Skip to content

Commit f664f39

Browse files
neargleneargle
committed
refactor(eva): registry and expose profile selection
1 parent 02c2e5d commit f664f39

24 files changed

+670
-82
lines changed

‎README.md‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -63,21 +63,19 @@ chmod a+x cdk
6363
## Usage
6464
```
6565
Usage:
66-
cdk evaluate [--full]
66+
cdk evaluate [--full] [--profile=<name>]
6767
cdk run (--list | <exploit> [<args>...])
6868
cdk <tool> [<args>...]
6969
7070
Evaluate:
7171
cdk evaluate Gather information to find weakness inside container.
7272
cdk evaluate --full Enable file scan during information gathering.
73+
cdk evaluate --profile=<name> Run a specific evaluation profile (basic, extended, additional).
7374
7475
Exploit:
7576
cdk run --list List all available exploits.
7677
cdk run <exploit> [<args>...] Run single exploit, docs in https://github.com/cdk-team/CDK/wiki
7778
78-
Auto Escape:
79-
cdk auto-escape <cmd> Escape container in different ways then let target execute <cmd>.
80-
8179
Tool:
8280
vi <file> Edit files in container like "vi" command.
8381
ps Show process information like "ps -ef" command.
@@ -91,6 +89,7 @@ Tool:
9189
Options:
9290
-h --help Show this help msg.
9391
-v --version Show version.
92+
--profile=<name> Select evaluation profile.
9493
```
9594

9695
## Features
@@ -105,9 +104,9 @@ CDK has three modules:
105104

106105
Usage
107106
```
108-
cdk evaluate [--full]
107+
cdk evaluate [--full] [--profile=<name>]
109108
```
110-
This command will run the scripts below without local file scanning, using `--full` to enable all.
109+
This command runs the baseline profile by default. Use `--full` (alias for `--profile=extended`) to include file-system checks, or pick a specific profile with `--profile=basic`, `--profile=additional`, or `--profile=extended`.
111110

112111
|Tactics|Script|Supported|Usage/Example|
113112
|---|---|---|---|
@@ -264,4 +263,3 @@ Project CDK is now included in 404Team [Starlink Project 2.0](https://github.com
264263
### Kubernetes community Days 2021
265264

266265
- [https://community.cncf.io/events/details/cncf-kcd-china-presents-kubernetes-community-days-china/](https://community.cncf.io/events/details/cncf-kcd-china-presents-kubernetes-community-days-china/)
267-

‎pkg/cli/banner.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,10 +39,10 @@ Find tutorial, configuration and use-case in https://github.com/cdk-team/CDK/
3939

4040
var BannerContainerTpl = BannerHeader + `
4141
%s
42-
cdk evaluate [--full]
43-
cdk eva [--full]
42+
cdk eva
43+
cdk eva --full
44+
cdk evaluate [--full] [--profile=<name>]
4445
cdk run (--list | <exploit> [<args>...])
45-
cdk auto-escape <cmd>
4646
cdk <tool> [<args>...]
4747
4848
%s
@@ -54,7 +54,6 @@ var BannerContainerTpl = BannerHeader + `
5454
%s
5555
cdk run --list List all available exploits.
5656
cdk run <exploit> [<args>...] Run single exploit, docs in https://github.com/cdk-team/CDK/wiki
57-
cdk auto-escape <cmd> Escape container in different ways then let target execute <cmd>.
5857
5958
%s
6059
vi <file> Edit files in container like "vi" command.
@@ -70,6 +69,7 @@ var BannerContainerTpl = BannerHeader + `
7069
%s
7170
-h --help Show this help msg.
7271
-v --version Show version.
72+
--profile=<name> Select evaluation profile (basic, extended, additional).
7373
`
7474

7575
// BannerContainer is the banner of CDK command line with colorful.

‎pkg/cli/parse.go‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -59,10 +59,12 @@ func ParseCDKMain() bool {
5959
// docopt argparse start
6060
parseDocopt()
6161

62-
if Args["auto-escape"].(bool) {
63-
plugin.RunSingleTask("auto-escape")
64-
return true
65-
}
62+
// delete auto-escape
63+
64+
// if Args["auto-escape"].(bool) {
65+
// plugin.RunSingleTask("auto-escape")
66+
// return true
67+
// }
6668

6769
// support for cdk eva(Evangelion) and cdk evaluate
6870
fok := Args["evaluate"]
@@ -73,10 +75,17 @@ func ParseCDKMain() bool {
7375
if ok.(bool) || fok.(bool) {
7476

7577
fmt.Printf(BannerHeader)
76-
evaluate.CallBasics()
77-
78-
if Args["--full"].(bool) {
79-
evaluate.CallAddedFunc()
78+
profileID := evaluate.ProfileBasic
79+
if rawProfile, ok := Args["--profile"]; ok {
80+
if v, ok := rawProfile.(string); ok && v != "" {
81+
profileID = v
82+
}
83+
}
84+
if profileID == evaluate.ProfileBasic && Args["--full"].(bool) {
85+
profileID = evaluate.ProfileExtended
86+
}
87+
if err := evaluate.NewEvaluator().RunProfile(profileID, nil); err != nil {
88+
log.Printf("evaluate profile %q failed: %v", profileID, err)
8089
}
8190
return true
8291
}

