cdk-team/CDK
CDK
CDK is a specialized toolset for container security auditing, container escape exploitation, and cloud infrastructure pentesting. It provides a collection of scripts and tools designed to identify and exploit vulnerabilities in container runtimes to break out of isolated environments and execute commands on the underlying host operating system.
The project features a dedicated Docker runtime exploit suite for abusing the Docker API, procfs, and cgroups to gain unauthorized host-level access. It includes specific techniques for bypassing isolation via LXCFS, user namespace exploitation, and host disk mounting, as well as capabilities for extracting cloud metadata and auditing service account permissions to escalate privileges in cluster environments.
The toolkit covers a broad range of security auditing capabilities, including Kubernetes cluster auditing for secret exfiltration and policy analysis, sensitive file and service scanning, and the detection of host network sharing. It also provides utilities for establishing reverse shells, deploying payloads in restricted environments, and installing system administration tools within minimal containers.
Features
- API-Based Escapes - Provides a capability to use unauthorized remote Docker API access to create privileged containers and execute host commands.
- Container Escape Auditors - Provides a comprehensive collection of scripts and tools for identifying and exploiting container escape vulnerabilities.
- Environment Vector Analysis - Provides a scanning mechanism that identifies kernel versions and mount points to determine viable escape vectors.
- Mount Analysis for Escapes - Lists directories and files mounted within a container to identify paths viable for container escapes.
- Host Command Execution - Provides a capability to run specified commands on the host by bypassing access controls via file handles.
- Cloud Provider Metadata Extraction - Provides an interface to extract infrastructure details and service account tokens from cloud provider endpoints.
- Cloud Infrastructure Data Collection - Collects cloud metadata and extracts credentials to identify vulnerabilities in virtualized environments.
- Service Account Auditing - Uses service account tokens to audit high-privilege access to cluster resources.
- Cloud Infrastructure Pentesting - Implements a utility for extracting cloud metadata and auditing service account permissions to escalate privileges.
- Cluster Takeover Techniques - Provides capabilities to bypass access controls and deploy persistence to take over cluster management.
- Container Escape Analysis - Includes a process for scanning sensitive files and network namespaces to identify viable container escape vectors.
- Container-Host Configuration Auditing - Includes a utility to scan for installed commands and active capabilities to identify attack vectors within containers.
- Container Security - Analyzes container runtimes, namespaces, and mounted filesystems to discover potential attack vectors.
- Cluster Credential Exfiltration - Ships a tool designed to dump secrets, API keys, and tokens from containerized namespaces and orchestration layers.
- Docker Runtime Exploits - Provides a dedicated exploit suite for abusing the Docker API, procfs, and cgroups to gain unauthorized host access.
- Escape Vector Identification - Scans environment variables and processes to locate services that can be leveraged for container escape.
- Kubernetes Cluster Auditing - Scans for leaked secrets, service account permissions, and security policy misconfigurations within a cluster.
- Secrets Extraction - Implements tools for discovering and extracting sensitive credentials and API keys from Kubernetes namespaces.
- Modular Attack Module Launchers - Provides a modular engine that loads and executes independent attack modules based on the detected environment.
- Namespace Discovery - Includes a discovery process that scans network and process namespaces to identify shared resources and leaked credentials.
- Port Scanning - Provides capabilities to scan IP ranges and ports to identify exposed APIs for potential exploitation.
- System Information - Provides a utility to retrieve user, kernel, and operating system details from within a container.
- Information Gathering - Implements capabilities to collect system metadata and cloud API information to identify security weaknesses.
- Docker Socket Access Verification - Includes a method to check for the presence of a Unix socket to determine if host processes can be controlled.
- Root Filesystem Mounting - Implements a method to launch containers with the host root directory mounted for direct filesystem modification.
- Physical Disk Exploitation - Identifies host device information and mounts physical disks into a container to modify host files.
- Filesystem Access Bypass - Implements techniques to bypass access control checks to read arbitrary files from the host system.
- Procfs-Based Escapes - Triggers core dumps through a mounted process filesystem to execute arbitrary shell commands on the host.
- Cluster Persistence Mechanisms - Implements methods to deploy backdoors or web shells to maintain long-term access within a containerized environment.
- Release Agent Exploitation - Manipulates the host cgroup release agent file to execute arbitrary shell commands on the underlying host.
- Cgroup-Based Escapes - Uses read and write privileges on cgroup directories to bypass isolation and access the host system.
- Credential Health Audits - Includes capabilities to scan for leaked access keys and extract tokens from databases to escalate privileges.
- Credential Leak Detectors - Provides a utility to scan directories and source code for leaked access keys and certificates within containers.
- Cluster Secret Exfiltration - Provides a process to dump sensitive configuration data and service account tokens from a cluster.
- Exploit Payload Deployments - Implements a delivery system to inject tools and reverse shells into restricted environments via APIs or mounts.
- Exploit Vector Mapping - Implements a logic system that matches detected system privileges to specific container escape techniques and payloads.
- Kubernetes API Server Auditing - Ships a utility to check for API server addresses and attempt anonymous authentication to identify takeover potential.
- Kernel Privilege Escalations - Provides a workflow to move from an unprivileged container user to administrative or root access on the host.
- Reverse Shells - Provides capabilities to spawn interactive reverse shell sessions for remote command execution from containerized environments.
- Sensitive File Discovery - Includes a tool to search the disk for file paths matching sensitive keywords to identify targets for exploitation.
- Process Injection Analysis - Checks for specific capabilities and namespace sharing to determine if process injection is possible.
- Pod Security Policy Auditing - Includes a utility to retrieve and list security policy rules to identify restrictions on container configurations.
- User Namespace Exploitation - Exploits unprivileged user namespace creation and capability inheritance to gain administrative privileges on the host.
- Host Network Mode Containers - Provides a method to identify if a container shares the host network namespace to determine escape vulnerability.
- Cloud Native Security - Toolkit for Kubernetes and container penetration testing.
- Cloud Security - Penetration testing toolkit for container environments.
- Cloud Security Tools - Container-focused penetration testing tool for cloud environments.
- Container and Cluster Security - Tool for information gathering and exploitation within container environments.
- Penetration Testing and Analysis - Toolkit for container penetration testing.
