gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-02-04 19:11:41 -08:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['src/pentesting-cloud/kubernetes-security/kubernetes-pivotin

Browse Source
This commit is contained in:
Translator
2025-01-02 21:34:56 +00:00
parent 5669651b7e
commit 163762ad5f
7 changed files with 189 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
book.toml
View File

@@ -22,6 +22,7 @@ after = ["links"]
[preprocessor.hacktricks]
command = "python3 ./hacktricks-preprocessor.py"
env = "prod"
[output.html]
additional-css = ["theme/pagetoc.css", "theme/tabs.css"]

18
hacktricks-preprocessor.py
View File

@@ -30,14 +30,16 @@ def ref(matchobj):
href = matchobj.groups(0)[0].strip()
title = href
if href.startswith("http://") or href.startswith("https://"):
# pass
try:
raw_html = str(urlopen(Request(href, headers={'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0'})).read())
match = re.search('<title>(.*?)</title>', raw_html)
title = match.group(1) if match else href
except Exception as e:
logger.debug(f'Error opening URL {href}: {e}')
pass #nDont stop on broken link
if context['config']['preprocessor']['hacktricks']['env'] == 'dev':
pass
else:
try:
raw_html = str(urlopen(Request(href, headers={'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0'})).read())
match = re.search('<title>(.*?)</title>', raw_html)
title = match.group(1) if match else href
except Exception as e:
logger.debug(f'Error opening URL {href}: {e}')
pass #nDont stop on broken link
else:
try:
if href.endswith("/"):

40
src/pentesting-cloud/kubernetes-security/kubernetes-pivoting-to-clouds.md
View File

