{"vulnerability": "cve-2018-1002105", "sightings": [{"uuid": "76eb7762-2426-4351-a297-3fd7b8ea25f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "seen", "source": "MISP/5c0a9495-4b38-4815-a223-767d0a021402", "content": "", "creation_timestamp": "2018-12-07T15:46:04.000000Z"}, {"uuid": "f2e29acb-40f6-4aa5-934c-9c82e617e7e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "seen", "source": "https://gist.github.com/kotamat/c6081cf96d211253e42f5862dc7eb917", "content": "", "creation_timestamp": "2025-02-12T22:43:06.000000Z"}, {"uuid": "897ee521-6b4f-4faa-a2f9-4bb1c004c7c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "seen", "source": "https://gist.github.com/batamimam08-netizen/9b175a7367548d791fd35c6f470b7fac", "content": "", "creation_timestamp": "2025-12-01T20:45:56.000000Z"}, {"uuid": "9fbb28bd-ab31-4532-bb7a-a6ff289f9c46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "seen", "source": "https://gist.github.com/namishelex01/c45e91ffc78335e7a096670758f310e6", "content": "", "creation_timestamp": "2025-12-17T18:58:48.000000Z"}, {"uuid": "3168de0e-06fe-408d-8c9e-a5690cf188e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "published-proof-of-concept", "source": "https://t.me/antichat/2997", "content": "#kubernetes #exploit #\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Kubernetes\n\n\u0416\u0443\u0442\u043a\u043e\u0432\u0430\u0442\u0430\u044f \u0434\u044b\u0440\u0430 CVE-2018-1002105: \u043f\u043e\u0441\u043b\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 API \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0441\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043c\u043e\u0436\u043d\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c discovery-\u0437\u0430\u043f\u0440\u043e\u0441. \u041f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 API \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0431\u0443\u0434\u0443\u0442 \u0432\u043e\u0441\u043f\u0440\u0438\u043d\u044f\u0442\u044b \u0431\u044d\u043a\u0435\u043d\u0434-\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438 \u043a\u0430\u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043e\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 API, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 API. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0441 \u0431\u044d\u043a\u0435\u043d\u0434\u043e\u043c, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434. \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e discovery-\u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0434\u0430\u0436\u0435 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043e\u043f\u0446\u0438\u0435\u0439 \"--anonymous-auth=false\".\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u043c \u043f\u0440\u043e\u043a\u0441\u0438 \u0432 \u0444\u0440\u043e\u043d\u0442\u0435\u043d\u0434\u0435 Kubernetes. \u041a\u043e\u0433\u0434\u0430 \u043e\u043d \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u0443 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f \u0432\u0435\u0431\u0441\u043e\u043a\u0435\u0442\u0430, \u0442\u043e \u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u043e\u0442\u0432\u0435\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438 \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u0434\u0430\u0436\u0435 \u043f\u0440\u0438 \u043e\u0442\u0432\u0435\u0442\u0435 404. \u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043f\u0440\u0438\u0434\u0435\u0442 404, \u043d\u043e \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u0432\u0441\u0435 \u0440\u0430\u0432\u043d\u043e \u0431\u0443\u0434\u0435\u0442 \u043e\u0442\u043a\u0440\u044b\u0442\u043e. \u041f\u0440\u0438\u0447\u0435\u043c \u043f\u0440\u043e\u043a\u0441\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c\u0438 \u043a\u0440\u0435\u0434\u0430\u043c\u0438, \u0447\u0435\u0433\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0434\u043b\u044f \u043c\u043d\u043e\u0433\u0438\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0431\u044d\u043a\u0435\u043d\u0434\u043e\u0432 \u0434\u0430\u0436\u0435 \u0431\u0435\u0437 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 1.10.11, 1.11.5, 1.12.3 \u0438 \u043d\u043e\u0432\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 1.13.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0431\u0430\u0433\u0430: https://rancher.com/blog/2018/2018-12-04-k8s-cve/\n\u041f\u0440\u0438\u043c\u0435\u0440 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430: https://github.com/evict/poc_CVE-2018-1002105", "creation_timestamp": "2018-12-12T19:03:24.000000Z"}, {"uuid": "3239710e-c572-4187-9096-38c6ae5886f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "published-proof-of-concept", "source": "https://t.me/antichat/2932", "content": "poc_CVE-2018-1002105\nhttps://github.com/evict/poc_CVE-2018-1002105", "creation_timestamp": "2018-12-07T12:04:22.000000Z"}, {"uuid": "96db186a-bad0-4963-a2fb-e0b91739a5ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "seen", "source": "https://t.me/CyberGovIL/276", "content": "\u05e4\u05d2\u05d9\u05e2\u05d5\u05ea \u05e7\u05e8\u05d9\u05d8\u05d9\u05ea \u05d1\u05e9\u05e8\u05ea Kubernetes\nhttps://www.gov.il/he/Departments/publications/reports/kubernetes\n\n\u05e4\u05d5\u05e8\u05e1\u05dd \u05e2\u05d3\u05db\u05d5\u05df \u05ea\u05d5\u05db\u05e0\u05d4 \u05e2\u05d1\u05d5\u05e8 \u05e9\u05e8\u05ea\u05d9 Kubernetes, \u05e2\u05d1\u05d5\u05e8 \u05e4\u05d2\u05d9\u05e2\u05d5\u05ea \u05e7\u05e8\u05d9\u05d8\u05d9\u05ea CVE-2018-1002105 \u05d4\u05de\u05d0\u05e4\u05e9\u05e8\u05ea \u05dc\u05ea\u05d5\u05e7\u05e3 \u05dc\u05e9\u05dc\u05d5\u05d7 \u05d1\u05e7\u05e9\u05d5\u05ea \u05d3\u05e8\u05da \u05e9\u05e8\u05ea \u05d4- API \u05e9\u05dc Kubernetes, \u05d0\u05dc \u05e9\u05e8\u05ea \u05d4- Backend (\u05d4\u05e9\u05e8\u05ea \u05d4\u05de\u05e0\u05d5\u05d4\u05dc).", "creation_timestamp": "2018-12-31T07:57:09.000000Z"}, {"uuid": "771c8b64-6682-451a-917f-c17d0b2eed9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "published-proof-of-concept", "source": "https://t.me/canyoupwnme/4848", "content": "poc_CVE-2018-1002105\nhttps://github.com/evict/poc_CVE-2018-1002105", "creation_timestamp": "2018-12-07T13:01:03.000000Z"}, {"uuid": "690e7745-9e7c-436c-b382-5146eeed4934", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "published-proof-of-concept", "source": "https://t.me/canyoupwnme/4852", "content": "Demystifying