Bug Fix: False Negative On AKS Hunting

[danielsagi]

Description

Fixed false negative in AzureSpnHunter when /run is disabled #373

The fix concludes an additional test for the debug handler. this is because we haven't merged #271 yet. After the multiple subscription will be full implemented, we will remove the extra check for debug handlers here.

Other general improvements:

• Multiple issues were discovered while fixing the false negative, like a lack of usage of self.event.session which could also result in a false negative.
• Previous method of getting the file was to just cat /etc/kuberntes/azure.json now we use the volumeMount path to make sure we get the real correlated path inside the container
• Added a passive evidence when finding a container with this mount. showing it's name.
• We now make use of the pods data previously obtained on ExposedPodsHandler event. instead of sending another request to the kubelet.

Tested on AKS clusters

Fixed Issues

fixes #373

Contribution checklist

• [x] I have read the Contributing Guidelines.
• [ ] The commits refer to an active issue in the repository.
• [ ] I have added automated testing to cover this case.

[codecov[bot]]

Codecov Report

Merging #420 (e1e9516) into main (f95df81) will decrease coverage by 0.46%. The diff coverage is 54.54%.

@@            Coverage Diff             @@
##             main     #420      +/-   ##
==========================================
- Coverage   63.88%   63.41%   -0.47%     
==========================================
  Files          42       42              
  Lines        2287     2296       +9     
==========================================
- Hits         1461     1456       -5     
- Misses        826      840      +14     

Impacted Files	Coverage Δ
kube_hunter/modules/hunting/aks.py	54.41% <54.54%> (-10.00%)	:arrow_down:
kube_hunter/modules/hunting/apiserver.py	70.41% <0.00%> (-1.93%)	:arrow_down:
kube_hunter/modules/hunting/kubelet.py	60.40% <0.00%> (+0.40%)	:arrow_up:

---

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update f95df81...e1e9516. Read the comment docs.