Container Security en Español

by | Mar 6, 2021 | Blog, Cloud, Herramientas / tools

Containers vs Virtual Machines

Basics:

  1. Los procesos deben correr como si estuvieran en otra computadora (process namaspace)
  2. Idem IPs (network namespace)
  3. Usuarios diferentes (user namespace)
  4. Las resouces debe ser limitadas (cgroups)
  5. No deberias poder escapar el container al host (seccomp-bpf)

Namespace wraps a global system resource in an abstraction

Reference: https://jvns.ca/blog/2016/10/10/what-even-is-a-container/

Como hay muchas formas de hacer containers se creo la OCI (para especificar runtime e imagenes):

La forma más comun de correr container es con Docker:

  • docker image
  • docker inspect (para saber que tiene adentro)
  • docker network
  • docker exec -it 9288919821 /bin/sh (para ejecutar bash)

Common missconfigurations:

  1. Mounting docker socket (if an attacker compromises the container can take over the host)
    1. Como? Start a privileged docker and scape
    2. Como 2? usar una backdored image
  2. Exposed docker socket. (lo mismo). Pero igual es una forma de escalar privilegios si estas como local user.
    1. Si eres local tienes que definir el docker host con: “export DOCKER_HOST=tcp://127.0.0.1:port”. El puerto normal es 2375
    2. Despues de eso montas root  (docker run -it /:/host container_name bash)
    3. y escapas con chroot (chroot /host bash)
  3. Privileged container (containe rrunning with privleged option)
    1. Como? mount host filesystem and use chroot to access host
    2. Para checarlo: “capsh –print” y revisas si tienes cap_sys_admin
  4. Shared Network Namspaces
    1. Como? pivot from one container to another via network
  5. Excesive linux capabilities like (cap_net_raw, cap_sys_admin, cap_setuid, cap_sys_module, cap_sys_ptrace, cap_dac_read_search, dac_override) examples can be found here https://github.com/Mexican-Pentester/Container_CAP_Explotation
  6. Containerd demon is running in the host machine
    1. ctr run –priviliged –net-host …etc.. bash
  7. Abusing runc same ^
  8. Insecure docker registry (docker registry is where you save images)
    1. by checking vuln in the images
    2. by overwriting images with malware
    3. El puerto normal es 5000

 

Kubernetes

In this part of the course he uses Multillidae to see the environment variables with

kubectl exec -it container -- sh
/# printenv

The output shows that certain environment variables have been assigned the values of Pod fields:

MY_POD_SERVICE_ACCOUNT=default
...
MY_POD_NAMESPACE=default
MY_POD_IP=172.17.0.4
...
MY_NODE_NAME=minikube
...
MY_POD_NAME=dapi-envars-fieldref

After we have to change the mount

mount

That will show you i fhtere is something like /secrets/ there

/run/secrets/kubernetes.io/serviceaccount

From there we can list them

ls -l /run/secrets/kubernetes.io/serviceaccount

Si encuentras un kubectl local que no se puede executar lo puedes copir a tu user (por ejemplo data) y ejecutrarlo 

Con el token que encontraste en mount puedes hablar con kubectl 🙂

Como lambda es un container tambien puedes printenv

Docker Host Security

  1. Check permissions of UNIX socket (ls -l var/run/docker.sock)
  2. TCP is only listening locally or you have authentication (netstat -tpln)
  3. Check docker group (cat etc/group | grep docker)
  4. Insecure registries (cat /etc/docker/daemon.json)
  5. capsh to check for capabilities (capsh –print)

 

Tools Scanning and benchmark

  1. Docker Bench for Security https://github.com/docker/docker-bench-security
  2. Dockscan (is olllddddd) https://github.com/kost/dockscan
  3. Amicontained https://github.com/genuinetools/amicontained. –> puede correr dentro del container 
  4. docker file lint (docker file installer) https://github.com/replicatedhq/dockerfilelint
  5. Clair (know vulnerabilities in images) https://github.com/quay/clair
  6. Docker hub can also scan using Synk

Tools privilage escalation

  1. Dockerrootplease https://hub.docker.com/r/chrisfosterelli/rootplease/
  2. Docker-rootshell https://github.com/gtank/docker-rootshell

https://www.marcolancini.it/2018/blog-arsenal-cloud-native-security-tools/#docker

For monitoring/loging Falco with local agents (elasticsearch and kibana) https://hub.docker.com/r/falcosecurity/falco