betep0k/cve-2021-25741Exploit for CVE-2021-25741 Kubernetes vulnerability allowing host filesystem mount into pods via race condition, with deployment scripts and technical details.
It's exploit for CVE-2021-25741 vulnerability. This vulnerability allows to mount Node filesystem inside of new POD with read-write privileges.
You can read more about the vulnerability here:
https://security.googleblog.com/2021/12/exploring-container-security-storage.html
I'm not author of this vulnerability and just made an exploit.
Thanks to @russtone and @maximusfox for the help with development of the exploit.
Vulnerable versions of the kubelet:
Just run run.sh and wait :) Exploiting will take some time (for me it was 10-20 minutes) because it's based on the race condition.
chmod +x run.sh; ./run.sh
When you get message "Success" you can attach to the POD and find Node filesystem in /mnt/data directory.
For attaching you can use next command:
kubectl exec -i -t cve202125741 -c mount-container -- /bin/sh
Exploit has 2 parts:
YAML file with pod configuration that exploits vulnerability. Because of race conidition it doesn't work every time, so you should do it in a loop.
Scripts that deploys pod.yaml, checks result and re-deploy it if it's required.
As renameat2 binary with RENAME_EXCHANGE option I used this code: https://gist.github.com/eatnumber1/f97ac7dad7b1f5a9721f
You can compile it by yourself and replace in pod.yaml if you want:
gcc renameat2.c -o renameat2
base64 renameat2
Solutions:
Solutions: