Skip to content

Commit ea67d07

Browse files
neargleneargle
authored
Merge pull request #122 from cdk-team/main-dev
refactor(eva): registry and expose profile selection + chore(cli): drop deprecated profile flag
2 parents 02c2e5d + 2a28ae1 commit ea67d07

26 files changed

+676
-81
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,4 @@ __debug_bin
3636
/pkg/tool/kubectl/assets/
3737

3838
/cdk
39+
.cache/

‎README.md‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -75,9 +75,6 @@ Exploit:
7575
cdk run --list List all available exploits.
7676
cdk run <exploit> [<args>...] Run single exploit, docs in https://github.com/cdk-team/CDK/wiki
7777
78-
Auto Escape:
79-
cdk auto-escape <cmd> Escape container in different ways then let target execute <cmd>.
80-
8178
Tool:
8279
vi <file> Edit files in container like "vi" command.
8380
ps Show process information like "ps -ef" command.
@@ -91,6 +88,7 @@ Tool:
9188
Options:
9289
-h --help Show this help msg.
9390
-v --version Show version.
91+
--profile=<name> Select evaluation profile.
9492
```
9593

9694
## Features
@@ -107,7 +105,6 @@ Usage
107105
```
108106
cdk evaluate [--full]
109107
```
110-
This command will run the scripts below without local file scanning, using `--full` to enable all.
111108

112109
|Tactics|Script|Supported|Usage/Example|
113110
|---|---|---|---|
@@ -264,4 +261,3 @@ Project CDK is now included in 404Team [Starlink Project 2.0](https://github.com
264261
### Kubernetes community Days 2021
265262

266263
- [https://community.cncf.io/events/details/cncf-kcd-china-presents-kubernetes-community-days-china/](https://community.cncf.io/events/details/cncf-kcd-china-presents-kubernetes-community-days-china/)
267-

‎conf/evaluate_conf.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,12 @@ type cloudAPIS struct {
115115
}
116116

117117
var CloudAPI = []cloudAPIS{
118+
{
119+
CloudProvider: "Volcano Engine (Volcengine)",
120+
API: "http://100.96.0.96/latest",
121+
ResponseMatch: "instance",
122+
DocURL: "https://www.volcengine.com/docs/6396/113780",
123+
},
118124
{
119125
CloudProvider: "Alibaba Cloud",
120126
API: "http://100.100.100.200/latest/meta-data/",

‎pkg/cli/banner.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,10 +39,10 @@ Find tutorial, configuration and use-case in https://github.com/cdk-team/CDK/
3939

4040
var BannerContainerTpl = BannerHeader + `
4141
%s
42+
cdk eva
43+
cdk eva --full
4244
cdk evaluate [--full]
43-
cdk eva [--full]
4445
cdk run (--list | <exploit> [<args>...])
45-
cdk auto-escape <cmd>
4646
cdk <tool> [<args>...]
4747
4848
%s
@@ -54,7 +54,6 @@ var BannerContainerTpl = BannerHeader + `
5454
%s
5555
cdk run --list List all available exploits.
5656
cdk run <exploit> [<args>...] Run single exploit, docs in https://github.com/cdk-team/CDK/wiki
57-
cdk auto-escape <cmd> Escape container in different ways then let target execute <cmd>.
5857
5958
%s
6059
vi <file> Edit files in container like "vi" command.
@@ -70,6 +69,7 @@ var BannerContainerTpl = BannerHeader + `
7069
%s
7170
-h --help Show this help msg.
7271
-v --version Show version.
72+
--profile=<name> Select evaluation profile (basic, extended, additional).
7373
`
7474

7575
// BannerContainer is the banner of CDK command line with colorful.

‎pkg/cli/parse.go‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -59,10 +59,12 @@ func ParseCDKMain() bool {
5959
// docopt argparse start
6060
parseDocopt()
6161

62-
if Args["auto-escape"].(bool) {
63-
plugin.RunSingleTask("auto-escape")
64-
return true
65-
}
62+
// delete auto-escape
63+
64+
// if Args["auto-escape"].(bool) {
65+
// plugin.RunSingleTask("auto-escape")
66+
// return true
67+
// }
6668

6769
// support for cdk eva(Evangelion) and cdk evaluate
6870
fok := Args["evaluate"]
@@ -73,10 +75,17 @@ func ParseCDKMain() bool {
7375
if ok.(bool) || fok.(bool) {
7476

7577
fmt.Printf(BannerHeader)
76-
evaluate.CallBasics()
77-
78-
if Args["--full"].(bool) {
79-
evaluate.CallAddedFunc()
78+
profileID := evaluate.ProfileBasic
79+
if rawProfile, ok := Args["--profile"]; ok {
80+
if v, ok := rawProfile.(string); ok && v != "" {
81+
profileID = v
82+
}
83+
}
84+
if profileID == evaluate.ProfileBasic && Args["--full"].(bool) {
85+
profileID = evaluate.ProfileExtended
86+
}
87+
if err := evaluate.NewEvaluator().RunProfile(profileID, nil); err != nil {
88+
log.Printf("evaluate profile %q failed: %v", profileID, err)
8089
}
8190
return true
8291
}

‎pkg/cli/parse_test.go‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ type testArgsCase struct {
3434
successStr string
3535
}
3636

37+
const parseTimeout = 5 * time.Second
38+
3739
func doParseCDKMainWithTimeout() {
3840

3941
result := make(chan bool, 1)
