SHIP SECURE.

"""
PUBLIC SAMPLE — REDACTED FOR PUBLIC RELEASE.

This file is a sanitized teaser of an APX Labs penetration test artifact.
The original exploit script is intentionally NOT published. Live hostnames,
credentials, tokens, and the working attack chain have been removed and
replaced with PLACEHOLDER values. The functions below are not runnable.

If you are a prospective customer and want to see the full, working
proof-of-concept under NDA, contact: contact@apxlabs.ai

----------------------------------------------------------------------
Vulnerability class : OS Command Injection (chained)
Attack chain        : Mass Assignment -> SSRF -> Shell Injection
Target              : crAPI demo environment (intentionally vulnerable
                      reference app maintained by OWASP, deployed on
                      isolated infrastructure for client demos)
Outcome             : Authenticated regular user achieves Remote Code
                      Execution on the backend server.
----------------------------------------------------------------------

Invariant the target was supposed to hold:
    The video conversion endpoint must NOT accept attacker-controlled
    OS commands. User input must be sanitized and must not reach an OS
    shell.

Why it failed:
    1) Mass Assignment on the video PUT endpoint accepted an
       arbitrary `conversion_params` field that should have been
       server-managed only.
    2) An SSRF in the "contact mechanic" endpoint allowed an external
       request to reach an internal-only conversion service.
    3) The internal conversion service passed `conversion_params`
       into an OS shell command without sanitization.

The combination — not any single bug — is what made RCE reachable to a
non-privileged authenticated user.
"""

# --- Configuration (placeholders) -------------------------------------
# Real values intentionally removed. Do not substitute live credentials.
BASE_URL              = "https://example.invalid"
INTERNAL_CONVERT_URL  = "https://internal.example.invalid/convert"
EMAIL                 = "PLACEHOLDER@example.invalid"
PASSWORD              = "PLACEHOLDER"  # REDACTED — rotate if you see a real value here

# Auth header shape (token redacted):
#   Authorization: Bearer PLACEHOLDER_JWT


# --- Step 1: Authenticate (REDACTED) ----------------------------------
def login():
    """
    POST {BASE_URL}/identity/api/auth/login  with {email, password}
    Returns: JWT bearer token.

    Implementation redacted for public release.
    """
    raise NotImplementedError("redacted for public release")


# --- Step 2: Locate a video resource owned by the test user (REDACTED)
def get_video_id(token):
    """
    GET {BASE_URL}/identity/api/v2/user/dashboard  with bearer token.
    Falls back to uploading a stub video if none exists.

    Implementation redacted for public release.
    """
    raise NotImplementedError("redacted for public release")


# --- Step 3: Mass Assignment (REDACTED) -------------------------------
def inject_conversion_params(token, video_id, payload):
    """
    PUT {BASE_URL}/identity/api/v2/user/videos/{id}

    The endpoint accepts an unexpected `conversion_params` field from
    the request body and persists it on the video record. Server-side
    allowlisting on the schema would have prevented this.

    Implementation redacted for public release.
    """
    raise NotImplementedError("redacted for public release")


# --- Step 4: SSRF to internal conversion service (REDACTED) -----------
def trigger_conversion_via_ssrf(token, video_id):
    """
    POST {BASE_URL}/workshop/api/merchant/contact_mechanic

    The endpoint dereferences a caller-supplied `mechanic_api` URL
    server-side. Passing the internal conversion URL here causes the
    server to hit its own internal-only service on behalf of the
    attacker — bypassing the external 403.

    Implementation redacted for public release.
    """
    raise NotImplementedError("redacted for public release")


# --- Step 5: Chain and verify (REDACTED) ------------------------------
def test_command_injection():
    """
    Full chain (described, not executed):

        token     = login()
        video_id  = get_video_id(token)

        # (1) Mass Assignment — plant attacker-controlled value
        inject_conversion_params(token, video_id, payload="REDACTED")

        # (2) SSRF — reach internal-only convert endpoint
        resp = trigger_conversion_via_ssrf(token, video_id)

        # (3) Shell Injection — internal endpoint passes the planted
        #     value into an OS shell. Response confirms execution.

    A direct request to the internal convert endpoint returns 403; the
    SSRF bypasses that boundary. The full proof-of-concept, response
    captures, and remediation guidance are available under NDA.
    """
    raise NotImplementedError("redacted for public release")


if __name__ == "__main__":
    # Intentionally non-runnable. See contact@apxlabs.ai for full PoC.
    raise SystemExit(
        "This is a redacted public sample. "
        "Request the full proof-of-concept under NDA: contact@apxlabs.ai"
    )