offsec notes

Docker Escape Tools

* deepce - script for Enumeration, Escalation of Privileges and Container Escapes written in pure sh * CDK - K8s, Docker penetration toolkit * botb - analysis and exploitation tool also being CI/CD friendly with common CI/CD technologies * amicontained - Useful tool to get the privileges the container has in order to find ways to escape from it * grype - Get the CVEs contained in the software installed in the image * linpeas - It can also enumerate containers

articles 7 Ways to Escape a Container - Обзор 7 распространенных техник побега из контейнера, их минимальных требований к capabilities и примеры уязвимых конфигураций контейнеров All You Need is Cap - Похожий ресерч, также содержит примеры уязвимых конфигураций контейнеров внутри подов

Gitlab checks

* Reconnaissance - Link * Abusing GitLab Runners - Link * Script for steal tasks by requesting them faster than a real runner - Link

Grafana pentest Известно, что с помощью уже созданных data sources можно получить доступ к ресурсам, к которым ходит графана Примеры: Grafana Remote Command Execution Through SQL Server SQL Injection by Default in Grafana (HTB — Jupiter) Но так же можно создать свой собственный data source и отправлять запросы от лица графаны, с помощью api метода proxy - https://spells.cr4.sh/pentest/infra/cloud-and-linux/grafana

ELK stack pentest Articles

* Link * Link

Notes

* Link * Link

Kafka pentest Common notes - Link Kafka UI RCE - Link Misconfigurations & Hardening - Link Zookeeper Работает на TCP 2181 и по умолчанию доступен без аутентификации. Позволяет получить статистику о кластере, информацию об узлах, выключить сервер и т.д Все команды:

dump: Lists the outstanding sessions and ephemeral nodes. This only works on the leader. envi: Print details about serving environment kill: Shuts down the server. This must be issued from the machine the ZooKeeper server is running on reqs: List outstanding requests ruok: Tests if server is running in a non-error state. The server will respond with imok if it is running. Otherwise it will not respond at all srst: Reset statistics returned by stat command stat: Lists statistics about performance and connected clients

Отправить команду:

echo urok | nc 192.168.1.1 2181

Metasploit Module - Link

msf > use auxiliary/gather/zookeeper_info_disclosure

Patroni authenticated Remote Code Execution PoC Discussion with developer: patroni/patroni#1734

Multi-Cloud tools Инструменты для тестирования облачных сред

* PurplePanda - поиск миссконфигов и privesc. Cloud/SaaS * Prowler - проведение аудитов, реагирование на инциденты и многое другое в таких средах, как AWS, Azure, GCP и Kubernetes * CloudSploit by Aqua - Cloud Security Scans * ScoutSuite - Multi-Cloud Security Auditing Tool

Представление инфраструктурных объектов и связей между ними в виде графа Neo4j

* cartography * starbase * IceKube * KubeHound

Дополнительный список cloud-sec инструментов - Link

Mythic С2 agent development How to create your own mythic agent in C Agent Customization in Mythic: Tailoring Tools for Red Team Needs

Multi Tool Kubernetes Pentest Image This docker image by Luntry contains all the most popular and necessary tools for Kubernetes penetration testing Inside:

* Shell via web * common tools for kube pentest * Bypass read-only container file system * Bypass signature engine

#kubernetes

Инструменты для изучения безопасности kubernetes

* simulator (with AWS) * kube_security_lab (On-premise)

Обзор на simulator - Link #kubernetes

pspy - unprivileged Linux process snooping It allows you to see commands run by other users, cron jobs, etc. as they execute. The tool gathers the info from procfs scans. Inotify watchers placed on selected parts of the file system trigger these scans to catch short-lived processes.

Also great to demonstrate why passing secrets as arguments on the command line is a bad idea.

Link

A collection of manifests that create pods with different elevated privileges. Quickly demonstrate the impact of allowing security sensitive pod attributes like

* hostNetwork * hostPID * hostPath * hostIPC * privileged

#kubernetes

Windows Local Privilege Escalation Cookbook Tactics & Techniques for windows privileges escalation with explanations, examples and labs for each case Link

Protected users abuse Link

This PowerShell script demonstrates advanced techniques including shellcode injection, dynamic function invocation, and PowerShell script obfuscation Link

k8s LAN Party - небольшая CTF от Wiz Research, посвященная Kubernetes. Write-up

PowerUp PowerUp.ps1 - aims to be a clearinghouse of common Windows privilege escalation vectors that rely on misconfigurations. Contains abuse modules such as:

* Token/Privilege Enumeration * Service Enumeration * DLL Hijacking * Registry Checks

e.g: Display services the current user can modify

PS C:\Users\dave> Get-ModifiableServiceFile

PowerUp also provides us an AbuseFunction, which is a built-in function to replace the binary and, if we have sufficient permissions, restart it. The default behavior is to create a new local user called john with the password Password123! and add it to the local Administrators group

PS C:\Users\dave> Install-ServiceBinary -Name 'vulnService'

#windows #privesc

Provide RDP access Turn on

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f

Bypass Restricted Admin Mode

reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f

Connect

xfreerdp /v:10.10.10.10 /u:username /pth:<NT_HASH> /dynamic-resolution +clipboard

Kubernetes pentest tools

* kube-hunter - мощный инструмент от Aqua Security * kubescape - выявление мисконфигов кластера, RBAC, скан образов * kdigger - тулза для разведки окружения * kubeletctl - кастомный клиент для общения с kebelet * peirates - мульти-комбайн тулза для пентеста кластера, в том числе изнутри pod'а * BOtB - инструмент для анализа и эксплуатации контейнеров

Krew kubectl plugins - https://krew.sigs.k8s.io/plugins/

A simple tshark EAP certificate extractor - Link For a more convincing attack, you can extract the Certificate used by a legitimate access point

./extract_EAP.sh -r <capture file>
./extract_EAP.sh -i mon0

#wifi