CDK

Release Date: 2024-05-19

📜 Changelog

💣 Exploits

• Feat(exp): adapt docker devicemapper file system when get docker rootfs

🧰 Tools

• 增加查看网络连接信息
• Fix(eva): long standing timeout in discovery k8s apiserver with sa, error msg: GET, ...connection timed out

✨ Others

• Feat(tool docs): add netstat document
• Fix(cgroup): latter part slice len error (#87)
• Chore: os.SEEK_END has been deprecated since Go 1.7
• Feat(exp): adapt docker devicemapper file system when get docker rootfs

🔑 Hash Table

Release Date: 2023-03-12

What's Changed

• V1.5.2 alpha by @neargle in https://github.com/cdk-team/CDK/pull/80

📜 Changelog

💣 Exploits

• Fix 78(exp): support containerd and other linux path

🧰 Tools

• Fix #77(exp shadow-apiserver): anonymous-auth is not valid, support v1.23.1

✨ Others

• Fix 78(exp): support containerd and other linux path
• Chore(exp): add alert message about flag auto-escape is deprecated

✨ In Chinese

• 支持 linux 环境下的不同容器运行时，如 containerd、runc、docker；
• 修复shadow-apiserver匿名访问无效的issue，支持新版本的k8s，如 v1.23.1；
• 添加迭代部分功能的消息提醒

🔑 Hash Table

Full Changelog: https://github.com/cdk-team/CDK/compare/v1.5.1...v1.5.2

Release Date: 2023-01-01

🎉 Happy New Year to everyone in 2023~

📜 Changelog

💣 Exploits

• Fix #71 (exp): k8s-shadow-apiserver check apiserver error in invalid to list pods

🔑 Hash Table

What's Changed

• fix #71 (exp): k8s-shadow-apiserver check apiserver error in invalid … by @neargle in https://github.com/cdk-team/CDK/pull/73

Full Changelog: https://github.com/cdk-team/CDK/compare/v1.5.0...v1.5.1

🏠 During the 7-day holiday, are there any technical activities in Xiamen that I can participate in?

Release Date: 2022-09-25

📜 Changelog

🔍 About Evaluate

• Feat(evaluate): check kernel exploit, use mzet-/linux-exploit-suggester
• Feat(evaluate): support check setuid files in path
• Perf(capabilities): red color for add caps

✨ Others

• Perf(evaluate): support two new formatted print func
• Perf(eva): a nice head 2 of title

🔑 Hash Table

What's Changed

• Feat(evaluate): check kernel exploit, use mzet-/linux-exploit-suggester by @neargle in https://github.com/cdk-team/CDK/pull/69

Full Changelog: https://github.com/cdk-team/CDK/compare/v1.4.1...v1.5.0

Release Date: 2022-09-19

📜 Changelog

🔍 About Evaluate

• Feat(evaluate): support check setuid files in path (#67)
• More colorful in Evaluate

🔑 Hash Table

What's Changed

• Better eva - feat(evaluate): support check setuid files in path by @neargle in https://github.com/cdk-team/CDK/pull/67

Full Changelog: https://github.com/cdk-team/CDK/compare/v1.4.0...v1.4.1

Release Date: 2022-09-04

📜 Changelog

💣 Exploits

• Perf(exp): add recommend message for lxcfs-rw and lxcfs-rw-cgroup exploit
• Fix(exp): function undefined in macos
• Feat(exp): support Exploit lxcfs-rw with cgroup release_agent

🔍 About Evaluate

• Feat(evaluate): output all mount info and more colorfu (#64)
• Perf(exp): add recommend message for lxcfs-rw and lxcfs-rw-cgroup exploit

✨ Others

• Feat(evaluate): output all mount info and more colorfu (#64)
• Perf(exp) #62: add recommend message for lxcfs-rw and lxcfs-rw-cgroup
• Feat(exp): support Exploit lxcfs-rw with cgroup release_agent
• Test(fix): fix import circle in TestParseCDKMain

What's Changed

• feat(exp): support Exploit lxcfs-rw with cgroup release_agent by @lockedtang in https://github.com/cdk-team/CDK/pull/61
• perf(exp): add recommend message for lxcfs-rw and lxcfs-rw-cgroup… by @neargle in https://github.com/cdk-team/CDK/pull/62
• feat(evaluate): output all mount info and more colorfu by @neargle in https://github.com/cdk-team/CDK/pull/64

New Contributors

• @lockedtang made their first contribution in https://github.com/cdk-team/CDK/pull/61

Full Changelog: https://github.com/cdk-team/CDK/compare/v1.3.0...v1.4.0

🔑 Hash Table

Release Date: 2022-07-10

🔮 Support for some function on the kubelet. Waiting for July 18?

