: 5.13.0</p>
</body></html>""")
            else:
                self.send_response(401)
                self.send_header("WWW-Authenticate", 'Basic realm="ActiveMQ"')
                self.send_header("Content-Type", "text/html")
                self.end_headers()
                self.wfile.write(b"<h1>401 Unauthorized</h1>")
            return

        # fileserver 上传的文件可通过 GET 访问
        if path.startswith("/fileserver/") or path.startswith("/api/"):
            fname = path.split("/")[-1]
            if fname in ActiveMQHandler._moved_files or fname in ActiveMQHandler._uploaded_files:
                qs = parse_qs(parsed.query)
                cmd = qs.get("cmd", [""])[0]
                if cmd:
                    self.send_text(200, self._simulate_cmd(cmd))
                else:
                    self.send_text(200, f"Shell active.\n{self.flag}")
                return
            self.send_html(404, "<h1>404</h1>")
            return

        self.send_html(404, "<h1>404</h1>")

    def do_PUT(self):
        parsed = urlparse(self.path)
        if parsed.path.startswith("/fileserver/"):
            fname = parsed.path.split("/")[-1]
            body = self.read_body().decode("utf-8", errors="replace")
            ActiveMQHandler._uploaded_files[fname] = body
            self.send_response(204)
            self.end_headers()
        else:
            self.send_html(404, "<h1>404</h1>")

    def do_MOVE(self):
        parsed = urlparse(self.path)
        if parsed.path.startswith("/fileserver/"):
            fname = parsed.path.split("/")[-1]
            dest = self.headers.get("Destination", "")
            if dest and fname in ActiveMQHandler._uploaded_files:
                dest_name = dest.split("/")[-1]
                ActiveMQHandler._moved_files[dest_name] = ActiveMQHandler._uploaded_files[fname]
                self.send_response(204)
                self.send_header("Content-Type", "text/plain")
                self.end_headers()
                # 移动成功意味着拿到了 flag
            else:
                self.send_html(400, "<h1>Bad Request</h1>")
        else:
            self.send_html(404, "<h1>404</h1>")

    def do_POST(self):
        self.do_PUT()

    @staticmethod
    def _check_basic_auth(auth_header: str, expected_user: str, expected_pass: str) -> bool:
        import base64
        if not auth_header.startswith("Basic "):
            return False
        try:
            decoded = base64.b64decode(auth_header[6:]).decode("utf-8")
            user, pwd = decoded.split(":", 1)
            return user == expected_user and pwd == expected_pass
        except Exception:
            return False

    def _simulate_cmd(self, cmd: str) -> str:
        if "id" in cmd:
            return f"uid=0(root) gid=0(root) groups=0(root)\n{self.flag}"
        elif "whoami" in cmd:
            return f"root\n{self.flag}"
        elif "cat" in cmd:
            return self.flag
        return f"simulated: {cmd}\n{self.flag}"


class PlatformAPIHandler(BaseHTTPRequestHandler):
    """完全兼容官方 HTTP API"""

    state: RangeState = None  # type: ignore

    def log_message(self, fmt, *args):
        pass

    def _check_auth(self) -> bool:
        token = self.headers.get("Agent-Token", "")
        if token != self.state.token:
            self._send_error(403, "无效的 Agent-Token")
            return False
        return True

    def _send_ok(self, data=None, message: str = "success"):
        body = json.dumps({"code": 0, "message": message, "data": data},
                          ensure_ascii=False)
        self.send_response(200)
        self.send_header("Content-Type", "application/json")
        self.end_headers()
        self.wfile.write(body.encode("utf-8"))

    def _send_error(self, http_code: int, message: str):
        body = json.dumps({"code": -1, "message": message, "data": None},
                          ensure_ascii=False)
        self.send_response(http_code)
        self.send_header("Content-Type", "application/json")
        self.end_headers()
        self.wfile.write(body.encode("utf-8"))

    def _read_json(self) -> dict:
        length = int(self.headers.get("Content-Length", 0))
        if length == 0:
            return {}
        raw = self.rfile.read(length)
        return json.loads(raw)