@@ -27,7 +27,7 @@ Njia ya kutoa ufikiaji kwa GSA kwa GKE cluser ni kwa kuziunganisha kwa njia hii:
```bash
Copy codekubectl create serviceaccount <service-account-name>
```
- Unda Siri ya Kubernetes inayoshikilia hati za akaunti ya huduma ya GCP unayotaka kutoa ruhusa kwa klasta ya GKE. Unaweza kufanya hivi kwa kutumia zana ya amri ya `gcloud`, kama inavyoonyeshwa katika mfano ufuatao:
- Unda Siri ya Kubernetes inayoshikilia hati za akaunti ya huduma ya GCP unayotaka kutoa ufikiaji kwa klasta ya GKE. Unaweza kufanya hivyo kwa kutumia zana ya amri ya `gcloud`, kama inavyoonyeshwa katika mfano ufuatao:
```bash
Copy codegcloud iam service-accounts keys create <key-file-name>.json \
--iam-account <gcp-service-account-email>
@@ -40,26 +40,26 @@ Copy codekubectl annotate serviceaccount <service-account-name> \
iam.gke.io/gcp-service-account=<gcp-service-account-email>
```
> [!WARNING]
> Katika **hatua ya pili** ilipangwa **siri za GSA kama siri ya KSA**. Kisha, ikiwa unaweza **kusoma siri hiyo** kutoka **ndani** ya **GKE** klasta, unaweza **kuinua hadi akaunti hiyo ya huduma ya GCP**.
> Katika **hatua ya pili** ilipangwa **akili za GSA kama siri ya KSA**. Kisha, ikiwa unaweza **kusoma hiyo siri** kutoka **ndani** ya **GKE** klasta, unaweza **kuinua hadi hiyo GCP huduma akaunti**.
### Utambulisho wa Kazi ya GKE
### GKE Workload Identity
Kwa Utambulisho wa Kazi, tunaweza kuunda [Kubernetes service account](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) ili kutenda kama [Google service account](https://cloud.google.com/iam/docs/understanding-service-accounts). Pods zinazotembea na akaunti ya huduma ya Kubernetes zitauthenticate kiotomatiki kama akaunti ya huduma ya Google wanapofikia Google Cloud APIs.
Kwa Workload Identity, tunaweza kuunda [Kubernetes service account](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) ili kutenda kama [Google service account](https://cloud.google.com/iam/docs/understanding-service-accounts). Pods zinazotembea na Kubernetes service account zitauthenticate kiotomatiki kama Google service account wanapofikia Google Cloud APIs.
Mfululizo wa **hatua za kwanza** za kuwezesha tabia hii ni **kuwezesha Utambulisho wa Kazi katika GCP** ([**hatua**](https://medium.com/zeotap-customer-intelligence-unleashed/gke-workload-identity-a-secure-way-for-gke-applications-to-access-gcp-services-f880f4e74e8c)) na kuunda GCP SA unayotaka k8s kuiga.
Mfululizo wa **hatua za kwanza** za kuwezesha tabia hii ni **kuwezesha Workload Identity katika GCP** ([**hatua**](https://medium.com/zeotap-customer-intelligence-unleashed/gke-workload-identity-a-secure-way-for-gke-applications-to-access-gcp-services-f880f4e74e8c)) na kuunda GCP SA unayotaka k8s kuiga.
- **Washa Utambulisho wa Kazi** kwenye klasta mpya
- **Washa Workload Identity** kwenye klasta mpya
```bash
gcloud container clusters update <cluster_name> \
--region=us-central1 \
--workload-pool=<project-id>.svc.id.goog
```
- **Unda/Sasisha nodepool mpya** (Vikundi vya Autopilot havihitaji hii)
- **Unda/Sasisha nodepool mpya** (Vikundi vya Autopilot havihitaji hili)
```bash
# You could update instead of create
gcloud container node-pools create <nodepoolname> --cluster=<cluser_name> --workload-metadata=GKE_METADATA --region=us-central1
```
- Unda **Akaunti ya Huduma ya GCP ili kujifanya** kutoka K8s yenye ruhusa za GCP:
- Unda **GCP Service Account ya kuiga** kutoka K8s yenye ruhusa za GCP:
```bash
# Create SA called "gsa2ksa"
gcloud iam service-accounts create gsa2ksa --project=<project-id>
@@ -126,7 +126,7 @@ gcloud auth activate-service-account --key-file=/var/run/secrets/google/service-
> Kama mshambuliaji ndani ya K8s unapaswa **kutafuta SAs** zenye **`iam.gke.io/gcp-service-account` annotation** kwani hiyo inaonyesha kwamba SA inaweza kufikia kitu katika GCP. Chaguo lingine lingekuwa kujaribu kutumia kila KSA katika klasta na kuangalia kama ina ufikiaji.\
> Kutoka GCP daima ni ya kuvutia kuorodhesha viunganishi na kujua **ni ufikiaji gani unatoa kwa SAs ndani ya Kubernetes**.
Hii ni script ya urahisi **kuzunguka juu ya maelezo ya pods** **ikiangalia** hiyo **annotation**:
Hii ni script ya urahisi **kuzunguka juu ya maelezo yote ya pods** **ikiangalia** hiyo **annotation**:
```bash
for ns in `kubectl get namespaces -o custom-columns=NAME:.metadata.name | grep -v NAME`; do
for pod in `kubectl get pods -n "$ns" -o custom-columns=NAME:.metadata.name | grep -v NAME`; do
@@ -141,9 +141,9 @@ done | grep -B 1 "gcp-service-account"
### Kiam & Kube2IAM (IAM role for Pods) <a href="#workflow-of-iam-role-for-service-accounts" id="workflow-of-iam-role-for-service-accounts"></a>
Njia (ya zamani) ya kutoa IAM Roles kwa Pods ni kutumia [**Kiam**](https://github.com/uswitch/kiam) au [**Kube2IAM**](https://github.com/jtblin/kube2iam) **server.** Kimsingi unahitaji kuendesha **daemonset** katika klasta yako yenye **aina ya IAM role yenye mamlaka.** Hii daemonset itakuwa ile itakayotoa ufikiaji wa IAM roles kwa pods zinazohitaji.
Njia (ya zamani) ya kutoa IAM Roles kwa Pods ni kutumia [**Kiam**](https://github.com/uswitch/kiam) au [**Kube2IAM**](https://github.com/jtblin/kube2iam) **server.** Kimsingi, unahitaji kuendesha **daemonset** katika klasta yako yenye **aina ya IAM role yenye mamlaka.** Hii daemonset itakuwa ile itakayotoa ufikiaji wa IAM roles kwa pods zinazohitaji.
