fix #71 (exp): k8s-shadow-apiserver check apiserver error in invalid to list pods

neargle · neargle · commit 93fa6157bcd8 · 2023-01-01T22:56:02.000+08:00
diff --git a/pkg/exploit/k8s_shadow_apiserver.go b/pkg/exploit/k8s_shadow_apiserver.go
@@ -61,7 +61,7 @@ func findApiServerPodInMasterNode(token string, serverAddr string) (string, erro
 		log.Printf("request apiserver uri `%s` error: %v, response: %s", opts.Api, err, resp)
 		return "", errors.New("faild to request api-server.")
 	}
-	if !strings.Contains(resp, "selfLink") {
+	if !strings.Contains(resp, "selfLink") && !strings.Contains(resp, "kube-apiserver") {
 		log.Println("api-server response:")
 		fmt.Println(resp)
 		return "", errors.New("invalid to list pods, possible caused by api-server forbidden this request.")

Original file line number	Diff line number	Diff line change
`@@ -61,7 +61,7 @@ func findApiServerPodInMasterNode(token string, serverAddr string) (string, erro`
`61`	`61`	log.Printf("request apiserver uri `%s` error: %v, response: %s", opts.Api, err, resp)
`62`	`62`	`return "", errors.New("faild to request api-server.")`
`63`	`63`	`}`
`64`		`- if !strings.Contains(resp, "selfLink") {`
	`64`	`+ if !strings.Contains(resp, "selfLink") && !strings.Contains(resp, "kube-apiserver") {`
`65`	`65`	`log.Println("api-server response:")`
`66`	`66`	`fmt.Println(resp)`
`67`	`67`	`return "", errors.New("invalid to list pods, possible caused by api-server forbidden this request.")`