📜 Changelog

💣 Exploits

• Test(main function): add unit test for ParseCDKMain
• Feat(exp): support "Exploit container escape with kubelet log access & /var/log mount"
• Feat(exp) (#55): Exploit a kubelet endpoint, default 10250

🧰 Tools

• Test(main function): add unit test for ParseCDKMain

✨ Others

• Test(github action): add go test
• Fix(network): support getgateway in linux container
• Docs(readme): add Quick Start
• Feat(network): get gateway in pods
• Feat(exp) (#55): Exploit a kubelet endpoint, default 10250

🔑 Hash Table

Contributor

@neargle @404tk

Full Changelog: https://github.com/cdk-team/CDK/compare/v1.2.0...v1.3.0

Release Date: 2022-06-25

☑️ Release a new version in the hospital 💊.

What's Changed

• add etcd get k8s token by @404tk in https://github.com/cdk-team/CDK/pull/52
• perf(probe): output ending message by @neargle in https://github.com/cdk-team/CDK/pull/53
• Fix #49 (shadow-apiserver): Flag --insecure-port has been deprecated by @neargle in https://github.com/cdk-team/CDK/pull/50

New Contributors

• @404tk made their first contribution in https://github.com/cdk-team/CDK/pull/52
• Thanks to @路飞 for privately reporting a bug, we fixed it in #49

📜 Changelog

💣 Exploits

• Feat(etcd) #52: get K8s service account token in ETCD

🧰 Tools

• Feat(etcd) #52: get K8s service account token in ETCD
• Perf(probe): output ending message

🔑 Hash Table

Release Date: 2022-06-12

📜 Changelog

💣 Exploits

• Fix #49(shadow-apiserver): Flag --insecure-port has been deprecated

🧰 Tools

• Fix(kcurl): more info for statuscode not in MaybeSuccessfulStatuscodeList

✨ Others

• Fix(kcurl): more info for statuscode not in MaybeSuccessfulStatuscodeList
• Fix #49(shadow-apiserver): Flag --insecure-port has been deprecated

What's Changed

• Fix #49 (shadow-apiserver): Flag --insecure-port has been deprecated by @neargle in https://github.com/cdk-team/CDK/pull/50

Full Changelog: https://github.com/cdk-team/CDK/compare/v1.1.0...v1.1.1

🔑 Hash Table

Release Date: 2022-05-30

📜 Changelog

💣 Exploits

• Chore(usage): ocd and CDK in banner title
• Docs(LICENSE): to the Apache License v2 and add file header(K8s style)
• Fix #46 (exp): add "run" to 3 exp desc document
• Fix(exp): runc-pwn error /proc/pid dir path
• Fix #44 (exp): k8s-psp-dump check args error
• Fix #45 (exp): check cmdline exclude cdk process
• Chore(utils): remove same function with StringContains
• Chore(exp & release): build mount cgroup only in linux

🔍 About Evaluate

• Add DNS-Based Service Discovery
• Perf(log): colorful usage
• Docs(LICENSE): to the Apache License v2 and add file header(K8s style)
• Feat(evaluate): get current pid cgroup info

🧰 Tools

• Docs(LICENSE): to the Apache License v2 and add file header(K8s style)

✨ Others

• Docs(thanks): add contrib rocks img in readme
• Chore(github action): run Evaluate, Exploit and Tool for test
• Add DNS-Based Service Discovery
• Fix(opt): docopt parse error
• Chroe(git): ignore vscode debug bin
• Perf(log): colorful usage
• Fix(action): del unnecessary build
• Feat(evaluate): get current pid cgroup info
• Fix(action): build cross-compiler in push & pull request
• Chore(exp & release): build mount cgroup only in linux

🔑 Hash Table

New Contributors

• @wywwzjj made their first contribution in https://github.com/cdk-team/CDK/pull/48

Full Changelog: https://github.com/cdk-team/CDK/compare/v1.0.6...v1.1.0

💣 Awesome CVE-2022-0492 Exploit!

Release Date: 2022-03-10

📜 Changelog

💣 Exploits

• Chore(exp & release): build mount cgroup only in linux
• Fix(exp): unprivileged_userns_clone sysctl file do not exist in CentOS
• Feat(exploit/abuse-unpriv-userns): exploit of CVE-2022-0492 (#41)
• Feat(exp/mount_cgroup.go): completely fix #35 in golang-style
• Fix #38 (exp): shim-pwn protobuf panic after run exploit

🔍 About Evaluate

• Feat(caps): find out add caps

✨ Others

• Chore(cli): add version info & commit id for debug

🔑 Hash Table

PR

• Implement mount-cgroup in Golang style by kmahyyg in https://github.com/cdk-team/CDK/pull/40
• feat(exploit/abuse_unpriv_userns.go): exploit of CVE-2022-0492 by kmahyyg in https://github.com/cdk-team/CDK/pull/41

New Contributors

• @kmahyyg made their first contribution in https://github.com/cdk-team/CDK/pull/40

💒 Happy wedding to my friend CDKKWANG, let's release a new version of CDK.
🌸 And fix some bugs by the way. Click to view more changelogs.