Kwanza kabisa unahitaji kuunda **ni roles zipi zinaweza kufikiwa ndani ya namespace**, na unafanya hivyo kwa kutumia annotation ndani ya kitu cha namespace:
Kwanza kabisa, unahitaji kusanidi **ni roles zipi zinaweza kufikiwa ndani ya namespace**, na unafanya hivyo kwa kutumia annotation ndani ya kitu cha namespace:
```yaml:Kiam
kind: Namespace
metadata:
@@ -161,7 +161,7 @@ iam.amazonaws.com/allowed-roles: |
["role-arn"]
name: default
```
Mara tu namespace imewekwa na majukumu ya IAM ambayo Pods zinaweza kuwa nayo unaweza **kuonyesha jukumu unalotaka kwenye kila ufafanuzi wa pod kwa kitu kama**:
Mara tu namespace imewekwa na majukumu ya IAM, Pods zinaweza kuwa na **onyesha jukumu unalotaka kwenye kila ufafanuzi wa pod kwa kitu kama**:
```yaml:Kiam & Kube2iam
kind: Pod
metadata:
@@ -171,7 +171,7 @@ annotations:
iam.amazonaws.com/role: reportingdb-reader
```
> [!WARNING]
> Kama mshambuliaji, ikiwa **utapata hizi alama** katika pods au namespaces au seva ya kiam/kube2iam inayoendesha (katika kube-system labda) unaweza **kujifanya kila r**oli ambayo tayari **inatumiwa na pods** na zaidi (ikiwa una ufikiaji wa akaunti ya AWS orodhesha majukumu).
> Kama mshambuliaji, ikiwa **utapata hizi alama** katika pods au namespaces au seva ya kiam/kube2iam inayoendesha (katika kube-system labda) unaweza **kujifanya kuwa kila r**oli ambayo tayari **inatumiwa na pods** na zaidi (ikiwa una ufikiaji wa akaunti ya AWS orodhesha majukumu).
#### Unda Pod na IAM Role
@@ -221,7 +221,7 @@ Ili **kupata aws kwa kutumia token** kutoka `/var/run/secrets/eks.amazonaws.com/
aws sts assume-role-with-web-identity --role-arn arn:aws:iam::123456789098:role/EKSOIDCTesting --role-session-name something --web-identity-token file:///var/run/secrets/eks.amazonaws.com/serviceaccount/token
```
> [!WARNING]
> Kama mshambuliaji, ikiwa unaweza kuhesabu klasta ya K8s, angalia **akaunti za huduma zenye anoteshoni hiyo** ili **kuinua hadi AWS**. Ili kufanya hivyo, tu **exec/create** **pod** ukitumia moja ya **akaunti za huduma zenye mamlaka** na kuiba tokeni.
> Kama mshambuliaji, ikiwa unaweza kuhesabu klasta ya K8s, angalia **akaunti za huduma zenye anoteshoni hiyo** ili **kuinua hadi AWS**. Kufanya hivyo, tu **exec/create** **pod** ukitumia moja ya **akaunti za huduma zenye mamlaka** na kuiba tokeni.
>
> Zaidi ya hayo, ikiwa uko ndani ya pod, angalia kwa mabadiliko ya mazingira kama **AWS_ROLE_ARN** na **AWS_WEB_IDENTITY_TOKEN.**
@@ -234,7 +234,7 @@ aws sts assume-role-with-web-identity --role-arn arn:aws:iam::123456789098:role/
../aws-security/aws-basic-information/aws-federation-abuse.md
{{#endref}}
### Pata Pods a SAs zenye Majukumu ya IAM katika Klasta
### Pata Pods a SAs zenye IAM Roles katika Klasta
Hii ni skripti ya urahisi **kuzunguka juu ya pods zote na maelezo ya sas** **ikiangalia** anoteshoni hiyo:
```bash
@@ -255,17 +255,17 @@ done | grep -B 1 "amazonaws.com"
```
### Node IAM Role
Sehemu iliyopita ilikuwa kuhusu jinsi ya kuiba IAM Roles kwa kutumia pods, lakini kumbuka kwamba **Node ya** K8s cluster itakuwa **kigezo ndani ya wingu**. Hii inamaanisha kwamba Node ina uwezekano mkubwa wa **kuwa na IAM role mpya ambayo unaweza kuiba** (_kumbuka kwamba kwa kawaida nodes zote za K8s cluster zitakuwa na IAM role sawa, hivyo huenda isiwe na maana kujaribu kuangalia kwenye kila node_).
Sehemu iliyopita ilikuwa kuhusu jinsi ya kuiba IAM Roles kwa kutumia pods, lakini kumbuka kwamba **Node ya** K8s cluster itakuwa **kifaa ndani ya wingu**. Hii ina maana kwamba Node ina uwezekano mkubwa wa **kuwa na IAM role mpya ambayo unaweza kuiba** (_kumbuka kwamba kwa kawaida nodes zote za K8s cluster zitakuwa na IAM role sawa, hivyo huenda isiwe na maana kujaribu kuangalia kwenye kila node_).
Hata hivyo, kuna hitaji muhimu la kufikia metadata endpoint kutoka kwa node, unahitaji kuwa kwenye node (ssh session?) au angalau kuwa na mtandao sawa:
Hata hivyo, kuna hitaji muhimu ili kufikia metadata endpoint kutoka kwa node, unahitaji kuwa kwenye node (ssh session?) au angalau kuwa na mtandao sawa:
```bash
kubectl run NodeIAMStealer --restart=Never -ti --rm --image lol --overrides '{"spec":{"hostNetwork": true, "containers":[{"name":"1","image":"alpine","stdin": true,"tty":true,"imagePullPolicy":"IfNotPresent"}]}}'
```
### Pora Token ya IAM Role
### Kununua Token ya IAM Role
Kabla tulijadili jinsi ya **kuunganisha IAM Roles na Pods** au hata jinsi ya **kutoroka hadi Node ili kupora IAM Role** ambayo mfano umeunganishwa nayo.
Awali tulijadili jinsi ya **kuunganisha IAM Roles kwa Pods** au hata jinsi ya **kutoroka hadi Node ili kununua IAM Role** ambayo mfano umeunganishwa nayo.
Unaweza kutumia skripti ifuatayo **kupora** **IAM role credentials** zako mpya za kazi ngumu:
Unaweza kutumia skripti ifuatayo ili **kununua** akiba yako mpya ya **IAM role credentials**:
```bash
IAM_ROLE_NAME=$(curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ 2>/dev/null || wget http://169.254.169.254/latest/meta-data/iam/security-credentials/ -O - 2>/dev/null)
if [ "$IAM_ROLE_NAME" ]; then

