mirror of
https://github.com/aquasecurity/kube-hunter.git
synced 2026-03-31 15:47:06 +00:00
Compare commits
1 Commits
bugfix/fix
...
bugfix/clo
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
6808adfe94 |
@@ -129,15 +129,15 @@ class FromPodHostDiscovery(Discovery):
|
|||||||
self.publish_event(HostScanEvent())
|
self.publish_event(HostScanEvent())
|
||||||
else:
|
else:
|
||||||
# Discover cluster subnets, we'll scan all these hosts
|
# Discover cluster subnets, we'll scan all these hosts
|
||||||
cloud = None
|
cloud, subnets = None, list()
|
||||||
if self.is_azure_pod():
|
if self.is_azure_pod():
|
||||||
subnets, cloud = self.azure_metadata_discovery()
|
subnets, cloud = self.azure_metadata_discovery()
|
||||||
elif self.is_aws_pod_v1():
|
elif self.is_aws_pod_v1():
|
||||||
subnets, cloud = self.aws_metadata_v1_discovery()
|
subnets, cloud = self.aws_metadata_v1_discovery()
|
||||||
elif self.is_aws_pod_v2():
|
elif self.is_aws_pod_v2():
|
||||||
subnets, cloud = self.aws_metadata_v2_discovery()
|
subnets, cloud = self.aws_metadata_v2_discovery()
|
||||||
else:
|
|
||||||
subnets = self.gateway_discovery()
|
subnets += self.gateway_discovery()
|
||||||
|
|
||||||
should_scan_apiserver = False
|
should_scan_apiserver = False
|
||||||
if self.event.kubeservicehost:
|
if self.event.kubeservicehost:
|
||||||
@@ -221,19 +221,27 @@ class FromPodHostDiscovery(Discovery):
|
|||||||
"http://169.254.169.254/latest/meta-data/mac",
|
"http://169.254.169.254/latest/meta-data/mac",
|
||||||
timeout=config.network_timeout,
|
timeout=config.network_timeout,
|
||||||
).text
|
).text
|
||||||
|
logger.debug(f"Extracted mac from aws's metadata v1: {mac_address}")
|
||||||
|
|
||||||
cidr = requests.get(
|
cidr = requests.get(
|
||||||
f"http://169.254.169.254/latest/meta-data/network/interfaces/macs/{mac_address}/subnet-ipv4-cidr-block",
|
f"http://169.254.169.254/latest/meta-data/network/interfaces/macs/{mac_address}/subnet-ipv4-cidr-block",
|
||||||
timeout=config.network_timeout,
|
timeout=config.network_timeout,
|
||||||
).text.split("/")
|
).text
|
||||||
|
logger.debug(f"Trying to extract cidr from aws's metadata v1: {cidr}")
|
||||||
|
|
||||||
|
try:
|
||||||
|
cidr = cidr.split("/")
|
||||||
address, subnet = (cidr[0], cidr[1])
|
address, subnet = (cidr[0], cidr[1])
|
||||||
subnet = subnet if not config.quick else "24"
|
subnet = subnet if not config.quick else "24"
|
||||||
cidr = f"{address}/{subnet}"
|
cidr = f"{address}/{subnet}"
|
||||||
logger.debug(f"From pod discovered subnet {cidr}")
|
logger.debug(f"From pod discovered subnet {cidr}")
|
||||||
|
|
||||||
self.publish_event(AWSMetadataApi(cidr=cidr))
|
self.publish_event(AWSMetadataApi(cidr=cidr))
|
||||||
|
|
||||||
return [(address, subnet)], "AWS"
|
return [(address, subnet)], "AWS"
|
||||||
|
except Exception as x:
|
||||||
|
logger.debug(f"ERROR: could not parse cidr from aws metadata api: {cidr} - {x}")
|
||||||
|
|
||||||
|
return [], "AWS"
|
||||||
|
|
||||||
# querying AWS's interface metadata api v2 | works only from a pod
|
# querying AWS's interface metadata api v2 | works only from a pod
|
||||||
def aws_metadata_v2_discovery(self):
|
def aws_metadata_v2_discovery(self):
|
||||||
@@ -255,6 +263,7 @@ class FromPodHostDiscovery(Discovery):
|
|||||||
timeout=config.network_timeout,
|
timeout=config.network_timeout,
|
||||||
).text.split("/")
|
).text.split("/")
|
||||||
|
|
||||||
|
try:
|
||||||
address, subnet = (cidr[0], cidr[1])
|
address, subnet = (cidr[0], cidr[1])
|
||||||
subnet = subnet if not config.quick else "24"
|
subnet = subnet if not config.quick else "24"
|
||||||
cidr = f"{address}/{subnet}"
|
cidr = f"{address}/{subnet}"
|
||||||
@@ -263,6 +272,10 @@ class FromPodHostDiscovery(Discovery):
|
|||||||
self.publish_event(AWSMetadataApi(cidr=cidr))
|
self.publish_event(AWSMetadataApi(cidr=cidr))
|
||||||
|
|
||||||
return [(address, subnet)], "AWS"
|
return [(address, subnet)], "AWS"
|
||||||
|
except Exception as x:
|
||||||
|
logger.debug(f"ERROR: could not parse cidr from aws metadata api: {cidr} - {x}")
|
||||||
|
|
||||||
|
return [], "AWS"
|
||||||
|
|
||||||
# querying azure's interface metadata api | works only from a pod
|
# querying azure's interface metadata api | works only from a pod
|
||||||
def azure_metadata_discovery(self):
|
def azure_metadata_discovery(self):
|
||||||
|
|||||||
Reference in New Issue
Block a user