Kubernetes CVE-2018-1002105 (and a dead simple exploit)\nhttps://www.twistlock.com/labs-blog/demystifying-kubernetes-cve-2018-1002105-dead-simple-exploit/", "creation_timestamp": "2018-12-09T19:31:14.000000Z"}, {"uuid": "062777e2-a9a6-4682-9246-ce04fc8567a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "exploited", "source": "https://t.me/SecLabNews/3820", "content": "\u041d\u043e\u0432\u043e\u0441\u0442\u044c \u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Kubernetes (CVE-2018-1002105) \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e \u0432\u0441\u043a\u043e\u043b\u044b\u0445\u043d\u0443\u043b\u0430 \u0418\u0411-\u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0438 \u043d\u0435\u0441\u043f\u0440\u043e\u0441\u0442\u0430. \u041a \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u043c\u0443 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u0443\u0436\u0435 \u0446\u0435\u043b\u044b\u0439 \u0440\u044f\u0434 \u0434\u0435\u043c\u043e-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u0434\u043b\u044f \u043d\u0435\u0435 \u0432 \u0441\u043e\u0432\u043e\u043a\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f\u043c\u0438.    \n\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Kubernetes", "creation_timestamp": "2018-12-11T10:28:26.000000Z"}, {"uuid": "0838834a-1437-4dc4-af99-e23f4990f8d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "seen", "source": "https://t.me/nonamepodcast/530", "content": "Friday random episode!\n\n\u0415\u043f\u0456\u0437\u043e\u0434 29. \u0421(\u0438|\u0435)\u0440\u0446\u0456\n\n\u041a\u0456\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043d\u043e\u0442\u0430\u0440\u0456\u0443\u0441\u0456\u0432 \u0447\u0438 \u043d\u0430\u043f\u0430\u0434 \u043d\u0430 \u0423\u043a\u0440\u0430\u0457\u043d\u0443?\nPost-mortem for Kubernetes CVE-2018-1002105\nSurveillance Kills Freedom By Killing Experimentation\nCommon-Knowledge Attacks on Democracy by Henry Farrell, Bruce Schneier\nLet them paste passwords \u2013 NCSC\nEquifax\u2026\n\nhttps://nonamepodcast.org/podcast/29-sources/", "creation_timestamp": "2026-08-12T18:00:03.881384Z"}, {"uuid": "6087bb22-c6bb-4797-8f81-15d387f8237d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "published-proof-of-concept", "source": "https://t.me/nonamepodcast/530", "content": "Friday random episode!\n\n\u0415\u043f\u0456\u0437\u043e\u0434 29. \u0421(\u0438|\u0435)\u0440\u0446\u0456\n\n\u041a\u0456\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043d\u043e\u0442\u0430\u0440\u0456\u0443\u0441\u0456\u0432 \u0447\u0438 \u043d\u0430\u043f\u0430\u0434 \u043d\u0430 \u0423\u043a\u0440\u0430\u0457\u043d\u0443?\nPost-mortem for Kubernetes CVE-2018-1002105\nSurveillance Kills Freedom By Killing Experimentation\nCommon-Knowledge Attacks on Democracy by Henry Farrell, Bruce Schneier\nLet them paste passwords \u2013 NCSC\nEquifax\u2026\n\nhttps://nonamepodcast.org/podcast/29-sources/", "creation_timestamp": "2026-08-13T00:00:07.215816Z"}, {"uuid": "61e79f5d-3435-469a-bbaa-a3e532492683", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "seen", "source": "https://t.me/hacking_Attack/11443", "content": "Run ./metarget appv list to see vulnerable scenes related to cloud native applications supported currently.  Note:  Before deploying application vulnerable scenes, you should install Docker and Kubernetes firstly. You can use Metarget to install Docker and Kubernetes.  \n2.4.1 Case: DVWA\n  Run:  ./metarget appv install dvwa  If the command above completes successfully, DVWA (https://github.com/digininja/DVWA) will be deployed as Deployment and Service resources in current Kubernetes.  Note:  You can specify --external option, then the service will be exposed as NodePort, so that you can visit it by IP of the host node.  By default, the type of service is ClusterIP.  \n2.5 Manage Vulnerable Cloud Native Target Cluster\n  Developing, currently not supported.  \n3 Installation\n  \n3.1 Requirements\n    Ubuntu 16.04 or 18.04  Python >= 3.5  pip3    \n3.2 From Source\n  Clone the repository and install requirements:  git clone https://github.com/brant-ruan/metarget.git\ncd metarget/\npip install -r requirements.txt  Begin to use Metarget and construct vulnerable scenes. For example:  ./metarget cnv install cve-2019-5736  \n3.3 From PyPI\n  Currently unsupported.  \n4 Scene List\n  \n4.1 Vulnerable Scenes Related to Cloud Native Components\n    Name  Class  Type  CVSS 3.x  Status      cve-2018-15664 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2018-15664.yaml)  docker  container_escape  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2018-15664)  \u2705      cve-2019-13139 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-13139.yaml)  docker  command_execution  8.4 (https://nvd.nist.gov/vuln/detail/CVE-2019-13139)  \u2705      cve-2019-14271 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-14271.yaml)  docker  container_escape  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2019-14271)  \u2705      cve-2020-15257 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2020-15257.yaml)  docker/containerd  container_escape  5.2 (https://nvd.nist.gov/vuln/detail/CVE-2020-15257)  \u2705      cve-2019-5736 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-5736.yaml)  docker/runc  container_escape  8.6 (https://nvd.nist.gov/vuln/detail/CVE-2019-5736)  \u2705      cve-2017-1002101 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2017-1002101.yaml)  kubernetes  container_escape  9.6 (https://nvd.nist.gov/vuln/detail/CVE-2017-1002101)  \u2705      cve-2018-1002105 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2018-1002105.yaml)  kubernetes  privilege_escalation  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2018-1002105)  \u2705      cve-2019-11253 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-11253.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-11253)  \u2705      cve-2019-9512 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9512.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9512)  \u2705      cve-2019-9514 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9514.