56
theme/book.js
View File

@@ -590,6 +590,62 @@ function playground_text(playground, hidden = true) {
});
})();
(function menubarLanguage() {
var menubarLanguageToggleButton = document.getElementById('menubar-languages-toggle');
var menubarLanguagePopup = document.getElementById('menubar-languages-popup');
var languageButtons = menubarLanguagePopup.querySelectorAll('.menu-bar-link');
function showLanguage() {
menubarLanguagePopup.style.display = 'flex';
menubarLanguageToggleButton.setAttribute('aria-expanded', true);
}
function hideLanguage() {
menubarLanguagePopup.style.display = 'none';
menubarLanguageToggleButton.setAttribute('aria-expanded', false);
menubarLanguageToggleButton.focus();
}
menubarLanguageToggleButton.addEventListener('click', function () {
if (menubarLanguagePopup.style.display === 'flex') {
hideLanguage();
} else {
showLanguage();
}
});
menubarLanguagePopup.addEventListener('focusout', function(e) {
// e.relatedTarget is null in Safari and Firefox on macOS (see workaround below)
if (!!e.relatedTarget && !menubarLanguageToggleButton.contains(e.relatedTarget) && !menubarLanguagePopup.contains(e.relatedTarget)) {
hideLanguage();
}
});
// Should not be needed, but it works around an issue on macOS & iOS: https://github.com/rust-lang/mdBook/issues/628
document.addEventListener('click', function(e) {
if (menubarLanguagePopup.style.display === 'block' && !menubarLanguageToggleButton.contains(e.target) && !menubarLanguagePopup.contains(e.target)) {
hideLanguage();
}
});
languageButtons.forEach((btn) => {
btn.addEventListener('click', function(e) {
const regex = /(?:(?:\/)+(?<lang>[a-z]{2}(?=\/|$)))?(?<path>(?:\/)*.*)?/g
var match = regex.exec(window.location.pathname)
var path = match.groups.path
console.log(`Path: ${path} ${typeof path}`)
const lang = match.groups.lang
console.log(`Lang: ${lang}`)
window.location = `/${e.target.id}${path}${window.location.hash}`
});
})
})();
(function chapterNavigation() {
document.addEventListener('keydown', function (e) {
if (e.altKey || e.ctrlKey || e.metaKey || e.shiftKey) { return; }

