From d6ca66644751d6df2dd0ed3591e63402186cd710 Mon Sep 17 00:00:00 2001
From: danielsagi <danielsagi2009@gmail.com>
Date: Fri, 26 Jun 2020 17:04:29 +0300
Subject: [PATCH] Minor hunting bug fixes (#360)

* fixed f string

* fixed wrong iteration on list when getting random pod

* added '/' suffix to path on kubelet debug handlers tests

* also fixed minor bug in etcd, protocol was refrenced on the hunter and not on the event

* ran black format

* moved protocol to be https

* ran black again

* fixed PR comments

* ran black again, formatting
---
 kube_hunter/modules/hunting/etcd.py    |  9 ++++++---
 kube_hunter/modules/hunting/kubelet.py | 12 ++++++------
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/kube_hunter/modules/hunting/etcd.py b/kube_hunter/modules/hunting/etcd.py
index 703ca73..15b3af3 100644
--- a/kube_hunter/modules/hunting/etcd.py
+++ b/kube_hunter/modules/hunting/etcd.py
@@ -81,6 +81,7 @@ class EtcdRemoteAccessActive(ActiveHunter):
     def __init__(self, event):
         self.event = event
         self.write_evidence = ""
+        self.event.protocol = "https"
 
     def db_keys_write_access(self):
         config = get_config()
@@ -88,7 +89,7 @@ class EtcdRemoteAccessActive(ActiveHunter):
         data = {"value": "remotely written data"}
         try:
             r = requests.post(
-                f"{self.protocol}://{self.event.host}:{ETCD_PORT}/v2/keys/message",
+                f"{self.event.protocol}://{self.event.host}:{ETCD_PORT}/v2/keys/message",
                 data=data,
                 timeout=config.network_timeout,
             )
@@ -113,14 +114,16 @@ class EtcdRemoteAccess(Hunter):
         self.event = event
         self.version_evidence = ""
         self.keys_evidence = ""
-        self.protocol = "https"
+        self.event.protocol = "https"
 
     def db_keys_disclosure(self):
         config = get_config()
         logger.debug(f"{self.event.host} Passive hunter is attempting to read etcd keys remotely")
         try:
             r = requests.get(
-                f"{self.protocol}://{self.eventhost}:{ETCD_PORT}/v2/keys", verify=False, timeout=config.network_timeout,
+                f"{self.event.protocol}://{self.event.host}:{ETCD_PORT}/v2/keys",
+                verify=False,
+                timeout=config.network_timeout,
             )
             self.keys_evidence = r.content if r.status_code == 200 and r.content != "" else False
             return self.keys_evidence
diff --git a/kube_hunter/modules/hunting/kubelet.py b/kube_hunter/modules/hunting/kubelet.py
index 6ae819b..05f9dfa 100644
--- a/kube_hunter/modules/hunting/kubelet.py
+++ b/kube_hunter/modules/hunting/kubelet.py
@@ -244,7 +244,7 @@ class SecureKubeletPortHunter(Hunter):
         """ all methods will return the handler name if successful """
 
         def __init__(self, path, pod, session=None):
-            self.path = path
+            self.path = path + ("/" if not path.endswith("/") else "")
             self.session = session if session else requests.Session()
             self.pod = pod
 
@@ -349,7 +349,7 @@ class SecureKubeletPortHunter(Hunter):
             # self.session.cert = self.event.client_cert
         # copy session to event
         self.event.session = self.session
-        self.path = "https://{self.event.host}:10250"
+        self.path = f"https://{self.event.host}:10250"
         self.kubehunter_pod = {
             "name": "kube-hunter",
             "namespace": "default",
@@ -425,7 +425,7 @@ class SecureKubeletPortHunter(Hunter):
                 pod_data = next(filter(is_kubesystem_pod, pods_data), None)
 
             if pod_data:
-                container_data = next(pod_data["spec"]["containers"], None)
+                container_data = pod_data["spec"]["containers"][0]
                 if container_data:
                     return {
                         "name": pod_data["metadata"]["name"],
@@ -459,12 +459,12 @@ class ProveRunHandler(ActiveHunter):
     def execute(self):
         config = get_config()
         r = self.event.session.get(
-            self.base_path + KubeletHandlers.PODS.value, verify=False, timeout=config.network_timeout,
+            f"{self.base_path}/" + KubeletHandlers.PODS.value, verify=False, timeout=config.network_timeout,
         )
         if "items" in r.text:
             pods_data = r.json()["items"]
             for pod_data in pods_data:
-                container_data = next(pod_data["spec"]["containers"])
+                container_data = pod_data["spec"]["containers"][0]
                 if container_data:
                     output = self.run(
                         "uname -a",
@@ -498,7 +498,7 @@ class ProveContainerLogsHandler(ActiveHunter):
         if "items" in pods_raw:
             pods_data = json.loads(pods_raw)["items"]
             for pod_data in pods_data:
-                container_data = next(pod_data["spec"]["containers"])
+                container_data = pod_data["spec"]["containers"][0]
                 if container_data:
                     container_name = container_data["name"]
                     output = requests.get(