bgeesaman

:poop:

bgeesaman

layout	title	date	categories	tags	image	author	published
post	Kubernetes Honey Token	2021-01-19	blog	kubernetes security honey token cloud jwt serviceaccount	/img/previews/honeyjar.jpeg	Brad Geesaman	true

bgeesaman

#!/usr/bin/env bash

set -eo pipefail

PARAMS=""
while (( "$#" )); do
  case "$1" in
    -d|--dest)
      if [ -n "$2" ] && [ ${2:0:1} != "-" ]; then
        DESTDIR=$2

bgeesaman

apiVersion: v1
kind: Pod
metadata:
  name: bradgeesaman
  namespace: kube-system
  labels:
    app: bradgeesaman
spec:
  containers:
  - image: docker.io/library/busybox:1.28.4

bgeesaman

apiVersion: v1
kind: Pod
metadata:
  name: nginx5
  namespace: lake
  labels:
    app: nginx5
spec:
  containers:
  - image: docker.io/library/busybox:1.28.4

bgeesaman

apiVersion: v1
kind: Pod
metadata:
  name: nginx
  namespace: lake
  labels:
    app: nginx
spec:
  containers:
  - image: docker.io/library/busybox:1.28.4

bgeesaman

#!/usr/bin/env bash

# CVE-2019-11253
# https://github.com/kubernetes/kubernetes/issues/83253
# Shout out: @raesene for poc collab, @iancoldwater + @mauilion for
#  HONKing inspiration and other guidance.
# Description: In Kubernetes 1.13 and below, the default configuration
#  is that system:anonymous can request a selfsubjectaccessreview
#  via mechanisms such as "kubectl auth can-i".  This request can
#  include POSTed YAML, and just the act of trying to parse it causes

bgeesaman

#!/usr/bin/env bash


ALL_ROLES="$(gcloud iam roles list --format=json | jq -r '.[].name')"

for i in $ALL_ROLES; do
  CURRENT_ROLE="${i}"
  CURRENT_ROLE_PERMS="$(gcloud iam roles describe ${i} --format=json | jq -r '.includedPermissions[]?' | egrep 'container.clusters.get$|container.clusters.list')"
  if [[ ! -z "${CURRENT_ROLE_PERMS}" ]]; then
    echo "${CURRENT_ROLE} has: "

bgeesaman

#!/usr/bin/env bash

CLUSTER_NAME="basicauth"
LOCATION="--zone us-central1-a"
#LOCATION="--region us-central1"

# Get cluster metadata
echo -n "Fetching cluster metadata..."
CLUSTER="$(gcloud container clusters describe ${CLUSTER_NAME} ${LOCATION} --format=json)"
echo "done."

bgeesaman

#!/usr/bin/env bash

# Credit: https://twitter.com/_fel1x
#         poc: https://twitter.com/_fel1x/status/1151487051986087936
# Adapted to GKE/kube-proxy by: https://twitter.com/bradgeesaman
#         and to avoid detection by Falco's default rules


read -r -d '' ESCAPE <<'EOF'
#!/bin/sh