    # ----- GET /api/challenges -----
    def do_GET(self):
        if self.path != "/api/challenges":
            self._send_error(404, "Not Found")
            return
        if not self._check_auth():
            return

        with self.state.lock:
            current_level = self.state.current_level
            visible = [c for c in self.state.challenges.values()
                       if c.level <= current_level]

            challenges_data = []
            for c in sorted(visible, key=lambda x: (x.level, x.difficulty)):
                inst = self.state.instances.get(c.code)
                flag_got = len(self.state.submitted_flags.get(c.code, []))
                ep = None
                inst_status = "stopped"
                if inst and inst.status == "running":
                    inst_status = "running"
                    ep = [f"{self.state.advertise_host}:{inst.port}"]

                challenges_data.append({
                    "title": c.title,
                    "code": c.code,
                    "difficulty": c.difficulty,
                    "description": c.description,
                    "level": c.level,
                    "total_score": c.total_score,
                    "total_got_score": c.total_score if flag_got >= c.flag_count
                                      else (c.total_score // c.flag_count * flag_got),
                    "flag_count": c.flag_count,
                    "flag_got_count": flag_got,
                    "hint_viewed": c.code in self.state.hints_viewed,
                    "instance_status": inst_status,
                    "entrypoint": ep,
                })

            solved = sum(1 for c in visible
                        if len(self.state.submitted_flags.get(c.code, [])) >= c.flag_count)

            self._send_ok({
                "current_level": current_level,
                "total_challenges": len(visible),
                "solved_challenges": solved,
                "challenges": challenges_data,
            })

    # ----- POST routes -----
    def do_POST(self):
        if not self._check_auth():
            return

        if self.path == "/api/start_challenge":
            self._handle_start()
        elif self.path == "/api/stop_challenge":
            self._handle_stop()
        elif self.path == "/api/submit":
            self._handle_submit()
        elif self.path == "/api/hint":
            self._handle_hint()
        elif self.path == "/api/reset":
            self._handle_reset()
        else:
            self._send_error(404, "Not Found")

    def _handle_start(self):
        data = self._read_json()
        code = data.get("code", "")

        with self.state.lock:
            cfg = self.state.challenges.get(code)
            if not cfg:
                self._send_error(404, "赛题不存在")
                return

            if cfg.level > self.state.current_level:
                self._send_error(403, f"尚未解锁关卡 {cfg.level}")
                return

            # 已全部完成
            flag_got = len(self.state.submitted_flags.get(code, []))
            if flag_got >= cfg.flag_count:
                self._send_ok({"already_completed": True},
                              "该赛题已全部完成，无需再启动实例")
                return

            # 检查并发限制
            if self.state.running_count() >= 3:
                inst = self.state.instances.get(code)
                if not (inst and inst.status == "running"):
                    self._send_error(400, "超出同时运行实例上限 (3)")
                    return

            # 如果已经在运行，直接返回
            inst = self.state.instances.get(code)
            if inst and inst.status == "running":
                self._send_ok([f"{self.state.advertise_host}:{inst.port}"],
                              "赛题实例已在运行中")
                return

        # 启动靶场实例 (在 lock 外，避免死锁)
        port = _find_free_port()
        handler_cls = _make_handler(cfg.handler_class, code, cfg.flags[0])
        server = ThreadedHTTPServer(("0.0.0.0", port), handler_cls)
        thread = threading.Thread(target=server.serve_forever, daemon=True)
        thread.start()

        with self.state.lock:
            self.state.instances[code] = InstanceInfo(
                code=code, port=port, server=server,
                thread=thread, status="running",
            )

        ep = [f"{self.state.advertise_host}:{port}"]
        print(f"  🟢 启动靶场: {cfg.title} → {ep[0]}")
        self._send_ok(ep, "赛题实例启动成功")

    def _handle_stop(self):
        data = self._read_json()
        code = data.get("code", "")

        with self.state.lock:
            cfg = self.state.challenges.get(code)
            if not cfg:
                self._send_error(404, "赛题不存在")
                return

            inst = self.state.instances.get(code)
            if not inst or inst.status != "running":
                self._send_error(400, "赛题实例未运行")
                return

            if inst.server:
                inst.server.shutdown()
            inst.status = "stopped"
            print(f"  🔴 停止靶场: {cfg.title}")

        self._send_ok(message="赛题实例已停止")

    def _handle_submit(self):
        data = self._read_json()
        code = data.get("code", "")
        flag = data.get("flag", "")

        with self.state.lock:
            cfg = self.state.challenges.get(code)
            if not cfg:
                self._send_error(404, "赛题不存在")
                return

            inst = self.state.instances.get(code)
            if not inst or inst.status != "running":
                self._send_error(400, "赛题实例未运行")
                return

            submitted = self.state.submitted_flags.get(code, [])
            flag_got = len(submitted)