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9514)  \u2705      cve-2020-8554 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8554.yaml)  kubernetes  man_in_the_middle  5.0 (https://nvd.nist.gov/vuln/detail/CVE-2020-8554)  \u2705      cve-2020-8557 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8557.yaml)  kubernetes  denial_of_service  5.5 (https://nvd.nist.gov/vuln/detail/CVE-2020-8557)  \u2705      cve-2020-8558 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8558.yaml)  kubernetes  exposure_of_service  8.8 (https://nvd.nist.gov/vuln/detail/CVE-2020-8558)  \u2705      cve-2016-5195 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kernel/cve-2016-5195.yaml)  kernel", "creation_timestamp": "2026-09-01T20:02:39.014659Z"}, {"uuid": "51457efd-5cd4-4c9d-882a-3288d4c829ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "seen", "source": "https://t.me/hacking_Attack/11442", "content": "2.2 Manage Cloud Native (https://www.kitploit.com/search/label/Cloud%20Native) Components\n  usage: metarget gadget [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported gadgets\n    install   install gadgets\n    remove    uninstall gadgets\n\noptional arguments:\n  -h, --help  show this help message and exit\n  \n2.2.1 Case: Install Docker with Specified Version\n  Run:  ./metarget gadget install docker --version 18.03.1  If the command above completes successfully, 18.03.1 Docker will be installed.  \n2.2.2 Case: Install Kubernetes with Specified Version\n  Run:  ./metarget gadget install k8s --version 1.16.5  If the command above completes successfully, 1.16.5 Kubernetes single-node cluster will be installed.  Note:  Usually, lots of options need to be configured in Kubernetes. As a security research project, Metarget provides some options for installation of Kubernetes:    -v VERSION, --version VERSION\n                        gadget version\n  --cni-plugin CNI_PLUGIN\n                        cni plugin, flannel by default\n  --pod-network-cidr POD_NETWORK_CIDR\n                        pod network cidr, default cidr for each plugin by\n                        default\n  --taint-master        taint master node or not\n  Metarget supports deployment of multi-node cluster. If you want to add more nodes into the cluster, you can copy tools/install_k8s_worker.sh script and run it on each worker nodes after the successful installation of single-node cluster.  \n2.2.3 Case: Install Kata-containers with Specified Version\n  Run:  ./metarget gadget install kata --version 1.10.0  If the command above completes successfully, 1.10.0 Kata-containers will be installed.  Note:  You can also specify the type of kata runtime (qemu/clh/fc/...) with --kata-runtime-type option, which is qemu by default.  \n2.2.4 Case: Install Linux Kernel (https://www.kitploit.com/search/label/Linux%20Kernel) with Specified Version\n  Run:  ./metarget gadget install kernel --version 5.7.5  If the command above completes successfully, 5.7.5 kernel will be installed.  Note:  Currently, Metarget install kernels in 2 ways:    apt  if apt package is not available, download *.deb remotely from Ubuntu and try to install    After successful installation of kernel, reboot of system is needed. Metarget will prompt to reboot automatically.  \n2.3 Manage Vulnerable Scenes Related to Cloud Native Components\n  usage: metarget cnv [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported cloud native vulnerabilities\n    install   install cloud native vulnerabilities\n    remove    uninstall cloud native vulnerabilities\n\noptional arguments:\n  -h, --help  show this help message and exit\n  Run ./metarget cnv list to see vulnerable scenes related to cloud native components supported currently.  \n2.3.1 Case: CVE-2019-5736\n  Run:  ./metarget cnv install cve-2019-5736  If the command above completes successfully, Docker with CVE-2019-5736 will be installed\u3002  \n2.3.2 Case: CVE-2018-1002105\n  Run:  ./metarget cnv install cve-2018-1002105  If the command above completes successfully, Kubernetes with CVE-2018-1002105 will be installed\u3002  \n2.3.3 Case: Kata-containers Escape\n  Run:  ./metarget cnv install kata-escape-2020  If the command above completes successfully, Kata-containers with CVE-2020-2023/2025/2026 will be installed\u3002  \n2.3.4 Case: CVE-2016-5195\n  Run:  ./metarget cnv install cve-2016-5195  If the command above completes successfully, kernel with CVE-2016-5195 will be installed\u3002  \n2.4 Manage Vulnerable Scenes Related to Cloud Native Applications\n  usage: metarget appv [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported application vulnerabilities\n    install   install application vulnerabilities\n    remove    uninstall application vulnerabilities\n\noptional arguments:\n  -h, --help  show this help message and exit", "creation_timestamp": "2026-09-01T20:02:39.411473Z"}, {"uuid": "d580bddd-505c-4a8c-a7fd-e9e52d81736c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "seen", "source": "https://t.me/hacking_Attack/11441", "content": "1 Introduction\n  Metarget = meta- + target, a framework providing automatic constructions of vulnerable infrastructures, used to deploy simple or complicated vulnerable cloud native targets swiftly and automatically.  \n1.1 Why Metarget?\n  During security researches, we might find that the deployment of vulnerable environment often takes much time, while the time spent on testing PoC or ExP is comparatively short. In the field of cloud native security, thanks to the complexity of cloud native systems, this issue is more terrible.  There are already some excellent security projects like Vulhub (https://github.com/vulhub/vulhub), VulApps (https://github.com/Medicean/VulApps) in the open-source community, which pack vulnerable scenes into container images, so that researchers could utilize them and deploy scenes quickly.  However, these projects mainly focus on vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) in applications. What if we need to study the vulnerabilities in the infrastructures like Docker, Kubernetes and even Linux kernel?  Hence, we develop Metarget and hope to solve the deployment issue above to some extent. Furthermore, we also expect that Metarget could help to construct multilayer vulnerable cloud native scenes automatically.  \n1.2 Install Vulnerability!\n  In this project, we come up with concepts like installing vulnerabilities and installing vulnerable scenes. Why not install vulnerabilities just like installing softwares? We can do that, because our goals are security research and offensive security.  