Guide on enumeration of homelab kubernetes

[ajutamangdev]

Hi there, I am trying to experiment enumeration of my homelab kind kubernetes cluster just for learning on how we can enumerate via msfconsole and kuberentes auxiliary module. I followed the instructions from https://docs.metasploit.com/docs/pentesting/metasploit-guide-kubernetes.html.

I am not able to verify my cluster configuration properly at msfconsole. May I know are there any options we can check our validation of our configuration like RHOST, RPORT, TOKEN.

Also has anyone tried using msfconsole for k8 ?

Documentation of K8 lack the instruction for RPORT as well.

[ajutamangdev]

Update:

I found out the lab environment guides as well. I followed all the instruction too. Here is the ref: https://github.com/rapid7/metasploit-framework/blob/master/test/kubernetes/Makefile

I see its not generating the token for full access.

# service-token: ##@tokens Create a Kubernetes service token for the default service account
echo $$(kubectl get secret -n default $$(kubectl -n default get serviceaccount default -o jsonpath="{.secrets[0].name}") -o jsonpath="{.data.token}" | base64 -d)

This case is for admin-token as well when we use make admin-token

I also figure out that Service account tokens are no longer able to generate token from 1.24 k8 version. We have to create manually. https://github.com/kubernetes/kubernetes/pull/108309 cc @adfoster-r7

[adfoster-r7]

Thanks! Do you know what solution we could use here instead? 🤔

[ajutamangdev]

Hi @adfoster-r7 Solution here is we have to create manually token for the service account. I created and whenever I call the api of kube server using curl. It works but it doesn't work with msfconsole.

[github-actions[bot]]

Hi!

This issue has been left open with no activity for a while now.

We get a lot of issues, so we currently close issues after 60 days of inactivity. It’s been at least 30 days since the last update here. If we missed this issue or if you want to keep it open, please reply here. You can also add the label "not stale" to keep this issue open!

As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request.