            # 检查是否正确
            if flag in cfg.flags and flag not in submitted:
                submitted.append(flag)
                self.state.submitted_flags[code] = submitted
                flag_got = len(submitted)

                # 计算得分 (扣除 hint)
                per_flag = cfg.total_score // cfg.flag_count
                if code in self.state.hints_viewed:
                    per_flag = int(per_flag * 0.9)

                msg = f"恭喜！答案正确（{flag_got}/{cfg.flag_count}），获得{per_flag}分"

                # 检查关卡解锁
                old_level = self.state.current_level
                new_level = self.state.current_level  # 重新计算
                if new_level > old_level:
                    msg += "【您已成功解锁新的关卡】"

                print(f"  ✅ Flag 正确: {flag} ({cfg.title})")
                self._send_ok({
                    "correct": True,
                    "message": msg,
                    "flag_count": cfg.flag_count,
                    "flag_got_count": flag_got,
                })
            else:
                if flag in submitted:
                    msg = "该 Flag 已提交过"
                else:
                    msg = "答案错误，请继续尝试"

                self._send_ok({
                    "correct": False,
                    "message": msg,
                    "flag_count": cfg.flag_count,
                    "flag_got_count": flag_got,
                })

    def _handle_hint(self):
        data = self._read_json()
        code = data.get("code", "")

        with self.state.lock:
            cfg = self.state.challenges.get(code)
            if not cfg:
                self._send_error(404, "赛题不存在")
                return

            inst = self.state.instances.get(code)
            if not inst or inst.status != "running":
                self._send_error(400, "赛题实例未运行")
                return

            flag_got = len(self.state.submitted_flags.get(code, []))
            if flag_got >= cfg.flag_count:
                self._send_error(400, "赛题已全部完成，不能查看提示")
                return

            first_view = code not in self.state.hints_viewed
            self.state.hints_viewed.add(code)

            if first_view:
                print(f"  💡 Hint 查看 (-10%): {cfg.title}")

            self._send_ok({
                "code": code,
                "hint_content": cfg.hint,
            })

    def _handle_reset(self):
        """重置靶场: 停止所有实例、清空提交记录"""
        self.state.reset()
        total = len(self.state.challenges)
        print(f"  🔄 靶场已重置 ({total} 题)")
        self._send_ok({"total_challenges": total}, "靶场已重置，所有状态清空")


# ============================================================================
# 辅助函数
# ============================================================================

def _find_free_port() -> int:
    """找一个空闲端口"""
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        s.bind(("", 0))
        return s.getsockname()[1]


def _make_handler(base_cls: type, code: str, flag: str) -> type:
    """为每个 challenge 创建独立的 handler 子类"""
    return type(f"{base_cls.__name__}_{code}", (base_cls,), {
        "challenge_code": code,
        "flag": flag,
    })


def _gen_flag(seed: str) -> str:
    """生成确定性 flag"""
    h = hashlib.md5(seed.encode()).hexdigest()[:16]
    return f"flag{{{h}}}"


# ============================================================================
# 赛题注册
# ============================================================================

def build_challenges() -> list[ChallengeConfig]:
    """构建所有赛题配置"""
    return [
        # Level 1
        ChallengeConfig(
            code="login-easy-01",
            title="Login Portal",
            difficulty="easy",
            level=1,
            description="一个员工管理后台登录页面",
            total_score=100,
            flag_count=1,
            flags=[_gen_flag("login-easy-01")],
            hint="尝试常见的默认管理员密码，如 admin/admin123",
            handler_class=LoginHandler,
        ),
        ChallengeConfig(
            code="info-easy-02",
            title="Information Leak",
            difficulty="easy",
            level=1,
            description="一个企业门户网站，似乎有些敏感信息没有清理干净",
            total_score=100,
            flag_count=1,
            flags=[_gen_flag("info-easy-02")],
            hint="检查 robots.txt 和备份文件",
            handler_class=InfoLeakHandler,
        ),
        ChallengeConfig(
            code="cmdi-medium-03",
            title="Command Execution",
            difficulty="medium",
            level=1,
            description="一个网络诊断工具，提供 ping 功能",
            total_score=150,
            flag_count=1,
            flags=[_gen_flag("cmdi-medium-03")],
            hint="ping 参数可能没有正确过滤特殊字符，尝试命令注入",
            handler_class=CmdInjHandler,
        ),

