Kubenomicon.
Kubenomicon. • Интересный проект в стиле MITRE ATTACK для Kubernetes, который ориентирован на наступательную безопасность. С акцентом на то, как использовать каждую атаку. • Initial access: • Using cloud credentials; • Compromised image In registry; • Kubeconfig file; • Application vulnerability; • Exposed sensitive interfaces; • SSH server running inside container. • Execution: • Exec inside container; • New container; • Application exploit (RCE); • Sidecar injection. • Persistence: • Backdoor container; • Writable hostPath mount; • Kubernetes cronjob; • Malicious admission controller; • Container service account; • Static pods. • Privilege escalation: • Privileged container; • Cluster-admin binding; • hostPath mount; • Access cloud resources. • Defense evasion: • Clear container logs; • Delete events; • Pod name similarity; • Connect from proxy server. • Credential access: • List K8S secrets; • Access node information; • Container service account; • Application credentials in configuration files; • Access managed identity credentials; • Malicious admission controller. • Discovery: • Access Kubernetes API server; • Access Kubelet API; • Network mapping; • Exposed sensitive interfaces; • Instance Metadata API. • Lateral movement: • Access cloud resources; • Container service account; • Cluster internal networking; • Application credentials in configuration files; • Writable hostPath mount; • CoreDNS poisoning; • ARP poisoning and IP spoofing. • Collection: • Images from a private registry; • Collecting data from pod. • Impact: • Data destruction; • Resource hijacking; • Denial of service. • Fundamentals: • Nodes; • Services; • etcd; • RBAC; • Kubelet; • Namespaces; • Secrets; • Interesting Files. https://kubenomicon.com/ #Kubernetes