Module: PWN::Plugins::K8s

Defined in:
lib/pwn/plugins/k8s.rb

Overview

trivy / kube-hunter wrappers plus docker-socket preflight.

Class Method Summary collapse

Class Method Details

.authors ⇒ Object 



39
40
41
 
# File 'lib/pwn/plugins/k8s.rb', line 39

public_class_method def self.authors
  "AUTHOR(S):\n  0day Inc. <[email protected]>\n"
end

.docker_socket?(opts = {}) ⇒ Boolean

Returns:

  • (Boolean) 


34
35
36
37
 
# File 'lib/pwn/plugins/k8s.rb', line 34

public_class_method def self.docker_socket?(opts = {})
  path = (opts[:path] || '/var/run/docker.sock').to_s
  PWN::Plugins::PreflightChecker.service?(name: 'docker', path: path)
end

.help ⇒ Object 



43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
 
# File 'lib/pwn/plugins/k8s.rb', line 43

public_class_method def self.help
  puts "USAGE:
    # List host binaries this module expects to be installed.
    #{self}.required_bins

    # Scan a container image or filesystem with trivy.
    #{self}.trivy(
      target: 'required - image name or path',
      image: 'optional - alias for target',
      path: 'optional - alias for target',
      mode: 'optional - trivy subcommand (defaults to image)'
    )

    # Run kube-hunter (remote cluster optional).
    #{self}.kube_hunter(
      remote: 'optional - API server host for --remote'
    )

    # True when the docker unix socket is present.
    #{self}.docker_socket?(
      path: 'optional - socket path (defaults to /var/run/docker.sock)'
    )

    # Print the AUTHOR(S) string for this module.
    #{self}.authors
  "
  constants.sort
end

.kube_hunter(opts = {}) ⇒ Object 



24
25
26
27
28
29
30
31
32
 
# File 'lib/pwn/plugins/k8s.rb', line 24

public_class_method def self.kube_hunter(opts = {})
  return { error: 'kube-hunter missing', hint: 'pip install kube-hunter' } unless PWN::Plugins::PreflightChecker.bin?(name: 'kube-hunter')

  cmd = ['kube-hunter']
  cmd += ['--remote', opts[:remote].to_s] if opts[:remote]
  cmd << '--report' << 'json'
  stdout, stderr, status = Open3.capture3(*cmd)
  { stdout: stdout, stderr: stderr, exit: status.exitstatus }
end

.required_bins ⇒ Object 



9
10
11
 
# File 'lib/pwn/plugins/k8s.rb', line 9

public_class_method def self.required_bins
  %w[trivy]
end

.trivy(opts = {}) ⇒ Object 



13
14
15
16
17
18
19
20
21
22
 
# File 'lib/pwn/plugins/k8s.rb', line 13

public_class_method def self.trivy(opts = {})
  PWN::Plugins::PreflightChecker.require_bin!(name: 'trivy')
  target = opts[:target] || opts[:image] || opts[:path]
  raise 'ERROR: target is required' if target.to_s.empty?

  mode = (opts[:mode] || :image).to_s
  cmd = ['trivy', mode, '--format', 'json', target.to_s]
  stdout, stderr, status = Open3.capture3(*cmd)
  { stdout: stdout, stderr: stderr, exit: status.exitstatus }
end