Class: Msf::Exploit::Remote::HTTP::Kubernetes::Client

Inherits:
Object
  • Object
show all
Defined in:
lib/msf/core/exploit/remote/http/kubernetes/client.rb

Defined Under Namespace

Classes: ExecChannel

Constant Summary collapse

USER_AGENT = 
'kubectl/v1.22.2 (linux/amd64) kubernetes/8b5a191'.freeze

Instance Method Summary collapse

Constructor Details

#initialize(config) ⇒ Client

Returns a new instance of Client.



45
46
47
48
 
# File 'lib/msf/core/exploit/remote/http/kubernetes/client.rb', line 45

def initialize(config)
  @http_client = config.fetch(:http_client)
  @token = config[:token]
end

Instance Method Details

#create_pod(data, namespace, options = {}) ⇒ Object 



225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
 
# File 'lib/msf/core/exploit/remote/http/kubernetes/client.rb', line 225

def create_pod(data, namespace, options = {})
  res, json = call_api(
    {
      'method' => 'POST',
      'uri' => http_client.normalize_uri("/api/v1/namespaces/#{namespace}/pods"),
      'data' => JSON.pretty_generate(data)
    },
    options
  )

  if res.code != 201
    raise Kubernetes::Error::UnexpectedStatusCode, res: res
  end

  json
end

#delete_pod(name, namespace, options = {}) ⇒ Object 



242
243
244
245
246
247
248
249
250
251
252
253
 
# File 'lib/msf/core/exploit/remote/http/kubernetes/client.rb', line 242

def delete_pod(name, namespace, options = {})
  _res, json = call_api(
    {
      'method' => 'DELETE',
      'uri' => http_client.normalize_uri("/api/v1/namespaces/#{namespace}/pods/#{name}"),
      'headers' => {}
    },
    options
  )

  json
end

#exec_pod(name, namespace, command, options = {}) ⇒ Object

rubocop:disable Style/DoubleNegation



51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
 
# File 'lib/msf/core/exploit/remote/http/kubernetes/client.rb', line 51

def exec_pod(name, namespace, command, options = {})
  options = {
    'stdin' => false,
    'stdout' => false,
    'stderr' => false,
    'tty' => false
  }.merge(options)

  # while kubectl uses SPDY/3.1, the Python client uses WebSockets over HTTP/1.1
  # see: https://github.com/kubernetes/kubernetes/issues/7452
  websocket = http_client.connect_ws(
    request_options(
      {
        'method' => 'GET',
        'uri' => http_client.normalize_uri("/api/v1/namespaces/#{namespace}/pods/#{name}/exec"),
        'query' => URI.encode_www_form(
          {
            'command' => command,
            'stdin' => !!options.delete('stdin'),
            'stdout' => !!options.delete('stdout'),
            'stderr' => !!options.delete('stderr'),
            'tty' => !!options.delete('tty')
          }
        ),
        'headers' => {
          'Sec-Websocket-Protocol' => 'v4.channel.k8s.io'
        }
      },
      options
    )
  )

  websocket
end

#exec_pod_capture(name, namespace, command, options = {}, &block) ⇒ Object

rubocop:enable Style/DoubleNegation



87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
 
# File 'lib/msf/core/exploit/remote/http/kubernetes/client.rb', line 87

def exec_pod_capture(name, namespace, command, options = {}, &block)
  websocket = exec_pod(name, namespace, command, options)
  return nil if websocket.nil?

  result = { error: {}, stdout: '', stderr: '' }
  websocket.wsloop do |channel_data, _data_type|
    next if channel_data.blank?