53
theme/css/chrome.css
View File

@@ -83,6 +83,13 @@ body.sidebar-visible #menu-bar {
}
}
.right-buttons .icons {
display: flex;
flex-direction: row;
flex-wrap: wrap;
column-gap: 0.5rem;
}
.icon-button {
border: none;
background: var(--bg);
@@ -138,11 +145,13 @@ body.sidebar-visible #menu-bar {
}
/* Collapse Menu Popup */
#menubar-collapse-toggle {
position: relative;
}
#menubar-collapse-popup {
position: absolute;
right: 30px;
top: var(--menu-bar-height);
right: 0px;
top: 35px;
z-index: 105;
border-radius: 5px;
font-size: 14px;
@@ -172,6 +181,44 @@ body.sidebar-visible #menu-bar {
background-color: var(--theme-hover);
}
/* Languages Menu Popup */
#menubar-languages-toggle {
position: relative;
}
#menubar-languages-popup {
position: absolute;
right: 0px;
top: 35px;
z-index: 105;
border-radius: 5px;
font-size: 14px;
color: var(--fg);
background: var(--bg);
border: 1px solid var(--table-border-color);
margin: 0;
padding: 0px;
display: none;
flex-direction: column;
max-height: 300px;
width: 150px;
overflow: scroll;
}
#menubar-languages-popup .menu-bar-link {
border: 0;
margin: 0;
padding: 8px 20px;
line-height: 25px;
white-space: nowrap;
text-align: start;
cursor: pointer;
color: inherit;
background: inherit;
font-size: inherit;
}
#menubar-languages-popup .menu-bar-link:hover {
background-color: var(--theme-hover);
}
.left-buttons {
display: flex;