        # Level 2
        ChallengeConfig(
            code="sqli-medium-04",
            title="SQL Injection",
            difficulty="medium",
            level=2,
            description="一个用户查询系统，通过 ID 检索用户信息",
            total_score=150,
            flag_count=1,
            flags=[_gen_flag("sqli-medium-04")],
            hint="搜索参数直接拼入 SQL 语句，尝试 UNION SELECT 注入",
            handler_class=SQLiHandler,
        ),
        ChallengeConfig(
            code="traversal-medium-05",
            title="File Traversal",
            difficulty="medium",
            level=2,
            description="一个在线文档查看系统",
            total_score=150,
            flag_count=1,
            flags=[_gen_flag("traversal-medium-05")],
            hint="文件读取参数没有过滤目录穿越字符，flag 在 /flag.txt",
            handler_class=TraversalHandler,
        ),
        ChallengeConfig(
            code="admin-hard-06",
            title="Admin Panel",
            difficulty="hard",
            level=2,
            description="一个企业内网管理面板，需要通过信息收集找到登录凭据",
            total_score=300,
            flag_count=1,
            flags=[_gen_flag("admin-hard-06")],
            hint="检查 robots.txt 和常见的备份文件路径 (.bak, .git)",
            handler_class=AdminPanelHandler,
        ),

        # Level 2 — 赛道 1 新增
        ChallengeConfig(
            code="xss-easy-07",
            title="XSS Guestbook",
            difficulty="easy",
            level=2,
            description="一个企业留言板系统，允许用户发布消息",
            total_score=100,
            flag_count=1,
            flags=[_gen_flag("xss-easy-07")],
            hint="留言内容没有过滤 HTML 标签，尝试注入 <script> 标签",
            handler_class=XSSHandler,
        ),
        ChallengeConfig(
            code="vulnapi-easy-08",
            title="Vulnerable API",
            difficulty="easy",
            level=2,
            description="一个计算器 REST API 服务，提供表达式求值功能",
            total_score=100,
            flag_count=1,
            flags=[_gen_flag("vulnapi-easy-08")],
            hint="API 的 /api/calc 接口直接 eval 用户输入，尝试注入 Python 代码",
            handler_class=VulnAPIHandler,
        ),

        # Level 3 — 赛道 1+2 进阶
        ChallengeConfig(
            code="ssti-medium-09",
            title="Template Injection",
            difficulty="medium",
            level=3,
            description="一个问候服务，可以自定义名字显示在页面上",
            total_score=200,
            flag_count=1,
            flags=[_gen_flag("ssti-medium-09")],
            hint="name 参数的内容会被模板引擎渲染，尝试 {{7*7}} 确认 SSTI",
            handler_class=SSTIHandler,
        ),
        ChallengeConfig(
            code="upload-medium-10",
            title="File Upload",
            difficulty="medium",
            level=3,
            description="一个文件管理系统，支持文件上传功能",
            total_score=200,
            flag_count=1,
            flags=[_gen_flag("upload-medium-10")],
            hint="后端只精确检测 .php 后缀，尝试 .php5 / .phtml 绕过",
            handler_class=FileUploadHandler,
        ),
        ChallengeConfig(
            code="xxe-medium-11",
            title="XXE Import",
            difficulty="medium",
            level=3,
            description="一个 XML 数据导入服务，支持批量导入记录",
            total_score=200,
            flag_count=1,
            flags=[_gen_flag("xxe-medium-11")],
            hint="XML 解析器支持外部实体，尝试 <!ENTITY> + file:// 协议读取 /flag.txt",
            handler_class=XXEHandler,
        ),
        ChallengeConfig(
            code="tomcat-medium-12",
            title="Tomcat Manager",
            difficulty="medium",
            level=3,
            description="一个 Apache Tomcat 服务器，管理页面似乎可以访问",
            total_score=200,
            flag_count=1,
            flags=[_gen_flag("tomcat-medium-12")],
            hint="Tomcat Manager 使用 Basic Auth，尝试默认凭据 tomcat:tomcat",
            handler_class=TomcatHandler,
        ),
        ChallengeConfig(
            code="deser-hard-13",
            title="Java Deserialize",
            difficulty="hard",
            level=3,
            description="一个企业应用门户，使用 Java 序列化管理用户会话",
            total_score=300,
            flag_count=1,
            flags=[_gen_flag("deser-hard-13")],
            hint="/api/session 接受 base64 编码的 Java 序列化数据，Commons-Collections 3.1 存在反序列化漏洞",
            handler_class=DeserializationHandler,
        ),

