diff --git a/src/modules/discovery/hosts.py b/src/modules/discovery/hosts.py index 9a400cc..7f1b103 100644 --- a/src/modules/discovery/hosts.py +++ b/src/modules/discovery/hosts.py @@ -13,14 +13,14 @@ from netifaces import AF_INET, ifaddresses, interfaces from ...core.events import handler from ...core.events.types import Event, NewHostEvent, Vulnerability -from ...core.types import Hunter +from ...core.types import Hunter, InformationDisclosure from ..hunting.aks import Azure class AzureMetadataApi(Vulnerability, Event): - """Access to Azure Metadata API exposes sensitive information about the machines associated with the cluster""" + """Access to the Azure Metadata API exposes sensitive information about the machines associated with the cluster""" def __init__(self, cidr): - Vulnerability.__init__(self, Azure, "Azure Metadata Exposure") + Vulnerability.__init__(self, Azure, "Azure Metadata Exposure", category=InformationDisclosure) self.cidr = cidr self.evidence = "cidr: {}".format(cidr) diff --git a/src/modules/hunting/aks.py b/src/modules/hunting/aks.py index 32d88ab..aa95ef6 100644 --- a/src/modules/hunting/aks.py +++ b/src/modules/hunting/aks.py @@ -7,16 +7,16 @@ from kubelet import ExposedRunHandler from ...core.events import handler from ...core.events.types import Event, Vulnerability -from ...core.types import Hunter, ActiveHunter, KubernetesCluster +from ...core.types import Hunter, ActiveHunter, KubernetesCluster, IdentityTheft class Azure(KubernetesCluster): """Azure Cluster""" name = "Azure" class AzureSpnExposure(Vulnerability, Event): - """By exposing the SPN, the attacker can gain access to the azure subscription""" + """The SPN is exposed, potentially allowing an attacker to gain access to the Azure subscription""" def __init__(self, container): - Vulnerability.__init__(self, Azure, "Azure SPN Exposure") + Vulnerability.__init__(self, Azure, "Azure SPN Exposure", category=IdentityTheft) self.container = container @handler.subscribe(ExposedRunHandler, predicate=lambda x: x.cloud=="Azure") diff --git a/src/modules/hunting/kubelet.py b/src/modules/hunting/kubelet.py index 5df08d5..3898b89 100644 --- a/src/modules/hunting/kubelet.py +++ b/src/modules/hunting/kubelet.py @@ -9,72 +9,66 @@ from __main__ import config from ...core.events import handler from ...core.events.types import Vulnerability, Event from ..discovery.kubelet import ReadOnlyKubeletEvent, SecureKubeletEvent -from ...core.types import Hunter, ActiveHunter, KubernetesCluster, Kubelet +from ...core.types import Hunter, ActiveHunter, KubernetesCluster, Kubelet, InformationDisclosure, RemoteCodeExec, AccessRisk urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) """ Vulnerabilities """ class ExposedPodsHandler(Vulnerability, Event): - """Exposes all complete PodSpecs bound to a node""" + """An attacker could view sensitive information about pods that are bound to a Node using the /pods endpoint""" def __init__(self): - Vulnerability.__init__(self, Kubelet, "Exposed /pods") + Vulnerability.__init__(self, Kubelet, "Exposed Pods", category=InformationDisclosure) class AnonymousAuthEnabled(Vulnerability, Event): - """Anonymous Auth to the kubelet, exposes secure access to all requests on the kubelet""" + """The kubelet is misconfigured, potentially allowing secure access to all requests on the kubelet, without the need to authenticate""" def __init__(self): - Vulnerability.__init__(self, Kubelet, "Anonymous Authentication") + Vulnerability.__init__(self, Kubelet, "Anonymous Authentication", category=RemoteCodeExec) class ExposedContainerLogsHandler(Vulnerability, Event): - """Outputs logs from a running container""" + """Output logs from a running container are using the exposed /containerLogs endpoint""" def __init__(self): - Vulnerability.__init__(self, Kubelet, "Exposed /containerLogs") - self.remediation="--enable-debugging-handlers=False On Kubelet" + Vulnerability.__init__(self, Kubelet, "Exposed Container Logs", category=InformationDisclosure) class ExposedRunningPodsHandler(Vulnerability, Event): - """Outputs a list of currently runnning pods, and some of their metadata""" + """Outputs a list of currently running pods, and some of their metadata, which can reveal sensitive information""" def __init__(self): - Vulnerability.__init__(self, Kubelet, "Exposed /runningpods") - self.remediation="--enable-debugging-handlers=False On Kubelet" + Vulnerability.