[v0.2.0] K8s Pillaging & Docker Modification#45
Conversation
Lavender-exe
commented
May 17, 2026
Lavender-exe
commented
- Added new K8s enumeration and exploitation
- Added more Docker escape methods
- Updated Guides
- Added Kubernetes Enumeration and Exploitation - Updated CVEs related to Docker Escapes - Updated Guides to reflect the new additions
stealthcopter
left a comment
stealthcopter
left a comment
There was a problem hiding this comment.
Hey @Lavender-exe
This is an amazing PR, thank you so much for contributing it! I picked up on a few minor things, keen to get your thoughts on them:
| printQuestion "Azure metadata .........." | ||
| azureResp=$(curl -s --connect-timeout 3 \ | ||
| -H "Metadata: true" \ | ||
| "http://169.254.169.253/metadata/instance?api-version=2021-02-01" 2>/dev/null | head -c 200) |
There was a problem hiding this comment.
| "http://169.254.169.253/metadata/instance?api-version=2021-02-01" 2>/dev/null | head -c 200) | |
| "http://169.254.169.254/metadata/instance?api-version=2021-02-01" 2>/dev/null | head -c 200) |
Is the IP address here off by one?
| if grep -q " $p " /proc/self/mountinfo 2>/dev/null; then | ||
| mountSrc=$(grep " $p " /proc/self/mountinfo | head -1 | awk '{print $4}') | ||
| # Overlay and tmpfs are normal container mounts; anything else is suspicious | ||
| if ! echo "$mountSrc" | grep -q "overlay\|tmpfs\|cgroup\|proc\|sysfs"; then |
There was a problem hiding this comment.
Can you just check this bit of code? the $4 doesn't seem to match with the grep on the line below ( mount root vs fstype). I also suspect the use of head here could potentially cause a false negative, would a loop be better?
| # Check for full root mount | ||
| printQuestion "Root filesystem mounted .." | ||
| if grep -q " / " /proc/self/mountinfo 2>/dev/null; then | ||
| rootMountSrc=$(grep " / " /proc/self/mountinfo | grep -v "overlay\|tmpfs" | head -1 | awk '{print $4}') |
There was a problem hiding this comment.
I think this could give a false negative due to the use of head here, thoughts?
|
Heya @stealthcopter! The changes were made mid CTF so it's error prone, you're correct with the errors and apologies for introducing them! |
2 participants
