github/kube-hunter
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-hunter.git synced 2026-05-10 03:07:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into secrets-typo

Browse Source
This commit is contained in:
mcherny
2019-02-04 18:28:39 +02:00
committed by GitHub
parent 9d010d4798 8d367d1aa0
commit 4ddb163945
1 changed files with 25 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
src/modules/hunting/apiserver.py
View File

@@ -317,32 +317,33 @@ class AccessApiServerViaServiceAccountToken(Hunter):
def execute(self):
if self.get_service_account_token():
if self.access_api_server():
self.publish_event(ServerApiAccess(self.api_server_evidence))
self.get_service_account_token()
if self.get_all_namespaces():
self.publish_event(ListAllNamespaces(self.all_namespaces_names_evidence))
if self.access_api_server():
self.publish_event(ServerApiAccess(self.api_server_evidence))
if self.get_pods_list_under_requested_scope():
self.publish_event(ListPodUnderAllNamespaces(self.namespaces_and_their_pod_names))
else:
if self.get_pods_list_under_requested_scope(scope='namespaces/default'):
self.publish_event(ListPodUnderDefaultNamespace(self.namespaces_and_their_pod_names))
if self.get_all_namespaces():
self.publish_event(ListAllNamespaces(self.all_namespaces_names_evidence))
if self.get_all_roles():
self.publish_event(ListAllRoles(self.all_roles_names_evidence))
else:
if self.get_roles_under_default_namespace():
self.publish_event(ListAllRolesUnderDefaultNamespace(
if self.get_pods_list_under_requested_scope():
self.publish_event(ListPodUnderAllNamespaces(self.namespaces_and_their_pod_names))
else:
if self.get_pods_list_under_requested_scope(scope='namespaces/default'):
self.publish_event(ListPodUnderDefaultNamespace(self.namespaces_and_their_pod_names))
if self.get_all_roles():
self.publish_event(ListAllRoles(self.all_roles_names_evidence))
else:
if self.get_roles_under_default_namespace():
self.publish_event(ListAllRolesUnderDefaultNamespace(
self.roles_names_under_default_namespace_evidence))
if self.get_all_cluster_roles():
self.publish_event(ListAllClusterRoles(self.all_cluster_roles_names_evidence))
if self.get_all_cluster_roles():
self.publish_event(ListAllClusterRoles(self.all_cluster_roles_names_evidence))
# At this point we know we got the service_account_token, and we might got all of the namespaces
self.publish_event(ApiServerPassiveHunterFinished(self.all_namespaces_names_evidence,
self.service_account_token_evidence,
self.event.host, self.event.port))
# At this point we know we got the service_account_token, and we might got all of the namespaces
self.publish_event(ApiServerPassiveHunterFinished(self.all_namespaces_names_evidence,
self.service_account_token_evidence,
self.event.host, self.event.port))
# Active Hunter
@@ -385,8 +386,8 @@ class AccessApiServerViaServiceAccountTokenActive(ActiveHunter):
privileged_value = ',"securityContext":{"privileged":true}' if is_privileged else ''
json_pod = \
"""
{{"apiVersion": "v1",
{{"apiVersion": "v1",
"kind": "Pod",
"metadata": {{
"name": "{random_str}"
@@ -406,7 +407,7 @@ class AccessApiServerViaServiceAccountTokenActive(ActiveHunter):
]
}}
}}
""".format(random_str=(str(uuid.uuid4()))[0:5], is_privileged_flag=privileged_value)
headers = {
'Content-Type': 'application/json',