Skip to content

Commit 604c39b

Browse files
authored
Merge pull request #94 from qing-root/TerraformGoat-B2
add apiserver unauth and dashboard vul lab
2 parents 8c24682 + abbdbc1 commit 604c39b

File tree

16 files changed

+553
-0
lines changed

16 files changed

+553
-0
lines changed
Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
resource "alicloud_instance" "instance" {
2+
security_groups = alicloud_security_group.group.*.id
3+
instance_type = data.alicloud_instance_types.types_ds.instance_types.0.id
4+
image_id = "ubuntu_18_04_64_20G_alibase_20190624.vhd"
5+
instance_name = "huocorp_terraform_goat_instance"
6+
vswitch_id = alicloud_vswitch.vswitch.id
7+
system_disk_size = 20
8+
internet_max_bandwidth_out = 100
9+
password = "Huoxian@123" // 虚拟机密码
10+
11+
provisioner "file" {
12+
connection {
13+
type = "ssh"
14+
host = self.public_ip
15+
user = "root"
16+
password = "Huoxian@123"
17+
timeout = "1h"
18+
}
19+
20+
source = "resource/kk"
21+
destination = "/root/kk" // deploy_k8s.sh用来安装k8s
22+
}
23+
24+
provisioner "remote-exec" {
25+
connection {
26+
type = "ssh"
27+
host = self.public_ip
28+
user = "root"
29+
password = "Huoxian@123"
30+
timeout = "1h"
31+
}
32+
script = "resource/deploy_k8s.sh"
33+
}
34+
35+
depends_on = [
36+
alicloud_security_group.group,
37+
alicloud_vswitch.vswitch,
38+
]
39+
}
40+
41+
resource "alicloud_security_group" "group" {
42+
name = "huocorp_terraform_goat_security_group"
43+
vpc_id = alicloud_vpc.vpc.id
44+
depends_on = [
45+
alicloud_vpc.vpc
46+
]
47+
}
48+
49+
resource "alicloud_security_group_rule" "allow_all_tcp" {
50+
type = "ingress"
51+
ip_protocol = "tcp"
52+
nic_type = "intranet"
53+
policy = "accept"
54+
port_range = "1/65535" // 允许访问所有端口
55+
priority = 1
56+
security_group_id = alicloud_security_group.group.id
57+
cidr_ip = "0.0.0.0/0"
58+
depends_on = [
59+
alicloud_security_group.group
60+
]
61+
}
62+
63+
resource "alicloud_vpc" "vpc" {
64+
vpc_name = "huocorp_terraform_goat_vpc"
65+
cidr_block = "172.16.0.0/16"
66+
}
67+
68+
resource "alicloud_vswitch" "vswitch" {
69+
vpc_id = alicloud_vpc.vpc.id
70+
cidr_block = "172.16.0.0/24"
71+
zone_id = "cn-beijing-h"
72+
vswitch_name = "huocorp_terraform_goat_vswitch"
73+
depends_on = [
74+
alicloud_vpc.vpc
75+
]
76+
}
77+
78+
// kubekey安装k8s集群,配置要求至少 2核4g
79+
data "alicloud_instance_types" "types_ds" {
80+
cpu_core_count = 2
81+
memory_size = 4
82+
}
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "dashborad_unauth_lab_address_link" {
2+
value = "http://${alicloud_instance.instance.public_ip}:8001"
3+
description = "dashborad un-auth lab address link."