        # Level 4 — VulnDB 验证场景 (模拟真实产品指纹和漏洞)
        ChallengeConfig(
            code="thinkphp-medium-14",
            title="ThinkPHP 5 RCE",
            difficulty="medium",
            level=4,
            description="一个 ThinkPHP 5.0.22 Web 应用，未开启强制路由",
            total_score=200,
            flag_count=1,
            flags=[_gen_flag("thinkphp-medium-14")],
            hint="ThinkPHP 5.x 可通过 ?s=/Index/\\think\\app/invokefunction 调用任意函数执行命令",
            handler_class=ThinkPHPHandler,
        ),
        ChallengeConfig(
            code="shiro-hard-15",
            title="Shiro RememberMe Deser",
            difficulty="hard",
            level=4,
            description="一个使用 Apache Shiro 1.2.4 认证框架的 Java Web 应用",
            total_score=300,
            flag_count=1,
            flags=[_gen_flag("shiro-hard-15")],
            hint="Shiro 使用默认密钥 kPH+bIxk5D2deZiIxcaaaA== 加密 rememberMe Cookie，可伪造反序列化 payload",
            handler_class=ShiroHandler,
        ),
        ChallengeConfig(
            code="struts2-medium-16",
            title="Struts2 S2-045 RCE",
            difficulty="medium",
            level=4,
            description="一个 Apache Struts 2.3.31 应用，支持文件上传",
            total_score=200,
            flag_count=1,
            flags=[_gen_flag("struts2-medium-16")],
            hint="Struts2 S2-045: Content-Type 中的 OGNL 表达式会被解析执行，构造 %{...} 注入",
            handler_class=Struts2Handler,
        ),
        ChallengeConfig(
            code="log4shell-hard-17",
            title="Log4Shell RCE",
            difficulty="hard",
            level=4,
            description="一个使用 Log4j 2.14.1 的 Java 企业应用",
            total_score=300,
            flag_count=1,
            flags=[_gen_flag("log4shell-hard-17")],
            hint="Log4j 会解析日志中的 ${jndi:ldap://...} 表达式，注入到 User-Agent、搜索框等被日志记录的字段",
            handler_class=Log4ShellHandler,
        ),
        ChallengeConfig(
            code="nacos-easy-18",
            title="Nacos Auth Bypass",
            difficulty="easy",
            level=4,
            description="一个 Alibaba Nacos 1.4.1 配置中心",
            total_score=100,
            flag_count=1,
            flags=[_gen_flag("nacos-easy-18")],
            hint="Nacos 可通过 User-Agent: Nacos-Server 绕过认证，也可尝试默认凭据 nacos/nacos",
            handler_class=NacosHandler,
        ),
        ChallengeConfig(
            code="jenkins-easy-19",
            title="Jenkins Script Console",
            difficulty="easy",
            level=4,
            description="一个未设置认证的 Jenkins 服务器",
            total_score=100,
            flag_count=1,
            flags=[_gen_flag("jenkins-easy-19")],
            hint="Jenkins /script 页面提供 Groovy 控制台，可执行 'id'.execute().text 等系统命令",
            handler_class=JenkinsHandler,
        ),
        ChallengeConfig(
            code="solr-hard-20",
            title="Solr Velocity RCE",
            difficulty="hard",
            level=4,
            description="一个 Apache Solr 8.1.1 搜索服务",
            total_score=300,
            flag_count=1,
            flags=[_gen_flag("solr-hard-20")],
            hint="通过 /solr/demo/config 启用 VelocityResponseWriter，再用 wt=velocity 执行模板注入",
            handler_class=SolrHandler,
        ),
        ChallengeConfig(
            code="drupal-medium-21",
            title="Drupalgeddon 2 RCE",
            difficulty="medium",
            level=4,
            description="一个 Drupal 8.5.0 CMS 网站",
            total_score=200,
            flag_count=1,
            flags=[_gen_flag("drupal-medium-21")],
            hint="CVE-2018-7600: POST /user/register?element_parents=account/mail/%23value&ajax_form=1 可执行命令",
            handler_class=DrupalHandler,
        ),
        ChallengeConfig(
            code="spring4shell-hard-22",
            title="Spring4Shell RCE",
            difficulty="hard",
            level=4,
            description="一个运行在 Tomcat + JDK11 上的 Spring MVC 5.3.17 应用",
            total_score=300,
            flag_count=1,
            flags=[_gen_flag("spring4shell-hard-22")],
            hint="CVE-2022-22965: 通过 class.module.classLoader 操控 Tomcat AccessLogValve 写入 JSP webshell",
            handler_class=Spring4ShellHandler,
        ),
        ChallengeConfig(
            code="fastjson-medium-23",
            title="Fastjson Deser RCE",
            difficulty="medium",
            level=4,
            description="一个使用 Fastjson 1.2.47 解析 JSON 的 Java Web 应用",
            total_score=200,
            flag_count=1,
            flags=[_gen_flag("fastjson-medium-23")],
            hint="发送含 @type + JdbcRowSetImpl 的 JSON，利用 JNDI 注入实现 RCE",
            handler_class=FastjsonHandler,
        ),
        ChallengeConfig(
            code="weblogic-medium-24",
            title="WebLogic SSRF",
            difficulty="medium",
            level=4,
            description="一个 Oracle WebLogic 10.3.6 服务器，启用了 UDDI Explorer",
            total_score=200,
            flag_count=1,
            flags=[_gen_flag("weblogic-medium-24")],
            hint="WebLogic UDDI Explorer 的 operator 参数存在 SSRF，可探测内网服务并结合 CRLF 攻击 Redis",
            handler_class=WebLogicSSRFHandler,
        ),
        ChallengeConfig(
            code="activemq-medium-25",
            title="ActiveMQ File Upload",
            difficulty="medium",
            level=4,
            description="一个 Apache ActiveMQ 5.13.0 消息队列服务",
            total_score=200,
            flag_count=1,
            flags=[_gen_flag("activemq-medium-25")],
            hint="ActiveMQ fileserver 支持 PUT 写入文件和 MOVE 移动文件，可写入 webshell 到 web 目录",
            handler_class=ActiveMQHandler,
        ),
    ]