To be exact, we expect that:    metarget cnv install cve-2019-5736 will install Docker with CVE-2019-5736 onto the server.  metarget cnv install cve-2018-1002105 will install Kubernetes with CVE-2018-1002105 onto the server.  metarget cnv install kata-escape-2020 will install Kata-containers with CVE-2020-2023/2025/2026 onto the server.  metarget cnv install cve-2016-5195 will install a kernel with DirtyCoW into the server.    It's cool, right? No more steps. No RTFM. Execute one command and enjoy your coffee.  Furthermore, we expect that:    with Metarget's help, ethical hackers are able to deploy simple or complicated cloud native targets swiftly and learn by hacking cloud native environments.  metarget appv install dvwa will install a DVWA (https://github.com/digininja/DVWA) target onto our vulnerable infrastructure.  metarget appv install thinkphp-5-0-23-rce --external will install a ThinkPHP RCE vulnerability (https://www.kitploit.com/search/label/Vulnerability) with NodePort service onto our vulnerable infrastructure.    You can just run 5 commands below after installing a new Ubuntu and obtain a multi-layer vulnerable scene:  ./metarget cnv install cve-2016-5195 # container escape with dirtyCoW\n./metarget cnv install cve-2019-5736 # container escape with docker\n./metarget cnv install cve-2018-1002105 # kubernetes single-node cluster with cve-2018-1002105\n./metarget cnv install privileged-container # deploy a privileged container\n./metarget appv install dvwa --external # deploy dvwa target  RCE, container escape, lateral movement, persistence, they are yours now.  More awesome functions are coming! Stay tuned :)  Note:  Thie project aims to provide vulnerable scenes for security research. The security of scenes generated is not guaranteed. It is NOT recommended to deploy components or scenes with Metarget on the Internet.  \n2 Usage\n  \n2.1 Basic Usage\n  usage: metarget [-h] [-v] subcommand ...\n\nautomatic constructions of vulnerable infrastructures\n\npositional arguments:\n  subcommand     description\n    gadget       cloud native gadgets (docker/k8s/...) management\n    cnv          cloud native vulnerabilities management\n    appv         application vulnerabilities management\n\noptional arguments:\n  -h, --help     show this help message and exit\n  -v, --version  show program's version number and exit\n  Run ./metarget gadget list to see cloud native components supported currently.", "creation_timestamp": "2026-09-01T20:02:40.074640Z"}, {"uuid": "4fa8d3eb-8f25-44a6-ba98-0f748f589a7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "seen", "source": "https://t.me/hacking_Attack/11441", "content": "1 Introduction\n  Metarget = meta- + target, a framework providing automatic constructions of vulnerable infrastructures, used to deploy simple or complicated vulnerable cloud native targets swiftly and automatically.  \n1.1 Why Metarget?\n  During security researches, we might find that the deployment of vulnerable environment often takes much time, while the time spent on testing PoC or ExP is comparatively short. In the field of cloud native security, thanks to the complexity of cloud native systems, this issue is more terrible.  There are already some excellent security projects like Vulhub (https://github.com/vulhub/vulhub), VulApps (https://github.com/Medicean/VulApps) in the open-source community, which pack vulnerable scenes into container images, so that researchers could utilize them and deploy scenes quickly.  However, these projects mainly focus on vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) in applications. What if we need to study the vulnerabilities in the infrastructures like Docker, Kubernetes and even Linux kernel?  Hence, we develop Metarget and hope to solve the deployment issue above to some extent. Furthermore, we also expect that Metarget could help to construct multilayer vulnerable cloud native scenes automatically.  \n1.2 Install Vulnerability!\n  In this project, we come up with concepts like installing vulnerabilities and installing vulnerable scenes. Why not install vulnerabilities just like installing softwares? We can do that, because our goals are security research and offensive security.  To be exact, we expect that:    metarget cnv install cve-2019-5736 will install Docker with CVE-2019-5736 onto the server.  metarget cnv install cve-2018-1002105 will install Kubernetes with CVE-2018-1002105 onto the server.  metarget cnv install kata-escape-2020 will install Kata-containers with CVE-2020-2023/2025/2026 onto the server.  metarget cnv install cve-2016-5195 will install a kernel with DirtyCoW into the server.    It's cool, right? No more steps. No RTFM. Execute one command and enjoy your coffee.  Furthermore, we expect that:    with Metarget's help, ethical hackers are able to deploy simple or complicated cloud native targets swiftly and learn by hacking cloud native environments.  metarget appv install dvwa will install a DVWA (https://github.com/digininja/DVWA) target onto our vulnerable infrastructure.  metarget appv install thinkphp-5-0-23-rce --external will install a ThinkPHP RCE vulnerability (https://www.kitploit.com/search/label/Vulnerability) with NodePort service onto our vulnerable infrastructure.    You can just run 5 commands below after installing a new Ubuntu and obtain a multi-layer vulnerable scene:  ./metarget cnv install cve-2016-5195 # container escape with dirtyCoW\n./metarget cnv install cve-2019-5736 # container escape with docker\n./metarget cnv install cve-2018-1002105 # kubernetes single-node cluster with cve-2018-1002105\n./metarget cnv install privileged-container # deploy a privileged container\n./metarget appv install dvwa --external # deploy dvwa target  RCE, container escape, lateral movement, persistence, they are yours now.  More awesome functions are coming! Stay tuned :)  Note:  Thie project aims to provide vulnerable scenes for security research. The security of scenes generated is not guaranteed. It is NOT recommended to deploy components or scenes with Metarget on the Internet.  \n2 Usage\n  \n2.1 Basic Usage\n  usage: metarget [-h] [-v] subcommand ...