forked from madhuakula/kubernetes-goat
-
Notifications
You must be signed in to change notification settings - Fork 0
/
access-kubernetes-goat.ps1
45 lines (34 loc) · 3.27 KB
/
access-kubernetes-goat.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
# Author: Madhu Akula
# This program has been created as part of Kubernetes Goat
# Kubernetes Goat Access vulnerable infrastructure
# Checking kubectl.exe setup
try {
kubectl.exe version > $null 2>&1
Write-Host "kubectl.exe setup looks good."
} catch {
Write-Host "Please check kubectl.exe setup."
exit
}
Write-Host 'Creating port forward for all the Kubernetes Goat resources to locally. We will be using 1230 to 1236 ports locally!'
# Exposing Sensitive keys in code bases Scenario
$POD_NAME = kubectl.exe get pods --namespace default -l "app=build-code" -o jsonpath="{.items[0].metadata.name}"
Start-Process -NoNewWindow -FilePath "C:\Program Files\Docker\Docker\resources\bin\kubectl.exe" -ArgumentList "port-forward $POD_NAME --address 0.0.0.0 1230:3000" -RedirectStandardError "C:\NUL" -RedirectStandardOutput ".\NUL"
# Exposing DIND (docker-in-docker) exploitation Scenario
$POD_NAME = kubectl.exe get pods --namespace default -l "app=health-check" -o jsonpath="{.items[0].metadata.name}"
Start-Process -NoNewWindow -FilePath "C:\Program Files\Docker\Docker\resources\bin\kubectl.exe" -ArgumentList "port-forward $POD_NAME --address 0.0.0.0 1231:80" -RedirectStandardError "C:\NUL" -RedirectStandardOutput ".\NUL"
# Exposing SSRF in K8S world Scenario
$POD_NAME = kubectl.exe get pods --namespace default -l "app=internal-proxy" -o jsonpath="{.items[0].metadata.name}"
Start-Process -NoNewWindow -FilePath "C:\Program Files\Docker\Docker\resources\bin\kubectl.exe" -ArgumentList "port-forward $POD_NAME --address 0.0.0.0 1232:3000" -RedirectStandardError "C:\NUL" -RedirectStandardOutput ".\NUL"
# Exposing Container escape to access host system Scenario
$POD_NAME = kubectl.exe get pods --namespace default -l "app=system-monitor" -o jsonpath="{.items[0].metadata.name}"
Start-Process -NoNewWindow -FilePath "C:\Program Files\Docker\Docker\resources\bin\kubectl.exe" -ArgumentList "port-forward $POD_NAME --address 0.0.0.0 1233:8080" -RedirectStandardError "C:\NUL" -RedirectStandardOutput ".\NUL"
# Exposing Kubernetes Goat Home
$POD_NAME = kubectl.exe get pods --namespace default -l "app=kubernetes-goat-home" -o jsonpath="{.items[0].metadata.name}"
Start-Process -NoNewWindow -FilePath "C:\Program Files\Docker\Docker\resources\bin\kubectl.exe" -ArgumentList "port-forward $POD_NAME --address 0.0.0.0 1234:80" -RedirectStandardError "C:\NUL" -RedirectStandardOutput ".\NUL"
# Exposing Attacking private registry Scenario
$POD_NAME = kubectl.exe get pods --namespace default -l "app=poor-registry" -o jsonpath="{.items[0].metadata.name}"
Start-Process -NoNewWindow -FilePath "C:\Program Files\Docker\Docker\resources\bin\kubectl.exe" -ArgumentList "port-forward $POD_NAME --address 0.0.0.0 1235:5000" -RedirectStandardError "C:\NUL" -RedirectStandardOutput ".\NUL"
# Exposing DoS resources Scenario
$POD_NAME = kubectl.exe get pods --namespace big-monolith -l "app=hunger-check" -o jsonpath="{.items[0].metadata.name}"
Start-Process -NoNewWindow -FilePath "C:\Program Files\Docker\Docker\resources\bin\kubectl.exe" -ArgumentList "--namespace big-monolith port-forward $POD_NAME --address 0.0.0.0 1236:8080" -RedirectStandardError "C:\NUL" -RedirectStandardOutput ".\NUL"
Write-Host "Visit http://127.0.0.1:1234 to get started with your Kubernetes Goat hacking!"