4+
}
Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIC5zCCAc+gAwIBAgIBADANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDEwprdWJl
3+
cm5ldGVzMB4XDTIyMDUyNTAwMzAwNVoXDTMyMDUyMjAwMzAwNVowFTETMBEGA1UE
4+
AxMKa3ViZXJuZXRlczCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALeq
5+
u/bFhznjf680PsYxipm6lc4yuE+LJNZoonkxTMN7gmnuS9bfi15wARsWL3j3krjq
6+
j6p/FqwaHqUEYkfPgAPm3SVW7fx2NFCfm4mBMympP3yGYDSI2QfajLvHJJqlommY
7+
BoGAJY9OoA8HC/lQciRH0ac0b2eWt01u01uUCjVqhKpyoSYScf/w8x3CGDtd/ikW
8+
tVR9eygk6voB72qNOkGemWIkIu0cdeqCyyV6mZ9NZdZVaKdMrxxD8rSwBIshAHdQ
9+
og6jMGqZ5vEaFXYIj0l8liouxz46d7FywwSrFQFp3mNkf1gxINs6mUuOtl1wabEM
10+
54RAV7jyuItYbQUAt8kCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgKkMA8GA1UdEwEB
11+
/wQFMAMBAf8wHQYDVR0OBBYEFN+879R6nxWe58q30Bk1woRY2iVWMA0GCSqGSIb3
12+
DQEBCwUAA4IBAQB2dtMsFOjA5tx9+E62l/6vFPRXoGX+M1bYHGedcocVKGc/0wm+
13+
oqdJPaYH67XztQdBIWRAXqF/KWj5g0TzZDM0yala1XgPp2ENZzDz/h0ysc2FLix+
14+
yNNGt2t5Ou3JEEAnuT6DkDjrNlVXgfZu3cPkhWYt2hb59GTDKJ+mZyldXRnjx2hF
15+
z0uaSgwpBOfvUIRl/WoxaIT/xW7VPBUZpGlWYe5cLXQKhJlmfWG0QpeRTXyh4TnY
16+
iSGGP4BH4NXMDRSv/WuMWH/6mgzc4n1Ne6J4pdiBx3MXaLDjWPJIekNO8Oza04h2
17+
bI3DrdZLUY5afZ8/BU27HyS3sBJTFfoxwNSA
18+
-----END CERTIFICATE-----
Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
#!/bin/bash
2+
function deploy_k8s(){
3+
export KKZONE=cn
4+
5+
# /root/kk 已经通过terrraform provisioner拷贝主机
6+
chmod 755 /root/kk
7+
8+
apt-get update -y
9+
apt-get install -y conntrack ebtables socat
10+
11+
/root/kk create cluster --with-kubernetes v1.21.5 -y
12+
13+
14+
15+
}
16+
17+
# apiverser没有任何身份认证
18+
function deploy_vuln_dashboard(){
19+
# 备份
20+
apiserver_config_path=/etc/kubernetes/manifests/kube-apiserver.yaml
21+
command_path=/usr/local/bin/kube-apiserver
22+
23+
24+
#安装dashborad
25+
curl https://raw.githubusercontent.com/kubernetes/dashboard/v2.5.0/aio/deploy/recommended.yaml -o ~/recommended.yaml
26+
27+
#将"system:anonymous"用户绑定到"cluster-admin"用户组
28+
kubectl create clusterrolebinding system:anonymous --clusterrole=cluster-admin --user=system:anonymous
29+
echo "[done] 'anonymous cluster-admin ' create"
30+
31+
# 修改apiserver 配置
32+
sed -i '/auto-generate-certificates/a\ \ \ \ -\ --enable-skip-login/' ~/recommended.yaml
33+
echo "[done] dashboard config change"
34+
kubectl apply -f ~/recommended.yaml
35+
sleep 6
36+
#打开 dashboard (默认端口 8001)
37+
#http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/
38+
kubectl proxy &
39+
sleep 3
40+
echo "[done] 'dashborad' restart"
41+
}
42+
43+
44+
deploy_k8s
45+
echo "[done] 'k8s cluster' deploy" && sleep 60
46+
deploy_vuln_dashboard
51.3 MB
Binary file not shown.
Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
Certificate:
2+
Data:
3+
Version: 3 (0x2)
4+
Serial Number: 9 (0x9)
5+
Signature Algorithm: sha256WithRSAEncryption
6+
Issuer: CN=kubernetes
7+
Validity
8+
Not Before: Jun 23 08:16:19 2022 GMT
9+
Not After : Jun 23 08:16:19 2023 GMT
10+
Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
11+
Subject Public Key Info:
12+
Public Key Algorithm: rsaEncryption
13+
RSA Public-Key: (2048 bit)
14+
Modulus:
15+
00:c9:21:00:b4:ad:b7:db:80:68:dd:38:08:29:02:
16+
16:e3:ca:10:f2:7b:95:62:90:16:7f:b1:3e:ac:98:
17+
1e:87:06:59:28:fb:54:86:f6:d2:9f:ef:cf:57:a2:
18+
44:ba:fb:7f:c4:24:a5:d5:2b:ca:c4:ed:c7:03:af:
19+
92:6f:21:ea:8f:80:e7:01:d1:b4:85:d2:43:ff:3a:
20+
f6:84:15:df:8a:05:bb:11:c2:76:39:5f:8a:d6:7d:
21+
97:0f:8d:c4:15:b1:60:4d:f3:e8:3d:dc:ff:94:45:
22+
ea:ae:be:df:94:45:0b:cd:7d:2d:b2:9f:d1:d8:d8:
23+
32:17:01:78:a4:7b:35:e8:b6:24:74:05:57:cb:2e:
24+
10:6d:ec:b8:e7:f1:5f:7b:4f:3b:48:8f:70:d6:9c:
25+
68:d3:2d:3c:22:78:c0:e6:03:89:3b:2a:c8:d3:52:
26+
70:c4:28:78:fb:6b:38:21:ba:75:a4:5f:95:11:ef:
27+
51:f3:bd:35:5d:aa:89:d6:6a:6b:e4:4e:b9:c9:f5:
28+
c8:e1:e6:f6:69:e2:63:2e:6d:02:fe:45:b1:3e:d6:
29+
5c:3d:5d:ff:ac:21:21:15:ed:73:e7:18:2c:ef:a2:
30+
a2:37:bb:61:93:a3:11:bb:f6:67:b4:c4:a1:08:28:
31+
4b:d5:e1:a8:a6:f0:49:c0:ab:07:3a:c3:83:0f:47:
32+
65:11
33+
Exponent: 65537 (0x10001)
34+
X509v3 extensions:
35+
X509v3 Basic Constraints:
36+
CA:FALSE
37+
Netscape Comment:
38+
OpenSSL Generated Certificate
39+
X509v3 Subject Key Identifier:
40+
DB:15:B4:EB:B2:BD:4D:D3:1E:BA:51:D7:C9:69:AF:77:10:43:D1:84
41+
X509v3 Authority Key Identifier:
42+
keyid:DF:BC:EF:D4:7A:9F:15:9E:E7:CA:B7:D0:19:35:C2:84:58:DA:25:56
43+
44+
X509v3 Key Usage:
45+
Digital Signature, Non Repudiation, Key Encipherment
46+
X509v3 Subject Alternative Name:
47+
DNS:*.org.example.com, DNS:*.example.com, DNS:agnhost-service.default.svc, IP Address:127.0.0.1
48+
Signature Algorithm: sha256WithRSAEncryption
49+
97:64:b0:ad:73:25:22:20:9c:40:60:fd:ab:0b:8c:08:de:09:
50+
5c:57:23:ab:cc:97:6e:f4:d5:be:1f:64:a1:38:9e:74:31:85:
51+
33:ee:94:94:ba:7b:67:0a:00:a2:3c:c8:fd:3c:dd:fa:c0:e3:
52+
42:96:09:e5:09:e4:40:a1:a0:61:33:ed:68:27:1d:b2:94:8e:
53+
6f:0d:73:72:53:38:73:ec:a9:4b:3f:5e:74:f8:5b:39:7a:99:
54+
a6:ec:df:0f:4a:e3:04:e2:78:c2:01:f6:c6:1c:55:d6:e5:1e:
55+
f8:28:dd:d1:26:77:cb:7e:22:26:3d:68:52:20:db:bb:06:b9:
56+
ea:1e:d5:40:b6:be:f0:74:09:cf:57:d5:82:d5:04:81:59:f9:
57+
a0:4f:c8:d1:49:fc:bc:86:88:38:70:17:0a:b5:6b:2d:ce:5c:
58+
22:55:a4:ad:3c:e7:ff:3a:c7:52:b1:89:23:9e:0f:05:ac:75:
59+
5f:33:ac:a4:d8:a3:c1:6f:37:21:7c:b1:22:23:50:21:7d:db:
60+
dc:82:b3:fc:8a:45:1d:16:1b:aa:06:f1:18:f0:90:ce:45:5c:
61+
45:03:c8:f6:13:37:0d:a7:57:7b:a0:92:15:e9:39:cf:f8:3b:
62+
b8:5f:51:c6:a9:d1:68:0e:2c:e3:42:f3:86:f2:71:1f:79:9b:
63+
61:b5:ee:b5
64+
-----BEGIN CERTIFICATE-----
65+
MIIDrzCCApegAwIBAgIBCTANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDEwprdWJl
66+
cm5ldGVzMB4XDTIyMDYyMzA4MTYxOVoXDTIzMDYyMzA4MTYxOVowRTELMAkGA1UE
67+
BhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdp
68+
ZGdpdHMgUHR5IEx0ZDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMkh
69+
ALStt9uAaN04CCkCFuPKEPJ7lWKQFn+xPqyYHocGWSj7VIb20p/vz1eiRLr7f8Qk
70+
pdUrysTtxwOvkm8h6o+A5wHRtIXSQ/869oQV34oFuxHCdjlfitZ9lw+NxBWxYE3z
71+
6D3c/5RF6q6+35RFC819LbKf0djYMhcBeKR7Nei2JHQFV8suEG3suOfxX3tPO0iP
72+
cNacaNMtPCJ4wOYDiTsqyNNScMQoePtrOCG6daRflRHvUfO9NV2qidZqa+ROucn1
73+
yOHm9mniYy5tAv5FsT7WXD1d/6whIRXtc+cYLO+ioje7YZOjEbv2Z7TEoQgoS9Xh
74+
qKbwScCrBzrDgw9HZRECAwEAAaOB2TCB1jAJBgNVHRMEAjAAMCwGCWCGSAGG+EIB
75+
DQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQU2xW0
76+
67K9TdMeulHXyWmvdxBD0YQwHwYDVR0jBBgwFoAU37zv1HqfFZ7nyrfQGTXChFja
77+
JVYwCwYDVR0PBAQDAgXgME4GA1UdEQRHMEWCESoub3JnLmV4YW1wbGUuY29tgg0q
78+
LmV4YW1wbGUuY29tghthZ25ob3N0LXNlcnZpY2UuZGVmYXVsdC5zdmOHBH8AAAEw
79+
DQYJKoZIhvcNAQELBQADggEBAJdksK1zJSIgnEBg/asLjAjeCVxXI6vMl2701b4f
80+
ZKE4nnQxhTPulJS6e2cKAKI8yP083frA40KWCeUJ5EChoGEz7WgnHbKUjm8Nc3JT
81+
OHPsqUs/XnT4Wzl6mabs3w9K4wTieMIB9sYcVdblHvgo3dEmd8t+IiY9aFIg27sG
82+
ueoe1UC2vvB0Cc9X1YLVBIFZ+aBPyNFJ/LyGiDhwFwq1ay3OXCJVpK085/86x1Kx
83+
iSOeDwWsdV8zrKTYo8FvNyF8sSIjUCF929yCs/yKRR0WG6oG8RjwkM5FXEUDyPYT
84+
Nw2nV3ugkhXpOc/4O7hfUcap0WgOLONC84bycR95m2G17rU=
85+
-----END CERTIFICATE-----
Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
-----BEGIN RSA PRIVATE KEY-----
2+
