前提
介绍
靶场内容
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
| Sensitive keys in codebases DIND (docker-in-docker) exploitation SSRF in the Kubernetes (K8S) world Container escape to the host system Docker CIS benchmarks analysis Kubernetes CIS benchmarks analysis Attacking private registry NodePort exposed services Helm v2 tiller to PwN the cluster - [Deprecated] Analyzing crypto miner container Kubernetes namespaces bypass Gaining environment information DoS the Memory/CPU resources Hacker container preview Hidden in layers RBAC least privileges misconfiguration KubeAudit - Audit Kubernetes clusters Falco - Runtime security monitoring & detection Popeye - A Kubernetes cluster sanitizer Secure network boundaries using NSP Cilium Tetragon - eBPF-based Security Observability and Runtime Enforcement Securing Kubernetes Clusters using Kyverno Policy Engine
|
搭建
https://icybersec.gitbook.io/cybersecuritynote/yun-wei-pei-zhi/kubernetes/an-zhuang-bu-shu#an-zhuang-kubectl
kubernetes-goat项目issues
安装helm
1
| curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
|
1 2 3
| helm version
version.BuildInfo{Version:"v3.11.0", GitCommit:"472c5736ab01133de504a826bd9ee12cbe4e7904", GitTreeState:"clean", GoVersion:"go1.18.10"}
|
安装socat,用于端口转发
kubernetes-goat.git
1
| git clone https://github.com/madhuakula/kubernetes-goat.git
|
- 修改
scenarios/internal-proxy/deployment.yaml
中CPU和内存值为300M。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
| spec: selector: matchLabels: app: internal-proxy template: metadata: labels: app: internal-proxy spec: containers: - name: internal-api image: madhuakula/k8s-goat-internal-api resources: limits: cpu: 300m memory: 300Mi requests: cpu: 300m memory: 300Mi ports:
|
1 2 3 4 5
| chmod +x bash setup-kubernetes-goat.sh chmod +x bash access-kubernetes-goat.sh
bash setup-kubernetes-goat.sh bash access-kubernetes-goat.sh
|
报错
- 个人遇到情况及解决
- 在执行
.sh
文件的时候出现的报错
1 2
| root@ubuntu20:~/kubernetes-goat# bash setup-kubernetes-goat.sh Error: Could not find kubectl or an other error happened, please check kubectl setup.
|
1 2
| root@ubuntu20:~/kubernetes-goat# bash access-kubernetes-goat.sh Please check kubectl setup.
|
1 2 3 4 5 6 7 8
| I fixed it using kubectl 1.23.0: 我使用 kubectl 1.23.0 修复了它:
curl -LO https://dl.k8s.io/release/v1.23.0/bin/linux/amd64/kubectl
sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
kubectl version --short
|
1
| curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
|
1
| https://get.helm.sh/helm-v3.13.1-linux-amd64.tar.gz
|
1
| mv helm /usr/local/bin/helm
|
搭建完成