78
theme/index.hbs
View File

@@ -144,34 +144,60 @@
<div class="right-buttons">
<div id="menubar-collapse">
<a class="menu-bar-link" href="https://training.hacktricks.xyz" target="_blank">
Hacktricks Training
</a>
<a class="menu-bar-link" href="https://twitter.com/hacktricks_live" target="_blank">
Twitter
</a>
<a class="menu-bar-link" href="https://www.linkedin.com/company/hacktricks" target="_blank">
Linkedin
</a>
<a class="menu-bar-link" href="https://github.com/sponsors/carlospolop" target="_blank">
Sponsor
</a>
</div>
<button id="menubar-collapse-toggle" class="icon-button" type="button" title="Toggle menu bar" aria-label="Toggle Menu bar" aria-expanded="false" aria-controls="collapse">
<i class="fa fa-ellipsis-h"></i>
</button>
<div id="menubar-collapse-popup" class="menubar-collapse-popup" aria-label="Menu" role="menu">
<a href="https://training.hacktricks.xyz" target="_blank" role="menuitem" class="menu-bar-link">Hacktricks Training</a>
<a href="https://twitter.com/hacktricks_live" target="_blank" role="menuitem" class="menu-bar-link">Twitter</a>
<a href="https://www.linkedin.com/company/hacktricks" target="_blank" role="menuitem" class="menu-bar-link">Linkedin</a>
<a href="https://github.com/sponsors/carlospolop" target="_blank" role="menuitem" class="menu-bar-link">Sponsor</a>
<a class="menu-bar-link" href="https://training.hacktricks.xyz" target="_blank">
Hacktricks Training
</a>
<a class="menu-bar-link" href="https://twitter.com/hacktricks_live" target="_blank">
Twitter
</a>
<a class="menu-bar-link" href="https://www.linkedin.com/company/hacktricks" target="_blank">
Linkedin
</a>
<a class="menu-bar-link" href="https://github.com/sponsors/carlospolop" target="_blank">
Sponsor
</a>
</div>
<div class="icons">
<div id="menubar-collapse-toggle" class="icon-button" type="button" title="Toggle menu bar" aria-label="Toggle Menu bar" aria-expanded="false" aria-controls="collapse">
<i class="fa fa-ellipsis-h"></i>
<div id="menubar-collapse-popup" class="menubar-collapse-popup" aria-label="Menu" role="menu">
<a href="https://training.hacktricks.xyz" target="_blank" role="menuitem" class="menu-bar-link">Hacktricks Training</a>
<a href="https://twitter.com/hacktricks_live" target="_blank" role="menuitem" class="menu-bar-link">Twitter</a>
<a href="https://www.linkedin.com/company/hacktricks" target="_blank" role="menuitem" class="menu-bar-link">Linkedin</a>
<a href="https://github.com/sponsors/carlospolop" target="_blank" role="menuitem" class="menu-bar-link">Sponsor</a>
</div>
</div>
{{#if search_enabled}}
<button id="search-toggle" class="icon-button" type="button" title="Search. (Shortkey: s)" aria-label="Toggle Searchbar" aria-expanded="false" aria-keyshortcuts="S" aria-controls="searchbar">
<i class="fa fa-search"></i>
</button>
{{/if}}
{{#if search_enabled}}
<button id="search-toggle" class="icon-button" type="button" title="Search. (Shortkey: s)" aria-label="Toggle Searchbar" aria-expanded="false" aria-keyshortcuts="S" aria-controls="searchbar">
<i class="fa fa-search"></i>
</button>
{{/if}}
<div id="menubar-languages-toggle" class="icon-button" type="button" title="Translations" aria-label="Toggle Tanslations" aria-expanded="false" aria-controls="translations">
<i class="fa fa-globe"></i>
<div id="menubar-languages-popup" class="menubar-languages-popup" aria-label="Language menu" role="language menu">
<button id="en" role="menuitem" class="menu-bar-link">English</button>
<button id="es" role="menuitem" class="menu-bar-link">Spanish</button>
<button id="fr" role="menuitem" class="menu-bar-link">French</button>
<button id="de" role="menuitem" class="menu-bar-link">German</button>
<button id="el" role="menuitem" class="menu-bar-link">Greek</button>
<button id="hi" role="menuitem" class="menu-bar-link">Hindi</button>
<button id="it" role="menuitem" class="menu-bar-link">Italian</button>
<button id="ja" role="menuitem" class="menu-bar-link">Japanese</button>
<button id="ko" role="menuitem" class="menu-bar-link">Korean</button>
<button id="pl" role="menuitem" class="menu-bar-link">Polish</button>
<button id="pt" role="menuitem" class="menu-bar-link">Portuguese</button>
<button id="sr" role="menuitem" class="menu-bar-link">Serbian</button>
<button id="sw" role="menuitem" class="menu-bar-link">Swahili</button>
<button id="tr" role="menuitem" class="menu-bar-link">Turkish</button>
<button id="uk" role="menuitem" class="menu-bar-link">Ukrainian</button>
<button id="af" role="menuitem" class="menu-bar-link">Afrikaans</button>
<button id="zh" role="menuitem" class="menu-bar-link">Chinese</button>
</div>
</div>
</div>
{{#if print_enable}}
<a href="{{ path_to_root }}print.html" title="Print this book" aria-label="Print this book">

2
theme/sponsor.js
View File

@@ -19,13 +19,11 @@
try {
const response = await fetch(url, { method: "GET" })
if (!response.ok) {
console.log(response)
throw new Error(`Response status: ${response.status}`)
}
const json = await response.json()
var sponsor = json.sponsor
console.log("boop", sponsor)
sponsorImg.src = sponsor.image_url
sponsorTitle.textContent = sponsor.name
sponsorDescription.innerHTML = sponsor.description