# ============================================================================
# 启动
# ============================================================================

def main():
    p = argparse.ArgumentParser(description="TCH 本地模拟靶场 + 比赛平台 API")
    p.add_argument("--port", type=int, default=9000, help="平台 API 端口 (默认: 9000)")
    p.add_argument("--token", type=str, default="test-token", help="Agent Token (默认: test-token)")
    p.add_argument("--host", type=str, default=None,
                   help="返回给客户端的 IP 地址 (默认: 自动检测)")
    args = p.parse_args()

    # 自动检测本机 IP
    advertise_host = args.host
    if not advertise_host or advertise_host == "0.0.0.0":
        try:
            s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
            s.connect(("8.8.8.8", 80))
            advertise_host = s.getsockname()[0]
            s.close()
        except Exception:
            advertise_host = "127.0.0.1"

    # 初始化状态
    state = RangeState(token=args.token, advertise_host=advertise_host)
    challenges = build_challenges()
    for c in challenges:
        state.register(c)

    # 构建 API handler
    handler_cls = type("BoundPlatformHandler", (PlatformAPIHandler,), {"state": state})

    # 启动 API 服务器
    api_server = ThreadedHTTPServer(("0.0.0.0", args.port), handler_cls)

    print("=" * 60)
    print("🏟️  TCH Local Test Range")
    print("=" * 60)
    print(f"  Platform API:    http://{advertise_host}:{args.port}/api/challenges")
    print(f"  Advertise Host:  {advertise_host}")
    print(f"  Agent Token:     {args.token}")
    print(f"  赛题数量:        {len(challenges)}")
    print()

    for c in challenges:
        flag_str = c.flags[0]
        print(f"  L{c.level} [{c.difficulty:6s}] {c.title:20s} | {c.total_score}pts | {flag_str}")
    print()
    print("  Level 解锁规则: 当前 level 的所有 easy 题全解后解锁下一 level")
    print()
    print("  使用方法:")
    print(f"    python3 competition.py --server {advertise_host}:{args.port} "
          f"--token {args.token} --workers 2")
    print()
    print("  Ctrl+C 停止")
    print("=" * 60)

    try:
        api_server.serve_forever()
    except KeyboardInterrupt:
        print("\n\n🛑 正在关闭...")
        # 停止所有靶场实例
        for inst in state.instances.values():
            if inst.server and inst.status == "running":
                inst.server.shutdown()
        api_server.shutdown()
        print("✅ 已关闭")


if __name__ == "__main__":
    main()