English | 简体中文
Usage of CDK for attacking targets without prior mutual consent is illegal. CDK is for security testing purposes only.
CDK is an open-sourced container penetration toolkit, designed for offering stable exploitation in different slimmed containers without any OS dependency. It comes with useful net-tools and many powerful PoCs/EXPs helps you to escape container and takeover K8s cluster easily.
Currently still under development, submit issues or mail [email protected] if you need any help.
Download latest release in: https://github.com/Xyntax/CDK/releases/
Drop executable files into target container and start testing.
Usage:
cdk evaluate [--full]
cdk run (--list | <exploit> [<args>...])
cdk auto-escape <cmd>
cdk <tool> [<args>...]
Evaluate:
cdk evaluate Gather information to find weakness inside container.
cdk evaluate --full Enable file scan during information gathering.
Exploit:
cdk run --list List all available exploits.
cdk run <exploit> [<args>...] Run single exploit, docs in https://github.com/Xyntax/CDK/wiki
Auto Escape:
cdk auto-escape <cmd> Escape container in different ways then let target execute <cmd>.
Tool:
vi <file> Edit files in container like "vi" command.
ps Show process information like "ps -ef" command.
nc [options] Create TCP tunnel.
ifconfig Show network information.
kcurl <path> (get|post) <uri> <data> Make request to K8s api-server.
ucurl (get|post) <socket> <uri> <data> Make request to docker unix socket.
probe <ip> <port> <parallel> <timeout-ms> TCP port scan, example: cdk probe 10.0.1.0-255 80,8080-9443 50 1000
Options:
-h --help Show this help msg.
-v --version Show version.
CDK have three modules:
- Evaluate: gather information inside container to find potential weakness.
- Exploit: for container escaping, persistance and lateral movement
- Tool: network-tools and APIs for TCP/HTTP requests, tunnels and K8s cluster management.
Usage
cdk evaluate [--full]
This command will run the scripts below without local file scanning, using --full
to enable all.
Tactics | Script | Supported | Usage/Example |
---|---|---|---|
Information Gathering | OS Basic Info | ✔ | link |
Information Gathering | Available Capabilities | ✔ | link |
Information Gathering | Available Linux Commands | ✔ | link |
Information Gathering | Mounts | ✔ | link |
Information Gathering | Net Namespace | ✔ | link |
Information Gathering | Sensitive ENV | ✔ | link |
Information Gathering | Sensitive Process | ✔ | link |
Information Gathering | Sensitive Local Files | ✔ | link |
Discovery | K8s Api-server Info | ✔ | link |
Discovery | K8s Service-account Info | ✔ | link |
Discovery | Cloud Provider Metadata API | ✔ | link |
List all available exploits:
cdk run --list
Run targeted exploit:
cdk run <script-name> [options]
Tactic | Technique | CDK Exploit Name | Supported | Doc |
---|---|---|---|---|
Escaping | docker-runc CVE-2019-5736 | runc-pwn | ✔ | |
Escaping | docker-cp CVE-2019-14271 | |||
Escaping | containerd-shim CVE-2020-15257 | shim-pwn | ✔ | link |
Escaping | dirtycow CVE-2016-5159 | |||
Escaping | docker.sock PoC (DIND attack) | docker-sock-check | ✔ | link |
Escaping | docker.sock Backdoor Image Deploy | docker-sock-deploy | ✔ | link |
Escaping | Device Mount Escaping | mount-disk | ✔ | link |
Escaping | Cgroups Escaping | mount-cgroup | ✔ | link |
Escaping | Procfs Escaping | mount-procfs | ✔ | link |
Escaping | Ptrace Escaping PoC | check-ptrace | ✔ | link |
Discovery | K8s Component Probe | service-probe | ✔ | link |
Lateral Movement | K8s Service Account Control | |||
Lateral Movement | Attack K8s api-server | |||
Lateral Movement | Attack K8s Kubelet | |||
Lateral Movement | Attack K8s Dashboard | |||
Lateral Movement | Attack K8s Helm | |||
Lateral Movement | Attack K8s Etcd | |||
Lateral Movement | Attack Private Docker Registry | |||
Remote Control | Reverse Shell | reverse-shell | ✔ | link |
Credential Access | Access Key Scanning | ak-leakage | ✔ | link |
Credential Access | Dump K8s Secrets | k8s-secret-dump | ✔ | |
Credential Access | Dump K8s Config | k8s-configmap-dump | ✔ | |
Persistence | Deploy WebShell | |||
Persistence | Deploy Backdoor Pod | |||
Persistence | Deploy Shadow K8s api-server | |||
Persistence | Deploy K8s CronJob | |||
Defense Evasion | Disable K8s Audit |
Running commands like in Linux, little different in input-args, see the usage link.
cdk nc [options]
cdk ps
Command | Description | Supported | Usage/Example |
---|---|---|---|
nc | TCP Tunnel | ✔ | link |
ps | Process Information | ✔ | link |
ifconfig | Network Information | ✔ | link |
vi | Edit Files | ✔ | link |
kcurl | Request to K8s api-server | ✔ | link |
dcurl | Request to Docker HTTP API | ||
ucurl | Request to Docker Unix Socket | ✔ | link |
rcurl | Request to Docker Registry API | ||
probe | IP/Port Scanning | ✔ | link |
- Echo loader for delivering CDK into target container via Web RCE.
- EDR defense evasion.
- Compile optimization.
- Dev docs