__init__(self, Kubelet, "Exposed Running Pods", category=InformationDisclosure) class ExposedExecHandler(Vulnerability, Event): - """Opens a websocket that enables running and executing arbitrary commands on a container""" + """An attacker could run arbitrary commands on a container""" def __init__(self): - Vulnerability.__init__(self, Kubelet, "Exposed /exec") - self.remediation="--enable-debugging-handlers=False On Kubelet" + Vulnerability.__init__(self, Kubelet, "Exposed Exec On Container", category=RemoteCodeExec) class ExposedRunHandler(Vulnerability, Event): - """Allows remote arbitrary execution inside a container""" + """An attacker could run an arbitrary command inside a container""" def __init__(self): - Vulnerability.__init__(self, Kubelet, "Exposed /run") - self.remediation="--enable-debugging-handlers=False On Kubelet" + Vulnerability.__init__(self, Kubelet, "Exposed Run Inside Container", category=RemoteCodeExec) class ExposedPortForwardHandler(Vulnerability, Event): - """Setting a port forwaring rule on a pod""" + """An attacker could set port forwaring rule on a pod""" def __init__(self): - Vulnerability.__init__(self, Kubelet, "Exposed /portForward") - self.remediation="--enable-debugging-handlers=False On Kubelet" + Vulnerability.__init__(self, Kubelet, "Exposed Port Forward", category=RemoteCodeExec) class ExposedAttachHandler(Vulnerability, Event): - """Opens a websocket that enables running and executing arbitrary commands on a container""" + """Opens a websocket that could enable an attacker to attach to a running container""" def __init__(self): - Vulnerability.__init__(self, Kubelet, "Exposed /attach") - self.remediation="--enable-debugging-handlers=False On Kubelet" + Vulnerability.__init__(self, Kubelet, "Exposed Attaching To Container", category=RemoteCodeExec) class ExposedHealthzHandler(Vulnerability, Event): - """By accessing open /healthz handler, an attacker could get the cluster health state""" + """By accessing the open /healthz handler, an attacker could get the cluster health state without authenticating""" def __init__(self): - Vulnerability.__init__(self, Kubelet, "Cluster Health Disclosure") + Vulnerability.__init__(self, Kubelet, "Cluster Health Disclosure", category=InformationDisclosure) class K8sVersionDisclosure(Vulnerability, Event): - """Discloses the kubernetes version, exposed from a log on the /metrics endpoint""" + """The kubernetes version could be obtained from logs in the /metrics endpoint""" def __init__(self, version): - Vulnerability.__init__(self, Kubelet, "Version Disclosure") + Vulnerability.__init__(self, Kubelet, "K8s Version Disclosure", category=InformationDisclosure) self.evidence = version class PrivilegedContainers(Vulnerability, Event): - """A Privileged container on a node, can expose the node/cluster to unwanted root operations""" + """A Privileged container exist on a node. could expose the node/cluster to unwanted root operations""" def __init__(self, containers): - Vulnerability.__init__(self, KubernetesCluster, "Privileged Container") + Vulnerability.__init__(self, KubernetesCluster, "Privileged Container", category=AccessRisk) self.containers = containers self.evidence = "pod: {}, container: {}".format(containers[0][0], containers[0][1]) diff --git a/src/modules/hunting/proxy.py b/src/modules/hunting/proxy.py index 34c7151..cd372bc 100644 --- a/src/modules/hunting/proxy.py +++ b/src/modules/hunting/proxy.py @@ -6,20 +6,20 @@ import json from ...core.events import handler from ...core.events.types import Event, Vulnerability -from ...core.types import ActiveHunter, Hunter, KubernetesCluster +from ...core.types import ActiveHunter, Hunter, KubernetesCluster, InformationDisclosure from ..discovery.dashboard import KubeDashboardEvent from ..discovery.proxy import KubeProxyEvent """ Vulnerabilities """ class KubeProxyExposed(Vulnerability, Event): - """Exposes all oprations on the cluster""" + """All oprations on the cluster are exposed""" def __init__(self): - Vulnerability.__init__(self, KubernetesCluster, "Proxy Exposed") + Vulnerability.__init__(self, KubernetesCluster, "Proxy Exposed", category=InformationDisclosure) class K8sVersionDisclosure(Vulnerability, Event): - """Discloses the kubernetes version, exposed from kube-proxy""" + """The Kubernetes version is exposed from kube-proxy""" def __init__(self): - Vulnerability.__init__(self, KubernetesCluster, "Version Disclosure") + Vulnerability.__init__(self, KubernetesCluster, "K8s Version Disclosure", category=InformationDisclosure) class Service(Enum):