Hackin_K8s.pdf

Presented at ChCon 2021.

Kubernetes has emerged as the primary container orchestration system in modern cloud infrastructure. It’s a fast moving beast & there are always new things to learn. As a result of this, certain basic security misconfigurations are quite common.

In this talk, we will introduce the core concepts of Kubernetes for an unfamiliar technical audience, and highlight some common methods to compromise workloads and clusters.

Transcript

1. 1 H A C K I N ’ Y O U R F I R S T K 8 S C L U S T E R I N T R O T O C L O U D & C O N T A I N E R I N F R A S T R U C T U R E E X P L O I T A T I O N @ 0 x S h n i f f e r @ n f F r e n c h i e
2. 2 O V E R V I E W 0. See: Recursion 1. Intro 
 2. Kubernetes 101 
 3. Attacking K8S 4. Fixes
3. 3 I N T R O Who the hell are these people, and 
 why are they standing between us and the beer?
4. 4 $WHOAMI S A M “ F R E N C H I E ” S T E W A R T @ n f F r e n c h i e Infrastructure Security Tech Lead @ Brex #Hiring Cyber security P.B.S. #LookingForWork iFly instructor A B I G A I L J A S K A R I @ 0 x S h n i f f e r
5. S A M “ F R E N C H I E ” S T E W A R T @ n f F r e n c h i e Infrastructure Security Tech Lead @ Brex #Hiring 5 $WHOAMI Cyber security P.B.S. #LookingForWork iFly instructor A B I G A I L J A S K A R I @ 0 x S h n i f f e r
6. 6 $WHOAMI @ N F F R E N C H I E @ 0 X S H N I F F E R
7. 7 K U B E R N E T E S 1 0 1 • What is it? • Why are we here? • Architecture • Building Blocks
8. 8 “AN OPEN-SOURCE SYSTEM FOR AUTOMATING DEPLOYMENT, SCALING, AND MANAGEMENT OF CONTAINERIZED APPLICATIONS” H I S T O R Y O F K 8 S Internal code name: Borg. Originally developed to meet Google’s scale G O O G L E The leading container orchestration platform, won “the container wars” against Apache Mesos, DC/OS, Docker Swarm, Hashicorp Nomad, etc C O M M U N I T Y B .K. Handed over to the Cloud Native Computing Foundation & released open-source C N C F 2015 NOW
9. 9 Instead of running an application as a single process, an application is separated into smaller independent processes that each perform a specific function. MICROSERVICES C O N T A I N E R S 1 0 1 https://d1.awsstatic.com/Developer%20Marketing/containers/monolith_1-monolith-microservices.70b547e30e30b013051d58a93a6e35e77408a2a8.png
10. 10 Modular Resource efficient Resilient Highly Available MICROSERVICES C O N T A I N E R S 1 0 1
11. 11 CONTAINER HISTORY C O N T A I N E R I Z A T I O N Containers effectively de-dupe the operating system between apps.
12. 12 3 INGREDIENTS C O N T A I N E R I Z A T I O N Regardless of the container technology used, each container is created in the same way: Dockerfile, manifest YAML, etc. 1 . M A N I F E S T Docker Image, Application Container Image, etc. 2 . I M A G E Running context of Manifest + Image 3 . C O N T A I N E R
13. 13 “JUST, LIKE, WHY, DUDE? ” F R E N C H I E - E A R L I E R T H I S W E E K
14. 14 “WHAT PROBLEMS DOES THIS SOLVE? ” W H Y A R E W E H E R E ?
15. 15 BENEFITS OF K8S W H Y A R E W E H E R E ? Manually or automatically based on CPU utilisation or custom metrics. 
 M A S S I V E S C A L E Seamlessly deploy and roll out new versions of applications without downtime U P D A T E S / R O L L B A C K Automatically allows services to find & communicate with each other via an internal IP & DNS S E R V I C E D I S C O V E R Y Binpacking of applications to maximise usage of hardware CPU/Memory/etc R E S O U R C E U S A G E ReplicaSets and health checks to ensure that your apps stay running F A U LT T O L E R A N C E
16. 16 ARCHITCTURE K U B E R N E T E S 1 0 1 1. CONTROL PLANE 2. NODE PLANE 3. KUBERNETES OBJECTS B U I L D I N G B L O C K S 16
17. 17 K8S ARCHITECTURE
18. 18 • API Server • etcd • Scheduler • Controller Manager • Cloud Controller Manager C O M P O N E N T S CONTROL PLANE K 8 S A R C H I T E C T U R E
19. 19 • Kubelet • Kube-proxy • Container Runtime C O M P O N E N T S NODE PLANE K 8 S A R C H I T E C T U R E
20. 20 • Pods • Services • Service Accounts • Secrets C O M P O N E N T S K8S OBJECTS K 8 S A R C H I T E C T U R E
21. 21 Complexity == Attacker opportunity CONFUSED? T H E C O N S ? Good.
22. 22 A T T A C K I N G K 8 S Party time! Excellent!
23. 23 ATTACK CHAIN T H R E A T B U T T ™ ( R I P ) C Y B E R V I K I N G Recon E N U M E R A T I O N What access do I have? 
 What access do I want? P R I V E S C Start with a deployment I N I T I A L F O O T H O L D Cluster compromise, crush your enemies, see them driven before you. P E R S I S T E N C E
24. 24 kubeaudit, kubestriker, kubebench Need the address of the API Server 
 Super short upgrade lifecycles P L E N T Y O F T O O L S ENUMERATION W H A T A R E W E D E A L I N G W I T H ?
25. 25 https://github.com/genuinetools/ amicontained 
 RCE in applications Deployment via developers & CI Backdoored images/dependencies Stolen credentials (k8s user/service, SSH to nodes, etc) kubectl exec $POD INITIAL FOOTHOLD “ E X P L O I T A T I O N ”
26. 26 “Container breakouts” https://github.com/inguardians/peirates SA hijacking $ kubectl get secrets $ cat /var/run/secrets/kubernetes.io/ serviceaccount/token $ kubectl auth can-i --list 
 $ kubectl auth can-i --list --as system:serviceaccount:default:default W H A T D O I W A N T ? PRIVESC W H A T D O I H A V E ?
27. 27 “Container breakouts” https://github.com/inguardians/peirates SA hijacking $ kubectl get secrets $ cat /var/run/secrets/kubernetes.io/ serviceaccount/token $ kubectl auth can-i --list 
 $ kubectl auth can-i --list --as system:serviceaccount:default:default W H A T D O I W A N T ? PRIVESC W H A T D O I H A V E ?
28. 28 Malicious DaemonSets 
 Malicious CRDs https://raesene.github.io/blog/ 2021/11/01/fun-with-CRDs/ Malicious Admission Control to steal credentials & C2bernetes https://www.youtube.com/watch? v=auUgVullAWM N O W T H E F U N S T A R T S PERSISTENCE “ E X P L O I T A T I O N ”
29. 29 P R A C T I C E Y O U R P E W P E W 1. https://github.com/honk-ci/ honkctl 2. https://github.com/ madhuakula/kubernetes-goat
30. 30 F I X E S 1. Patch & Use EKS/GKE/AKS 2. k-rail / Admission Control 3. SLSA/SBOM 4. Audit2RBAC
31. 31 R E C A P 1. Intro 
 2. Kubernetes 101 
 3. Basic Attack Methodology 4. Fixes
32. 32 T H A N K S @ n f F r e n c h i e @ 0 x S h n i f f e r G r e e t z S I G - H O N K