A tool for scanning Kubernetes (https://www.kitploit.com/search/label/Kubernetes) cluster for risky permissions in Kubernetes's Role-based access control (RBAC) authorization (https://www.kitploit.com/search/label/Authorization) model. The tool was published as part of the "Securing Kubernetes Clusters by Eliminating Risky Permissions" research https://www.cyberark.com/threat-research-blog/securing-kubernetes-clusters-by-eliminating-risky-permissions/.

Overview
KubiScan helps cluster administrators identify permissions that attackers could potentially exploit to compromise the clusters. This can be especially helpful on large environments where there are lots of permissions that can be challenging to track. KubiScan gathers information about risky roles\clusterroles, rolebindings\clusterrolebindings, users and pods, automating traditional manual processes and giving administrators the visibility (https://www.kitploit.com/search/label/Visibility) they need to reduce risk.
What can it do?
Identify risky Roles\ClusterRoles Identify risky RoleBindings\ClusterRoleBindings Identify risky Subjects (Users, Groups and ServiceAccounts) Identify risky Pods\Containers Dump tokens from pods (all or by namespace) Get associated RoleBindings\ClusterRoleBindings to Role, ClusterRole or Subject (user, group or service account) List Subjects with specific kind ('User', 'Group' or 'ServiceAccount') List rules of RoleBinding or ClusterRoleBinding Show Pods that have access to secret data through a volume or environment variables Get bootstrap tokens for the cluster
Usage

Container

With ~/.kube/config file
This should be executed within the Master node where the config file is located:
docker run -it --rm -e CONF_PATH=~/.kube/config -v /:/tmp cyberark/kubiscan CONF_PATH - the cluster config file's path Inside the container the command kubiscan is equivalent to python3 /KubiScan/KubiScan.py.
Notice that in this case, the whole file system will be mounted. This is due to the fact that the config files contain paths to other places in the filesystem (https://www.kitploit.com/search/label/Filesystem) that will be different in other environments.
With service account token (good from remote)
Some functionality requires a privileged service account with the following permissions: resources: ["roles", "clusterroles", "rolebindings", "clusterrolebindings", "pods", "secrets"]
verbs: ["get", "list"] resources: ["pods/exec"]
verbs: ["create", "get"] But most of the functionalities are not, so you can use this settings for limited service account:
It can be created by running: kubectl apply -f - << EOF
apiVersion: v1
kind: ServiceAccount
metadata:
name: kubiscan-sa
namespace: default
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: kubiscan-clusterrolebinding
subjects:
- kind: ServiceAccount
name: kubiscan-sa
namespace: default
apiGroup: ""
roleRef:
kind: ClusterRole
name: kubiscan-clusterrole
apiGroup: ""
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: kubiscan-clusterrole
rules:
- apiGroups: ["*"]
resources: ["roles", "clusterroles", "rolebindings", "clusterrolebindings", "pods"]
verbs: ["get", "list"]
EOF
Save the service account's token to a file:
kubectl get secrets $(kubectl get sa kubiscan-sa -o json | jq -r '.secrets[0].name') -o json | jq -r '.data.token' | base64 -d > token Run the container from anywhere you want:
docker run -it --rm -v $PWD/token:/token cyberark/kubiscan In the shell you will be able to to use kubiscan like that:
kubiscan -ho -t /token For example:
kubiscan -ho 192.168.21.129:8443 -t /token -rs Notice that you can also use the certificate authority (ca.crt) to verify the SSL connection:
docker run -it --rm -v $PWD/token:/token -v /ca.crt:/ca.crt cyberark/kubiscan Inside the container:

kubiscan -ho -t /token -c /ca.crt To remove the privileged service account, run the following commands:
kubectl delete clusterroles kubiscan-clusterrole
kubectl delete clusterrolebindings kubiscan-clusterrolebinding
kubectl delete sa kubiscan-sa
Directly with Python3

Prerequisites:
Python 3.5+ Pip3 Kubernetes Python Client Prettytable openssl (built-in in ubuntu) - used only for join token
Example for installation on Ubuntu:
apt-get update
apt-get install -y python3 python3-pip
pip3 install kubernetes
pip3 install PTable Run alias kubiscan='python3 / to use kubiscan. After installing all of the above requirements (https://www.kitploit.com/search/label/Requirements) you can run it in two different ways:
From the Master node:
On the Master node where ~/.kube/config exist and all the relevant certificates, simply run:
kubiscan
For example: kubiscan -rs will show all the risky subjects (users, service accounts and groups).
From a remote host:
To use this tool from a remote host, you will need a privileged service account like we explained in the container section.
After you have the token inside a file you can run:
kubiscan -ho -t /token
Examples
To see all the examples, run python3 KubiScan.py -e or from within the container kubiscan -e.
Demo
A small example of KubiScan usage:

Risky Roles YAML
There is a file named risky_roles.yaml. This file contains templates for risky roles with priority.
Although the kind in each role is Role, these templates will be compared against any Role\ClusterRole in the cluster.
When each of these roles is checked against a role in the cluster, it checks if the role in the cluster contains the rules from the risky role. If it does, it will be marked as risky.
We added all the roles we found to be risky, but because each one can define the term "risky" in a different way, you can modify the file by adding\removing roles you think are more\less risky.
References:
For more comments, suggestions or questions, you can contact Eviatar Gerzi (@g3rzi (https://twitter.com/g3rzi)) and CyberArk Labs.

Download KubiScan (https://github.com/cyberark/KubiScan)

Hacking on Medium
Hack The Box-Lame

https://cdn-images-1.medium.com/max/600/1*0jHirL8A8Tp_UuqS36CQ_g.png
This is my 14th write up and I will be discussing my experience with the machine “Lame” from Hack The Box. Htb is a great platform for…

Continue reading on Medium »

Hacking on Medium
Introduction to IoT Hardware Hacking

https://cdn-images-1.medium.com/max/1200/1*rwawAsWrhj-a1sZp5UMRQg.jpeg
by offen5ive

Continue reading on Medium »

Hacking on Medium
A Guide to Joining Hackathons as a Designer

https://cdn-images-1.medium.com/max/1500/0*InY99bFd5gxzm4h5
Ever feel intimidated joining hackathons as a designer? Then this guide is for you!

Continue reading on Medium »

Hacking on Medium
Is the CEH really “worth it”?

This question has been bouncing around in my head since I started really gobbling up certifications about 2 years ago. One of the first…

Continue reading on Medium »

hacking: security in practice
Someone Doxxed Me

Is there a possible way to identify who made an Instagram account because someone created an account and revealed my friend and I’s home addresses. I want to find out who was responsible for this but I don’t know how to find out who created the account.

https://www.instagram.com/hsbsnzomamzmzhznsnsjwoamzkz here is the account link for anyone that wants to help me. If you find out who it is please tell me through private messages, Thanks a lot 🙏🏽

submitted by /u/Bennythebear25
[link] [comments]

Hacking on Medium
PC Optimization (Windows 10)

https://cdn-images-1.medium.com/max/1705/1*1eMHGZH7wSGGJJXX81C4cQ.png
We’ve all experienced our devices become painfully slow to the point we no longer want to use them. This can make for a very annoying…

Continue reading on Medium »

Hacking on Medium
Buffer overflow Vulnerability

What is Buffer Overflow ?

Continue reading on Medium »

Hacking on Medium
Advanced Phishing Email — When Protective AI May Harm

One popular technique we hear a lot on corporate and college courses on phishing is that there are certain patterns with phishing emails…

Continue reading on Medium »