hacktricks-cloud

Kyverno is an open-source policy management framework for Kubernetes designed to define, enforce, and audit policies across Kubernetes infrastructure. It is used to manage security, compliance, and governance through several key use cases:

• Network Policy Enforcement: Controlling traffic between pods or services.
• Secret Management: Enforcing specific formats or storage locations for secrets.
• Access Control: Requiring specific roles or permissions for resource access.

Kubernetes pentesting follows a structured progression from external discovery to cloud pivoting. The methodology covers:

1. External Reconnaissance: Identifying exposed Kubernetes services on the internet or internal networks.
2. Pod-Level Enumeration: Techniques used after compromising a single Pod to escalate privileges or escape to the host.
3. Credential-Based Enumeration: Using compromised user credentials, tokens, or Service Account (SA) tokens to interact with the Kubernetes API.
4. RBAC Abuse: Leveraging Role-Based Access Control (RBAC) misconfigurations to escalate permissions.
5. Namespace Escalation: Moving from a compromised namespace to other namespaces with higher privileges.
6. Cloud Pivoting: Exploiting Kubernetes Service Account permissions to move from the Kubernetes cluster into the underlying cloud provider (e.g., AWS, GCP).

Gitblit is a self-hosted Git server written in Java. It can be deployed as a standalone JAR or within servlet containers. It includes an embedded SSH service (Apache MINA SSHD) to facilitate Git operations over SSH.

Security research for Gitblit includes vulnerabilities such as the embedded SSH authentication bypass (CVE-2024-28080).

Azure Cloud Shell is an interactive, authenticated, browser-accessible terminal for managing Azure resources. It supports both Bash and PowerShell and runs on a temporary, per-session host that times out after 20 minutes of inactivity.

Key Characteristics

• Persistence: Files in the $HOME location are persisted using a 5-GB file share if a storage account is mounted. Without a storage account, the session is ephemeral and files are deleted upon exit.
• Preinstalled Tools: Includes Azure CLI, Azure PowerShell, Terraform, Docker CLI, Ansible, Git, and editors (vim, nano, emacs).
• Azure Drive (PowerShell only): Provides the Azure: drive, allowing filesystem-like navigation of Azure resources (Compute, Network, Storage) using cd Azure:.
• Customization: Users with an attached storage account can install additional tools that do not require root permissions.

When performing post-exploitation on AWS Lightsail environments, focus on recovering deleted data and sensitive information through snapshots. Key vectors include:

1. Database Snapshots: If the database has snapshots enabled, you can recover sensitive information that has been deleted from the live database by restoring an old snapshot into a new database instance.
2. Instance Snapshots: Snapshots of Lightsail instances may contain sensitive data from previously deleted instances or data that was recently removed from the current instance. You can access this data by:
   • Creating a new Lightsail instance directly from the snapshot.
   • Exporting the snapshot to an Amazon EC2 AMI and then performing standard EC2 post-exploitation/forensics.
3. Privilege Escalation: Use Lightsail-specific privilege escalation techniques to gain broader access to the environment.

Google Password Sync (GPS) is a service used to synchronize user passwords between Active Directory (AD) and Google Workspace.

Installation Paths:

• Binary for configuration: C:\Program Files\Google\Password Sync\PasswordSync.exe
• Running service: C:\Program Files\Google\Password Sync\password_sync_service.exe

Configuration Methods:

1. OAuth Login: Requires a GUI on the Domain Controller. Stores an encrypted token in the registry.
2. GCP Service Account (SA): Uses a JSON file with Workspace management permissions. This is a high-risk configuration as SA credentials do not expire and can allow pivoting from GCP to Workspace. Credentials are stored in the registry.
3. AD Credentials: Can use application context, anonymous, or specific credentials. If specific credentials are used, the username is stored on disk and the password is encrypted in the registry.

This guide provides methodologies for attacking Jenkins instances deployed within OpenShift or Kubernetes clusters. The primary difference between these environments and traditional VM-based Jenkins deployments is the orchestration of builds via pods. In these environments, the Jenkins master is a pod (often in a specific namespace), and build workers/slaves are ephemeral pods that are created for the duration of a build and destroyed immediately after completion.

Prerequisites for exploitation:

• Direct user access to the Jenkins instance.
• OR Write permission to a Source Control Management (SCM) repository that triggers automated builds via webhooks.

Several AWS services may be misconfigured to allow unauthenticated access or enumeration from the public internet. The following services are common targets for unauthenticated enumeration and access testing:

• Storage & Databases: S3, DynamoDB, DocumentDB, RDS, Redshift, Elasticsearch, MSK, MQ.
• Compute & Serverless: Lambda, EC2, Codebuild, Elastic Beanstalk.
• Messaging & Integration: SNS, SQS, Kinesis Video, API Gateway.
• Identity & Management: IAM, Identity Center (SSO), Cognito.
• Other: Cloudfront, IoT, Media, Sagemaker, AWS Config, Serverless repository.

Attackers can maintain persistence in an AWS environment using Elastic Beanstalk through several vectors:

1. Instance-level Persistence: Introducing mechanisms like cron jobs or SSH keys directly into the EC2 instances to steal IAM role credentials from the Instance Metadata Service (IMDS).
2. Application Code Backdooring: Modifying the source code within the S3 repository used by Elastic Beanstalk to ensure the backdoor executes alongside legitimate application logic.
3. Version Deployment: Deploying an entirely new, backdoored version of the application instead of modifying the existing one.
4. Lifecycle Hook Abuse: Configuring custom lifecycle hooks to execute malicious scripts during instance provisioning or termination.