    channel = channel_data[0].ord
    channel_data = channel_data[1..-1]
    case channel
    when EXEC_CHANNEL_STDOUT
      result[:stdout] << channel_data
      block.call(channel_data, nil) if block_given?
    when EXEC_CHANNEL_STDERR
      result[:stderr] << channel_data
      block.call(nil, channel_data) if block_given?
    when EXEC_CHANNEL_ERROR
      result[:error] = JSON(channel_data)
    end
  end

  result
end

#get_namespace(namespace, options = {}) ⇒ Object 



189
190
191
192
193
194
195
196
197
198
199
 
# File 'lib/msf/core/exploit/remote/http/kubernetes/client.rb', line 189

def get_namespace(namespace, options = {})
  _res, json = call_api(
    {
      'method' => 'GET',
      'uri' => http_client.normalize_uri("/api/v1/namespaces/#{namespace}")
    },
    options
  )

  json
end

#get_pod(pod, namespace, options = {}) ⇒ Object 



124
125
126
127
128
129
130
131
132
133
134
 
# File 'lib/msf/core/exploit/remote/http/kubernetes/client.rb', line 124

def get_pod(pod, namespace, options = {})
  _res, json = call_api(
    {
      'method' => 'GET',
      'uri' => http_client.normalize_uri("/api/v1/namespaces/#{namespace}/pods/#{pod}")
    },
    options
  )

  json
end

#get_secret(secret, namespace, options = {}) ⇒ Object 



165
166
167
168
169
170
171
172
173
174
175
 
# File 'lib/msf/core/exploit/remote/http/kubernetes/client.rb', line 165

def get_secret(secret, namespace, options = {})
  _res, json = call_api(
    {
      'method' => 'GET',
      'uri' => http_client.normalize_uri("/api/v1/namespaces/#{namespace}/secrets/#{secret}")
    },
    options
  )

  json
end

#get_version(options = {}) ⇒ Object 



112
113
114
115
116
117
118
119
120
121
122
 
# File 'lib/msf/core/exploit/remote/http/kubernetes/client.rb', line 112

def get_version(options = {})
  _res, json = call_api(
    {
      'method' => 'GET',
      'uri' => http_client.normalize_uri("/version")
    },
    options
  )

  json
end

#list_auth(namespace, options = {}) ⇒ Object 



136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
 
# File 'lib/msf/core/exploit/remote/http/kubernetes/client.rb', line 136

def list_auth(namespace, options = {})
  data = {
    kind: "SelfSubjectRulesReview",
    "apiVersion": "authorization.k8s.io/v1",
    "metadata": {
      "creationTimestamp": nil
    },
    "spec": {
      "namespace": namespace
    },
    "status": {
      "resourceRules": nil,
      "nonResourceRules": nil,
      "incomplete": false
    }
  }

  _res, json = call_api(
    {
      'method' => 'POST',
      'uri' => http_client.normalize_uri('/apis/authorization.k8s.io/v1/selfsubjectrulesreviews'),
      'data' => JSON.pretty_generate(data)
    },
    options
  )

  json
end

#list_namespaces(options = {}) ⇒ Object 



201
202
203
204
205
206
207
208
209
210
211
 
# File 'lib/msf/core/exploit/remote/http/kubernetes/client.rb', line 201

def list_namespaces(options = {})
  _res, json = call_api(
    {
      'method' => 'GET',
      'uri' => http_client.normalize_uri('/api/v1/namespaces')
    },
    options
  )

  json
end

#list_pods(namespace, options = {}) ⇒ Object 



213
214
215
216
217
218
219
220
221
222
223
 
# File 'lib/msf/core/exploit/remote/http/kubernetes/client.rb', line 213

def list_pods(namespace, options = {})
  _res, json = call_api(
    {
      'method' => 'GET',
      'uri' => http_client.normalize_uri("/api/v1/namespaces/#{namespace}/pods")
    },
    options
  )

  json
end

#list_secrets(namespace, options = {}) ⇒ Object 



177
178
179
180
181
182
183
184
185
186
187
 
# File 'lib/msf/core/exploit/remote/http/kubernetes/client.rb', line 177

def list_secrets(namespace, options = {})
  _res, json = call_api(
    {
      'method' => 'GET',
      'uri' => http_client.normalize_uri("/api/v1/namespaces/#{namespace}/secrets")
    },
    options
  )

  json
end