Kubernetes Goat
I only wrote some things that I have not encountered in my article. I will not mention those that I have encountered.
1Code base sensitive key
Explode the directory and find the git directory -> gitdump grabs the historical git submission information -> local git log gets the submission record -> find the submitted env file based on the submission record -> checkout switches to that submission, view the .env file -> view aws ak/sk
2Docker-in-Docker vulnerability exploitation
Command injection vulnerability -> Detect the docker.sock file -> Download the docker binary executable package and launch the docker virtual machine to call the sock (/tmp/docker/docker -H unix:///custom/docker/docker.sock images) -> Use the modified sock to create a machine with a shared host folder (/tmp/docker/docker -H unix:///custom/docker/docker.sock run -v /:/mnt -it alpine sh)
3SSRF in Kubernetes (K8S)
In actual combat, ssrf is used to obtain the intranet k8s curl api or dashboard to obtain the image warehouse password without authorization.
4 Containers escape to the main system
mout checks the mounted directory and finds that it is mounted to the root directory of the host.
Common characteristics of mounting to the host's root directory
a. /dev/mapper/centos-root on /host-system type xfs
b. /dev/sda on /host-system type file format
>
Directly chroot /host-system bash and use host-system as the root directory to restart a bash and escape successfully.
5 Attack private repositories
/v2/_catalog Get docker warehouse information -> /v2/mirror image/manifests/latest Get image information, including env information, which may contain ak sk or various api-keys
6 Get cap information, etc.
amicontained tools
capsh --print comes with the command
7 Information hidden in images
docker history --no-trunc madhuakula/k8s-goat-hidden-in-layers View build history ->
At this time, there are many ideas. The following is an introduction to the ideas.
1docker cp pulls the file out and looks at it
2docker save transfers the tar file to your own machine and then docker load + cap permissions and then access it
3Reference
Docker save transfers the tar file to your own machine -> decompress -> use dive to analyze the image
https://github.com/wagoodman/dive/releases
8Falco - Runtime security monitoring and instrumentation
https://github.com/falcosecurity/falco
Since it can build monitoring logs and is open source, it can modify the cpp file, detect ak, sk and other rules and send the key to our vps machine.
Comments (0)
Login to post a comment.