MIIEpAIBAAKCAQEAySEAtK2324Bo3TgIKQIW48oQ8nuVYpAWf7E+rJgehwZZKPtU
3+
hvbSn+/PV6JEuvt/xCSl1SvKxO3HA6+SbyHqj4DnAdG0hdJD/zr2hBXfigW7EcJ2
4+
OV+K1n2XD43EFbFgTfPoPdz/lEXqrr7flEULzX0tsp/R2NgyFwF4pHs16LYkdAVX
5+
yy4Qbey45/Ffe087SI9w1pxo0y08InjA5gOJOyrI01JwxCh4+2s4Ibp1pF+VEe9R
6+
8701XaqJ1mpr5E65yfXI4eb2aeJjLm0C/kWxPtZcPV3/rCEhFe1z5xgs76KiN7th
7+
k6MRu/ZntMShCChL1eGopvBJwKsHOsODD0dlEQIDAQABAoIBAQC18SHnUAKzEO1L
8+
uQVAu4AjXcaI5BzVxYxkxNzyWsW61ZZQSVNEqAEO52vEVakhEKOatqBBP1U1YfeX
9+
MPshhyfd2vieH6rTJ8uVFiysffDytY5tWWGDMxewQnoletP337ZDrjHXzJRy9/B9
10+
VXOBeBheMi/ll0fIhoKBZzZQbJjuwkLb42QZ8vGAg49bG7C3VLpXVrht335mLWYK
11+
cDEtXj6tE7ipxjx65PTmw8Rjj6ESOhYrnAJRBek3ngtBJFRwXGtrINy5nHpcE3x5
12+
0Zg+bpB72DdGv48C3lABYT180UkA/9/CB3ofjrYlzRccvczlXuRAeTdvyjl8bD7m
13+
dpvgdqdBAoGBAPEPpYxH97DlyjgmHcV2xVKEEASeLyO9dcbx1cZo2lykDrPgkTi5
14+
ICkJDAJHkMcEpRvIydDXwh4cMB4Idzuweuy4k9Pr3Jz9cjo03PnaHV/27n3gtlk2
15+
RBcXOMdFHlK3HhVVQseToHDR2+2f1rzQOaYcPSvoscxupeLRpZtq8/dpAoGBANWX
16+
2FyCZoBD9/YboEb0RlT/Kvct7gfk5Hkot1grDvrxgyFzj36fTVEZ1RX6jHX3aVxD
17+
0kx4okL8year7eMvi1x0Av9lXXgRIc4ouHdOG+CaG1pjIxkKPLLxYQP89biDI8p1
18+
C2QnIzOSseaixF61wTASbOrv9K/xex7hXrxW5TNpAoGAcBZParf38vgWHB+VDkEY
19+
pTKk5BDNaHfq8LN4LEaK6jKaZ4dO3yotSwda3yB5sCB3yUCGnqYEK839jalwD4AS
20+
2ElG624raY/rcicsbLy/leSSplM7VqYF6RqyGu4HmHxu74pyf6wkGPFrqsT8q1TC
21+
yXst8mHDcoQsfBfxQh/sCqkCgYAKmUJPNNlJPBYtzCkj3DMxPIgxQ8Iv+hesO2z9
22+
nwVbRmivXECek+EOSS3drVUS9Xfw8BybVtEWadzK6XUgdNeBevA7JBiDQLZguHyO
23+
zv1rI7p/vbOcJnnklz2tKPw4b6ly/mPWUGrawEi7nRAJcxNnA0MMVWPa5yyo154P
24+
0nAFIQKBgQDwMvfdacHwiNTcpn1gTZc7gQE17m8fRIi2oyH3PPclDv8AmoTjnqGi
25+
YtDrj6NJIBN8XuKKuu+2ptqNXk3PSMDrkv1Zhoo6PrvtwpiUwDoWcANfToEESueH
26+
za4vAwRqx3MiV91d8Z2/wVu67RTp3+198zCv9eujDuP5dNqAKf77MA==
27+
-----END RSA PRIVATE KEY-----
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
terraform {
2+
required_providers {
3+
alicloud = {
4+
source = "aliyun/alicloud"
5+
version = "1.163.0"
6+
}
7+
}
8+
}
9+
10+
provider "alicloud" {
11+
profile = "default"
12+
region = "cn-beijing"
13+
}
Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
resource "alicloud_instance" "instance" {
2+
security_groups = alicloud_security_group.group.*.id
3+