‎pkg/cli/parse_test.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,11 @@ func TestParseCDKMain(t *testing.T) {
6464
args: []string{"./cdk_cli_path", "eva"},
6565
successStr: "current user",
6666
},
67+
{
68+
name: "./cdk eva --profile=additional",
69+
args: []string{"./cdk_cli_path", "eva", "--profile=additional"},
70+
successStr: "randomize_va_space",
71+
},
6772
{
6873
name: "./cdk run test-poc",
6974
args: []string{"./cdk_cli_path", "run", "test-poc"},

‎pkg/evaluate/available_linux_capabilities.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,3 +100,14 @@ func getAddCaps(currentCaps []string) []string {
100100
}
101101
return addCaps
102102
}
103+
104+
func init() {
105+
RegisterSimpleCheck(
106+
CategoryCommands,
107+
"commands.capabilities",
108+
"Inspect process capabilities",
109+
func() {
110+
GetProcCapabilities()
111+
},
112+
)
113+
}

‎pkg/evaluate/available_linux_commands.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,7 @@ func SearchAvailableCommands() {
3333
}
3434
log.Printf("available commands:\n\t%s\n", strings.Join(ans, ","))
3535
}
36+
37+
func init() {
38+
RegisterSimpleCheck(CategoryCommands, "commands.available", "Enumerate available commands", SearchAvailableCommands)
39+
}

‎pkg/evaluate/categories.go‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
package evaluate
2+
3+
var (
4+
CategorySystemInfo = CategorySpec{
5+
ID: "information.system",
6+
Title: "Information Gathering - System Info",
7+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
8+
Order: 100,
9+
}
10+
CategoryServices = CategorySpec{
11+
ID: "information.services",
12+
Title: "Information Gathering - Services",
13+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
14+
Order: 200,
15+
}
16+
CategoryCommands = CategorySpec{
17+
ID: "information.commands",
18+
Title: "Information Gathering - Commands and Capabilities",
19+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
20+
Order: 300,
21+
}
22+
CategoryMounts = CategorySpec{
23+
ID: "information.mounts",
24+
Title: "Information Gathering - Mounts",
25+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
26+
Order: 400,
27+
}
28+
CategoryNetNamespace = CategorySpec{
29+
ID: "information.netns",
30+
Title: "Information Gathering - Net Namespace",
31+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
32+
Order: 500,
33+
}
34+
CategorySysctl = CategorySpec{
35+
ID: "information.sysctl",
36+
Title: "Information Gathering - Sysctl Variables",
37+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
38+
Order: 600,
39+
}
40+
CategoryDNS = CategorySpec{
41+
ID: "information.dns",
42+
Title: "Information Gathering - DNS-Based Service Discovery",
43+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
44+
Order: 700,
45+
}
46+
CategoryK8sAPIServer = CategorySpec{
47+
ID: "discovery.k8s_api",
48+
Title: "Discovery - K8s API Server",
49+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
50+
Order: 800,
51+
}
52+
CategoryK8sServiceAccount = CategorySpec{
53+
ID: "discovery.k8s_sa",
54+
Title: "Discovery - K8s Service Account",
55+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
56+
Order: 900,
57+
}
58+
CategoryCloudMetadata = CategorySpec{
59+
ID: "discovery.cloud_metadata",
60+
Title: "Discovery - Cloud Provider Metadata API",
61+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
62+
Order: 1000,
63+
}
64+
CategoryKernel = CategorySpec{
65+
ID: "exploit.kernel",
66+
Title: "Exploit Pre - Kernel Exploits",
67+
DefaultProfiles: []string{ProfileBasic, ProfileExtended},
68+
Order: 1100,
69+
}
70+
CategorySensitiveFiles = CategorySpec{
71+
ID: "information.sensitive_files",
72+
Title: "Information Gathering - Sensitive Files",
73+
DefaultProfiles: []string{ProfileExtended, ProfileAdditional},
74+
Order: 1200,
75+
}
76+
CategoryASLR = CategorySpec{
77+
ID: "information.aslr",
78+
Title: "Information Gathering - ASLR",
79+
DefaultProfiles: []string{ProfileExtended, ProfileAdditional},
80+
Order: 1300,
81+
}
82+
CategoryCgroups = CategorySpec{
83+
ID: "information.cgroups",
84+
Title: "Information Gathering - Cgroups",
85+
DefaultProfiles: []string{ProfileExtended, ProfileAdditional},
86+
Order: 1400,
87+
}
88+
)

‎pkg/evaluate/cgroups.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,3 +53,7 @@ func DumpCgroup() {
5353
}
5454

5555
}
56+
57+
func init() {
58+
RegisterSimpleCheck(CategoryCgroups, "cgroups.dump", "Dump cgroup configuration", DumpCgroup)
59+
}

‎pkg/evaluate/check_mount_escape.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,3 +67,7 @@ func MountEscape() {
6767

6868
}
6969
}
70+
71+
func init() {
72+
RegisterSimpleCheck(CategoryMounts, "mounts.escape", "Inspect mount escape opportunities", MountEscape)
73+
}

‎pkg/evaluate/cloud_metadata_api.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,3 +43,7 @@ func CheckCloudMetadataAPI() {
4343
}
4444
}
4545
}
46+
47+
func init() {
48+
RegisterSimpleCheck(CategoryCloudMetadata, "cloud.metadata_api", "Probe cloud metadata API endpoints", CheckCloudMetadataAPI)
49+
}

0 commit comments

Comments
 (0)