Release Date: 2022-03-06

📜 Changelog

💣 Exploits

• Fix #38 (exp): shim-pwn protobuf panic after run exploit

🔍 About Evaluate

• Feat(caps): find out add caps

✨ Others

• Chore(cli): add version info & commit id for debug
• Fix #38 (exp): shim-pwn protobuf panic after run exploit
• Fix #37 (eva): add eva args to docopt
• Chore: support for cdk eval
• Feat(caps): find out add caps
• Bump github.com/containerd/containerd from 1.4.11 to 1.4.12
• Fix action: cedrickring/golang-action is archived, offical actions/setup-go action instead
• Fix action: apply in all push and pull request
• Bump github.com/tidwall/gjson from 1.6.7 to 1.9.3
• Add event: https://community.cncf.io/events/details/cncf-kcd-china-presents-kubernetes-community-days-china/
• Github action: git build test after a new pull request and push

🔑 Hash Table

Release Date: 2021-10-02

📜 Changelog

💣 Exploits

• Fix DeployBackdoorDaemonset return true when error.
• Fix build tag mistake in CapDacReadSearch Exploit
• Better cap_dac_read_search exploit
• Fix: http authorization token have blank string in prefix or subfix
• Add force-fuzz option for k8s-psp-dump exploit
• Add filter string for lxcfs-rw exploit

🔍 About Evaluate

• Fix DeployBackdoorDaemonset return true when error.

🧰 Tools

• Fix DeployBackdoorDaemonset return true when error.
• Fix: http authorization token have blank string in prefix or subfix

✨ Others

• Fix typo: KCON 2021 Arsenal
• Add kcon2021 and whc2021
• Format "run --list" output.
• Add StringContains function
• Add filter string for lxcfs-rw exploit
• Bump github.com/containerd/containerd from 1.4.3 to 1.4.8

🔑 Hash Table

Release Date: 2021-07-08

📜 Changelog

💣 Exploits

• Add exploit: to container image registry, brute force the accounts and passwords cracking

✨ Others

• Add document for brute force the accounts and passwords cracking
• Add meta-data api url of ucloud PR #24
• Auto changelog: move changelog generate code to bash script

🔑 Hash Table

Release Date: 2021-06-17

📜 Changelog

💣 Exploits

• Add CAP_DAC_READ_SEARCH exploit
• Fix error when target mountpoint is not a directory
• Add SYS_ADMIN check and format capability output
• Fix: truncation or EOF when reading target file
• Various supplements to cap-dac-read-search

🔍 About Evaluate

• More infomations about available linux capabilities
• Add SYS_ADMIN check and format capability output
• Add check for CAP_SYS_MODULE and CAP_DAC_READ_SEARCH

✨ Others

• Add meta-data api url of ucloud PR #24 from Alex-null/main
• Auto changelog: move changelog generate code to bash script
• Bash variables uppercase and add other changelogs
• Changelog generation by automatic in github action
• Add meta-data api url of Amazon Web Services Cloud
• More infomations about available linux capabilities
• Add check for CAP_SYS_MODULE and CAP_DAC_READ_SEARCH
• Add check for OpenStack metadata
• Add CAP_DAC_READ_SEARCH exploit
• Update release note format

🔑 Hash Table

Fixes

• fit exploit k8s-backdoor-daemonset for k8s- for k8s version >1.8. #13 @greenhandatsjtu
• fit exploit k8s-shadow-apiserver for Tencent Cloud TKE cluster.

New features

• Make capabilities information readable.
• Update cgroup and hostname capabilities in the evaluate module.
• Update rewrite-cgroup-devices exploit to make it more stable.
• More ports for k8s service probe.
• Enable auto-pwn task.
• New exploit: k8s-get-sa-token
• New exploit: k8s-psp-dump
• Release the thin version, now CDK can be easily used to pwn serverless/function service.
• Use Github actions to compile and release.

Fixes

• HTTP header set twice in several exploits.
• Wrong parameter output in k8s-backdoor-daemonset exploit.

Release Date: 2021-04-11

• bugfix run: check-ptrace
• new exploit: docker-api-pwn to takeover host with port 2375 open.
• change exploit docker-sock-deploy to docker-sock-pwn, the new exploit will run commands directly without attaching to the backdoor container.

More Exploits Enabled:

1. Evaluate kube-proxy route localnet(CVE-2020-8558) vulnerability.
2. Exploit LXC container with lxcfs mounted into container with rw privilege.
3. Exploit privileged containers with CGroup device.allow overwrite.

Add multiple K8s exploits.