@@ -43,8 +45,8 @@ func doParseCDKMainWithTimeout() {
4345
}()
4446

4547
select {
46-
case <-time.After(time.Second * 2):
47-
log.Println("check run ok, timeout in 2s, and return.")
48+
case <-time.After(parseTimeout):
49+
log.Printf("check run ok, timeout reached in %s, and return.", parseTimeout)
4850
return
4951
case <-result:
5052
return
@@ -64,6 +66,11 @@ func TestParseCDKMain(t *testing.T) {
6466
args: []string{"./cdk_cli_path", "eva"},
6567
successStr: "current user",
6668
},
69+
// {
70+
// name: "./cdk eva --profile=additional",
71+
// args: []string{"./cdk_cli_path", "eva", "--profile=additional"},
72+
// successStr: "randomize_va_space",
73+
// },
6774
{
6875
name: "./cdk run test-poc",
6976
args: []string{"./cdk_cli_path", "run", "test-poc"},

‎pkg/evaluate/available_linux_capabilities.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,3 +100,14 @@ func getAddCaps(currentCaps []string) []string {
100100
}
101101
return addCaps
102102
}
103+
104+
func init() {
105+
RegisterSimpleCheck(
106+
CategoryCommands,
107+
"commands.capabilities",
108+
"Inspect process capabilities",
109+
func() {
110+
GetProcCapabilities()
111+
},
112+
)
113+
}

‎pkg/evaluate/available_linux_commands.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,7 @@ func SearchAvailableCommands() {
3333
}
3434
log.Printf("available commands:\n\t%s\n", strings.Join(ans, ","))
3535
}
36+
37+
func init() {
38+
RegisterSimpleCheck(CategoryCommands, "commands.available", "Enumerate available commands", SearchAvailableCommands)
39+
}

‎pkg/evaluate/categories.go‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
package evaluate
2+
3+
var (
4+
CategorySystemInfo = CategorySpec{
5+
ID: "information.system",
6+
Title: "Information Gathering - System Info",
7+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
8+
Order: 100,
9+
}
10+
CategoryServices = CategorySpec{
11+
ID: "information.services",
12+
Title: "Information Gathering - Services",
13+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
14+
Order: 200,
15+
}
16+
CategoryCommands = CategorySpec{
17+
ID: "information.commands",
18+
Title: "Information Gathering - Commands and Capabilities",
19+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
20+
Order: 300,
21+
}
22+
CategoryMounts = CategorySpec{
23+
ID: "information.mounts",
24+
Title: "Information Gathering - Mounts",
25+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
26+
Order: 400,
27+
}
28+
CategoryNetNamespace = CategorySpec{
29+
ID: "information.netns",
30+
Title: "Information Gathering - Net Namespace",
31+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
32+
Order: 500,
33+
}
34+
CategorySysctl = CategorySpec{
35+
ID: "information.sysctl",
36+
Title: "Information Gathering - Sysctl Variables",
37+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
38+
Order: 600,
39+
}
40+
CategoryDNS = CategorySpec{
41+
ID: "information.dns",
42+
Title: "Information Gathering - DNS-Based Service Discovery",
43+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
44+
Order: 700,
45+
}
46+
CategoryK8sAPIServer = CategorySpec{
47+
ID: "discovery.k8s_api",
48+
Title: "Discovery - K8s API Server",
49+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
50+
Order: 800,
51+
}
52+
CategoryK8sServiceAccount = CategorySpec{
53+
ID: "discovery.k8s_sa",
54+
Title: "Discovery - K8s Service Account",
55+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
56+
Order: 900,
57+
}
58+
CategoryCloudMetadata = CategorySpec{
59+
ID: "discovery.cloud_metadata",
60+
Title: "Discovery - Cloud Provider Metadata API",
61+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
62+
Order: 1000,
63+
}
64+
CategoryKernel = CategorySpec{
65+
ID: "exploit.kernel",
66+
Title: "Exploit Pre - Kernel Exploits",
67+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
68+
Order: 1100,
69+
}
70+
CategorySensitiveFiles = CategorySpec{
71+
ID: "information.sensitive_files",
72+
Title: "Information Gathering - Sensitive Files",
73+
DefaultProfiles: []string{ProfileExtended, ProfileAdditional},
74+
Order: 1200,
75+
}
76+
CategoryASLR = CategorySpec{
77+
ID: "information.aslr",
78+
Title: "Information Gathering - ASLR",
79+
DefaultProfiles: []string{ProfileExtended, ProfileAdditional},
80+
Order: 1300,
81+
}
82+
CategoryCgroups = CategorySpec{
83+
ID: "information.cgroups",
84+
Title: "Information Gathering - Cgroups",
85+
DefaultProfiles: []string{ProfileExtended, ProfileAdditional},
86+
Order: 1400,
87+
}
88+
)

‎pkg/evaluate/cgroups.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,3 +53,7 @@ func DumpCgroup() {
5353
}
5454

5555
}
56+
57+
func init() {
58+
RegisterSimpleCheck(CategoryCgroups, "cgroups.dump", "Dump cgroup configuration", DumpCgroup)
59+
}

0 commit comments

Comments
 (0)