instance_type = data.alicloud_instance_types.types_ds.instance_types.0.id
4+
image_id = "ubuntu_18_04_64_20G_alibase_20190624.vhd"
5+
instance_name = "huocorp_terraform_goat_instance"
6+
vswitch_id = alicloud_vswitch.vswitch.id
7+
system_disk_size = 20
8+
internet_max_bandwidth_out = 100
9+
password = "Huoxian@123" // 虚拟机密码
10+
11+
provisioner "file" {
12+
connection {
13+
type = "ssh"
14+
host = self.public_ip
15+
user = "root"
16+
password = "Huoxian@123"
17+
timeout = "1h"
18+
}
19+
20+
source = "resource/kk"
21+
destination = "/root/kk" // deploy_k8s.sh用来安装k8s
22+
}
23+
24+
provisioner "remote-exec" {
25+
connection {
26+
type = "ssh"
27+
host = self.public_ip
28+
user = "root"
29+
password = "Huoxian@123"
30+
timeout = "1h"
31+
}
32+
script = "resource/deploy_k8s.sh"
33+
}
34+
35+
depends_on = [
36+
alicloud_security_group.group,
37+
alicloud_vswitch.vswitch,
38+
]
39+
}
40+
41+
resource "alicloud_security_group" "group" {
42+
name = "huocorp_terraform_goat_security_group"
43+
vpc_id = alicloud_vpc.vpc.id
44+
depends_on = [
45+
alicloud_vpc.vpc
46+
]
47+
}
48+
49+
resource "alicloud_security_group_rule" "allow_all_tcp" {
50+
type = "ingress"
51+
ip_protocol = "tcp"
52+
nic_type = "intranet"
53+
policy = "accept"
54+
port_range = "1/65535" // 允许访问所有端口
55+
priority = 1
56+
security_group_id = alicloud_security_group.group.id
57+
cidr_ip = "0.0.0.0/0"
58+
depends_on = [
59+
alicloud_security_group.group
60+
]
61+
}
62+
63+
resource "alicloud_vpc" "vpc" {
64+
vpc_name = "huocorp_terraform_goat_vpc"
65+
cidr_block = "172.16.0.0/16"
66+
}
67+
68+
resource "alicloud_vswitch" "vswitch" {
69+
vpc_id = alicloud_vpc.vpc.id
70+
cidr_block = "172.16.0.0/24"
71+
zone_id = "cn-beijing-h"
72+
vswitch_name = "huocorp_terraform_goat_vswitch"
73+
depends_on = [
74+
alicloud_vpc.vpc
75+
]
76+
}
77+
78+
// kubekey安装k8s集群,配置要求至少 2核4g
79+
data "alicloud_instance_types" "types_ds" {
80+
cpu_core_count = 2
81+
memory_size = 4
82+
}
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "apiserver_unauth_lab_address_link" {
2+
value = "http://${alicloud_instance.instance.public_ip}:8443"
3+
description = "apiserver un-auth lab address link."
4+
}

0 commit comments

Comments
 (0)