\n\nautomatic constructions of vulnerable infrastructures\n\npositional arguments:\n  subcommand     description\n    gadget       cloud native gadgets (docker/k8s/...) management\n    cnv          cloud native vulnerabilities management\n    appv         application vulnerabilities management\n\noptional arguments:\n  -h, --help     show this help message and exit\n  -v, --version  show program's version number and exit\n  Run ./metarget gadget list to see cloud native components supported currently.", "creation_timestamp": "2026-09-02T01:03:16.735745Z"}, {"uuid": "781e370c-920c-4c9f-a516-6a63b057a54d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "seen", "source": "https://t.me/hacking_Attack/11443", "content": "Run ./metarget appv list to see vulnerable scenes related to cloud native applications supported currently.  Note:  Before deploying application vulnerable scenes, you should install Docker and Kubernetes firstly. You can use Metarget to install Docker and Kubernetes.  \n2.4.1 Case: DVWA\n  Run:  ./metarget appv install dvwa  If the command above completes successfully, DVWA (https://github.com/digininja/DVWA) will be deployed as Deployment and Service resources in current Kubernetes.  Note:  You can specify --external option, then the service will be exposed as NodePort, so that you can visit it by IP of the host node.  By default, the type of service is ClusterIP.  \n2.5 Manage Vulnerable Cloud Native Target Cluster\n  Developing, currently not supported.  \n3 Installation\n  \n3.1 Requirements\n    Ubuntu 16.04 or 18.04  Python >= 3.5  pip3    \n3.2 From Source\n  Clone the repository and install requirements:  git clone https://github.com/brant-ruan/metarget.git\ncd metarget/\npip install -r requirements.txt  Begin to use Metarget and construct vulnerable scenes. For example:  ./metarget cnv install cve-2019-5736  \n3.3 From PyPI\n  Currently unsupported.  \n4 Scene List\n  \n4.1 Vulnerable Scenes Related to Cloud Native Components\n    Name  Class  Type  CVSS 3.x  Status      cve-2018-15664 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2018-15664.yaml)  docker  container_escape  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2018-15664)  \u2705      cve-2019-13139 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-13139.yaml)  docker  command_execution  8.4 (https://nvd.nist.gov/vuln/detail/CVE-2019-13139)  \u2705      cve-2019-14271 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-14271.yaml)  docker  container_escape  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2019-14271)  \u2705      cve-2020-15257 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2020-15257.yaml)  docker/containerd  container_escape  5.2 (https://nvd.nist.gov/vuln/detail/CVE-2020-15257)  \u2705      cve-2019-5736 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-5736.yaml)  docker/runc  container_escape  8.6 (https://nvd.nist.gov/vuln/detail/CVE-2019-5736)  \u2705      cve-2017-1002101 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2017-1002101.yaml)  kubernetes  container_escape  9.6 (https://nvd.nist.gov/vuln/detail/CVE-2017-1002101)  \u2705      cve-2018-1002105 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2018-1002105.yaml)  kubernetes  privilege_escalation  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2018-1002105)  \u2705      cve-2019-11253 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-11253.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-11253)  \u2705      cve-2019-9512 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9512.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9512)  \u2705      cve-2019-9514 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9514.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9514)  \u2705      cve-2020-8554 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8554.yaml)  kubernetes  man_in_the_middle  5.0 (https://nvd.nist.gov/vuln/detail/CVE-2020-8554)  \u2705      cve-2020-8557 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8557.yaml)  kubernetes  denial_of_service  5.5 (https://nvd.nist.gov/vuln/detail/CVE-2020-8557)  \u2705      cve-2020-8558 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8558.yaml)  kubernetes  exposure_of_service  8.8 (https://nvd.nist.gov/vuln/detail/CVE-2020-8558)  \u2705      cve-2016-5195 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kernel/cve-2016-5195.yaml)  kernel", "creation_timestamp": "2026-09-02T01:03:14.939484Z"}, {"uuid": "fd53ecfe-31b8-4b33-a7f7-232d2554181a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "seen", "source": "https://t.me/hacking_Attack/11442", "content": "2.2 Manage Cloud Native (https://www.kitploit.com/search/label/Cloud%20Native) Components\n  usage: metarget gadget [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported gadgets\n    install   install gadgets\n    remove    uninstall gadgets\n\noptional arguments:\n  -h, --help  show this help message and exit\n  \n2.2.1 Case: Install Docker with Specified Version\n  Run:  ./metarget gadget install docker --version 18.03.1  If the command above completes successfully, 18.03.1 Docker will be installed.  \n2.2.2 Case: Install Kubernetes with Specified Version\n  Run:  ./metarget gadget install k8s --version 1.16.5  If the command above completes successfully, 1.16.5 Kubernetes single-node cluster will be installed.  Note:  Usually, lots of options need to be configured in Kubernetes. As a security research project, Metarget provides some options for installation of Kubernetes:    -v VERSION, --version VERSION\n                        gadget version\n  --cni-plugin CNI_PLUGIN\n                        cni plugin, flannel by default\n  --pod-network-cidr POD_NETWORK_CIDR\n                        pod network cidr, default cidr for each plugin by\n                        default\n  --taint-master        taint master node or not\n  Metarget supports deployment of multi-node cluster. If you want to add more nodes into the cluster, you can copy tools/install_k8s_worker.sh script and run it on each worker nodes after the successful installation of single-node cluster.  \n2.2.3 Case: Install Kata-containers with Specified Version\n  Run:  ./metarget gadget install kata --version 1.10.0  If the command above completes successfully, 1.10.0 Kata-containers will be installed.  Note:  You can also specify the type of kata runtime (qemu/clh/fc/...) with --kata-runtime-type option, which is qemu by default.  \n2.2.4 Case: Install Linux Kernel (https://www.kitploit.com/search/label/Linux%20Kernel) with Specified Version\n  Run:  ./metarget gadget install kernel --version 5.7.5  If the command above completes successfully, 5.7.5 kernel will be installed.  Note:  Currently, Metarget install kernels in 2 ways:    apt  if apt package is not available, download *.deb remotely from Ubuntu and try to install    After successful installation of kernel, reboot of system is needed. Metarget will prompt to reboot automatically.  \n2.3 Manage Vulnerable Scenes Related to Cloud Native Components\n  usage: metarget cnv [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported cloud native vulnerabilities\n    install   install cloud native vulnerabilities\n    remove    uninstall cloud native vulnerabilities\n\noptional arguments:\n  -h, --help  show this help message and exit\n  Run ./metarget cnv list to see vulnerable scenes related to cloud native components supported currently.  \n2.3.1 Case: CVE-2019-5736\n  Run:  ./metarget cnv install cve-2019-5736  If the command above completes successfully, Docker with CVE-2019-5736 will be installed\u3002  \n2.3.2 Case: CVE-2018-1002105\n  Run:  ./metarget cnv install cve-2018-1002105  If the command above completes successfully, Kubernetes with CVE-2018-1002105 will be installed\u3002  \n2.3.3 Case: Kata-containers Escape\n  Run:  ./metarget cnv install kata-escape-2020  If the command above completes successfully, Kata-containers with CVE-2020-2023/2025/2026 will be installed\u3002  \n2.3.4 Case: CVE-2016-5195\n  Run:  ./metarget cnv install cve-2016-5195  If the command above completes successfully, kernel with CVE-2016-5195 will be installed\u3002  \n2.4 Manage Vulnerable Scenes Related to Cloud Native Applications\n  usage: metarget appv [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported application vulnerabilities\n    install   install application vulnerabilities\n    remove    uninstall application vulnerabilities\n\noptional arguments:\n  -h, --help  show this help message and exit", "creation_timestamp": "2026-09-02T01:03:15.205188Z"}, {"uuid": "1320f181-412e-4646-85e1-b2839fd3582f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/11443", "content": "Run ./metarget appv list to see vulnerable scenes related to cloud native applications supported currently.  Note:  Before deploying application vulnerable scenes, you should install Docker and Kubernetes firstly. You can use Metarget to install Docker and Kubernetes.  \n2.4.1 Case: DVWA\n  Run:  ./metarget appv install dvwa  If the command above completes successfully, DVWA (https://github.com/digininja/DVWA) will be deployed as Deployment and Service resources in current Kubernetes.  Note:  You can specify --external option, then the service will be exposed as NodePort, so that you can visit it by IP of the host node.  By default, the type of service is ClusterIP.  \n2.5 Manage Vulnerable Cloud Native Target Cluster\n  Developing, currently not supported.  \n3 Installation\n  \n3.1 Requirements\n    Ubuntu 16.04 or 18.04  Python >= 3.5  pip3    \n3.2 From Source\n  Clone the repository and install requirements:  git clone https://github.com/brant-ruan/metarget.git\ncd metarget/\npip install -r requirements.txt  Begin to use Metarget and construct vulnerable scenes. For example:  ./metarget cnv install cve-2019-5736  \n3.3 From PyPI\n  Currently unsupported.  \n4 Scene List\n  \n4.1 Vulnerable Scenes Related to Cloud Native Components\n    Name  Class  Type  CVSS 3.x  Status      cve-2018-15664 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2018-15664.yaml)  docker  container_escape  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2018-15664)  \u2705      cve-2019-13139 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-13139.yaml)  docker  command_execution  8.4 (https://nvd.nist.gov/vuln/detail/CVE-2019-13139)  \u2705      cve-2019-14271 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-14271.yaml)  docker  container_escape  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2019-14271)  \u2705      cve-2020-15257 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2020-15257.yaml)  docker/containerd  container_escape  5.2 (https://nvd.nist.gov/vuln/detail/CVE-2020-15257)  \u2705      cve-2019-5736 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-5736.yaml)  docker/runc  container_escape  8.6 (https://nvd.nist.gov/vuln/detail/CVE-2019-5736)  \u2705      cve-2017-1002101 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2017-1002101.yaml)  kubernetes  container_escape  9.6 (https://nvd.nist.gov/vuln/detail/CVE-2017-1002101)  \u2705      cve-2018-1002105 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2018-1002105.yaml)  kubernetes  privilege_escalation  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2018-1002105)  \u2705      cve-2019-11253 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-11253.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-11253)  \u2705      cve-2019-9512 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9512.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9512)  \u2705      cve-2019-9514 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9514.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9514)  \u2705      cve-2020-8554 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8554.yaml)  kubernetes  man_in_the_middle  5.0 (https://nvd.nist.gov/vuln/detail/CVE-2020-8554)  \u2705      cve-2020-8557 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8557.yaml)  kubernetes  denial_of_service  5.5 (https://nvd.nist.gov/vuln/detail/CVE-2020-8557)  \u2705      cve-2020-8558 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8558.yaml)  kubernetes  exposure_of_service  8.8 (https://nvd.nist.gov/vuln/detail/CVE-2020-8558)  \u2705      cve-2016-5195 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kernel/cve-2016-5195.yaml)  kernel", "creation_timestamp": "2026-09-08T04:00:04.433153Z"}, {"uuid": "b12db75f-056c-4e7f-98a5-fb85346575dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/11441", "content": "1 Introduction\n  Metarget = meta- + target, a framework providing automatic constructions of vulnerable infrastructures, used to deploy simple or complicated vulnerable cloud native targets swiftly and automatically.  \n1.1 Why Metarget?\n  During security researches, we might find that the deployment of vulnerable environment often takes much time, while the time spent on testing PoC or ExP is comparatively short. In the field of cloud native security, thanks to the complexity of cloud native systems, this issue is more terrible.  There are already some excellent security projects like Vulhub (https://github.com/vulhub/vulhub), VulApps (https://github.com/Medicean/VulApps) in the open-source community, which pack vulnerable scenes into container images, so that researchers could utilize them and deploy scenes quickly.  However, these projects mainly focus on vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) in applications. What if we need to study the vulnerabilities in the infrastructures like Docker, Kubernetes and even Linux kernel?  Hence, we develop Metarget and hope to solve the deployment issue above to some extent. Furthermore, we also expect that Metarget could help to construct multilayer vulnerable cloud native scenes automatically.  \n1.2 Install Vulnerability!\n  In this project, we come up with concepts like installing vulnerabilities and installing vulnerable scenes. Why not install vulnerabilities just like installing softwares? We can do that, because our goals are security research and offensive security.  To be exact, we expect that:    metarget cnv install cve-2019-5736 will install Docker with CVE-2019-5736 onto the server.  metarget cnv install cve-2018-1002105 will install Kubernetes with CVE-2018-1002105 onto the server.  metarget cnv install kata-escape-2020 will install Kata-containers with CVE-2020-2023/2025/2026 onto the server.  metarget cnv install cve-2016-5195 will install a kernel with DirtyCoW into the server.    It's cool, right? No more steps. No RTFM. Execute one command and enjoy your coffee.  Furthermore, we expect that:    with Metarget's help, ethical hackers are able to deploy simple or complicated cloud native targets swiftly and learn by hacking cloud native environments.  metarget appv install dvwa will install a DVWA (https://github.com/digininja/DVWA) target onto our vulnerable infrastructure.  metarget appv install thinkphp-5-0-23-rce --external will install a ThinkPHP RCE vulnerability (https://www.kitploit.com/search/label/Vulnerability) with NodePort service onto our vulnerable infrastructure.    You can just run 5 commands below after installing a new Ubuntu and obtain a multi-layer vulnerable scene:  ./metarget cnv install cve-2016-5195 # container escape with dirtyCoW\n./metarget cnv install cve-2019-5736 # container escape with docker\n./metarget cnv install cve-2018-1002105 # kubernetes single-node cluster with cve-2018-1002105\n./metarget cnv install privileged-container # deploy a privileged container\n./metarget appv install dvwa --external # deploy dvwa target  RCE, container escape, lateral movement, persistence, they are yours now.  More awesome functions are coming! Stay tuned :)  Note:  Thie project aims to provide vulnerable scenes for security research. The security of scenes generated is not guaranteed. It is NOT recommended to deploy components or scenes with Metarget on the Internet.  \n2 Usage\n  \n2.1 Basic Usage\n  usage: metarget [-h] [-v] subcommand ...\n\nautomatic constructions of vulnerable infrastructures\n\npositional arguments:\n  subcommand     description\n    gadget       cloud native gadgets (docker/k8s/...) management\n    cnv          cloud native vulnerabilities management\n    appv         application vulnerabilities management\n\noptional arguments:\n  -h, --help     show this help message and exit\n  -v, --version  show program's version number and exit\n  Run ./metarget gadget list to see cloud native components supported currently.", "creation_timestamp": "2026-09-08T05:00:04.315074Z"}, {"uuid": "6fbee347-f2ce-4dfe-a484-2d324d86ae38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/11442", "content": "2.2 Manage Cloud Native (https://www.kitploit.com/search/label/Cloud%20Native) Components\n  usage: metarget gadget [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported gadgets\n    install   install gadgets\n    remove    uninstall gadgets\n\noptional arguments:\n  -h, --help  show this help message and exit\n  \n2.2.1 Case: Install Docker with Specified Version\n  Run:  ./metarget gadget install docker --version 18.03.1  If the command above completes successfully, 18.03.1 Docker will be installed.  \n2.2.2 Case: Install Kubernetes with Specified Version\n  Run:  ./metarget gadget install k8s --version 1.16.5  If the command above completes successfully, 1.16.5 Kubernetes single-node cluster will be installed.  Note:  Usually, lots of options need to be configured in Kubernetes. As a security research project, Metarget provides some options for installation of Kubernetes:    -v VERSION, --version VERSION\n                        gadget version\n  --cni-plugin CNI_PLUGIN\n                        cni plugin, flannel by default\n  --pod-network-cidr POD_NETWORK_CIDR\n                        pod network cidr, default cidr for each plugin by\n                        default\n  --taint-master        taint master node or not\n  Metarget supports deployment of multi-node cluster. If you want to add more nodes into the cluster, you can copy tools/install_k8s_worker.sh script and run it on each worker nodes after the successful installation of single-node cluster.  \n2.2.3 Case: Install Kata-containers with Specified Version\n  Run:  ./metarget gadget install kata --version 1.10.0  If the command above completes successfully, 1.10.0 Kata-containers will be installed.  Note:  You can also specify the type of kata runtime (qemu/clh/fc/...) with --kata-runtime-type option, which is qemu by default.  \n2.2.4 Case: Install Linux Kernel (https://www.kitploit.com/search/label/Linux%20Kernel) with Specified Version\n  Run:  ./metarget gadget install kernel --version 5.7.5  If the command above completes successfully, 5.7.5 kernel will be installed.  Note:  Currently, Metarget install kernels in 2 ways:    apt  if apt package is not available, download *.deb remotely from Ubuntu and try to install    After successful installation of kernel, reboot of system is needed. Metarget will prompt to reboot automatically.  \n2.3 Manage Vulnerable Scenes Related to Cloud Native Components\n  usage: metarget cnv [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported cloud native vulnerabilities\n    install   install cloud native vulnerabilities\n    remove    uninstall cloud native vulnerabilities\n\noptional arguments:\n  -h, --help  show this help message and exit\n  Run ./metarget cnv list to see vulnerable scenes related to cloud native components supported currently.  \n2.3.1 Case: CVE-2019-5736\n  Run:  ./metarget cnv install cve-2019-5736  If the command above completes successfully, Docker with CVE-2019-5736 will be installed\u3002  \n2.3.2 Case: CVE-2018-1002105\n  Run:  ./metarget cnv install cve-2018-1002105  If the command above completes successfully, Kubernetes with CVE-2018-1002105 will be installed\u3002  \n2.3.3 Case: Kata-containers Escape\n  Run:  ./metarget cnv install kata-escape-2020  If the command above completes successfully, Kata-containers with CVE-2020-2023/2025/2026 will be installed\u3002  \n2.3.4 Case: CVE-2016-5195\n  Run:  ./metarget cnv install cve-2016-5195  If the command above completes successfully, kernel with CVE-2016-5195 will be installed\u3002  \n2.4 Manage Vulnerable Scenes Related to Cloud Native Applications\n  usage: metarget appv [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported application vulnerabilities\n    install   install application vulnerabilities\n    remove    uninstall application vulnerabilities\n\noptional arguments:\n  -h, --help  show this help message and exit", "creation_timestamp": "2026-09-08T05:00:04.527715Z"}, {"uuid": "513c3cda-52f3-4c25-8b95-fe6f6d3a6a4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/11442", "content": "2.2 Manage Cloud Native (https://www.kitploit.com/search/label/Cloud%20Native) Components\n  usage: metarget gadget [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported gadgets\n    install   install gadgets\n    remove    uninstall gadgets\n\noptional arguments:\n  -h, --help  show this help message and exit\n  \n2.2.1 Case: Install Docker with Specified Version\n  Run:  ./metarget gadget install docker --version 18.03.1  If the command above completes successfully, 18.03.1 Docker will be installed.  \n2.2.2 Case: Install Kubernetes with Specified Version\n  Run:  ./metarget gadget install k8s --version 1.16.5  If the command above completes successfully, 1.16.5 Kubernetes single-node cluster will be installed.  Note:  Usually, lots of options need to be configured in Kubernetes. As a security research project, Metarget provides some options for installation of Kubernetes:    -v VERSION, --version VERSION\n                        gadget version\n  --cni-plugin CNI_PLUGIN\n                        cni plugin, flannel by default\n  --pod-network-cidr POD_NETWORK_CIDR\n                        pod network cidr, default cidr for each plugin by\n                        default\n  --taint-master        taint master node or not\n  Metarget supports deployment of multi-node cluster. If you want to add more nodes into the cluster, you can copy tools/install_k8s_worker.sh script and run it on each worker nodes after the successful installation of single-node cluster.  \n2.2.3 Case: Install Kata-containers with Specified Version\n  Run:  ./metarget gadget install kata --version 1.10.0  If the command above completes successfully, 1.10.0 Kata-containers will be installed.  Note:  You can also specify the type of kata runtime (qemu/clh/fc/...) with --kata-runtime-type option, which is qemu by default.  \n2.2.4 Case: Install Linux Kernel (https://www.kitploit.com/search/label/Linux%20Kernel) with Specified Version\n  Run:  ./metarget gadget install kernel --version 5.7.5  If the command above completes successfully, 5.7.5 kernel will be installed.  Note:  Currently, Metarget install kernels in 2 ways:    apt  if apt package is not available, download *.deb remotely from Ubuntu and try to install    After successful installation of kernel, reboot of system is needed. Metarget will prompt to reboot automatically.  \n2.3 Manage Vulnerable Scenes Related to Cloud Native Components\n  usage: metarget cnv [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported cloud native vulnerabilities\n    install   install cloud native vulnerabilities\n    remove    uninstall cloud native vulnerabilities\n\noptional arguments:\n  -h, --help  show this help message and exit\n  Run ./metarget cnv list to see vulnerable scenes related to cloud native components supported currently.  \n2.3.1 Case: CVE-2019-5736\n  Run:  ./metarget cnv install cve-2019-5736  If the command above completes successfully, Docker with CVE-2019-5736 will be installed\u3002  \n2.3.2 Case: CVE-2018-1002105\n  Run:  ./metarget cnv install cve-2018-1002105  If the command above completes successfully, Kubernetes with CVE-2018-1002105 will be installed\u3002  \n2.3.3 Case: Kata-containers Escape\n  Run:  ./metarget cnv install kata-escape-2020  If the command above completes successfully, Kata-containers with CVE-2020-2023/2025/2026 will be installed\u3002  \n2.3.4 Case: CVE-2016-5195\n  Run:  ./metarget cnv install cve-2016-5195  If the command above completes successfully, kernel with CVE-2016-5195 will be installed\u3002  \n2.4 Manage Vulnerable Scenes Related to Cloud Native Applications\n  usage: metarget appv [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported application vulnerabilities\n    install   install application vulnerabilities\n    remove    uninstall application vulnerabilities\n\noptional arguments:\n  -h, --help  show this help message and exit", "creation_timestamp": "2026-09-09T00:00:41.834062Z"}, {"uuid": "b08ced03-1531-482e-bd36-15d4ffdf3ce0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/11441", "content": "1 Introduction\n  Metarget = meta- + target, a framework providing automatic constructions of vulnerable infrastructures, used to deploy simple or complicated vulnerable cloud native targets swiftly and automatically.  \n1.1 Why Metarget?\n  During security researches, we might find that the deployment of vulnerable environment often takes much time, while the time spent on testing PoC or ExP is comparatively short. In the field of cloud native security, thanks to the complexity of cloud native systems, this issue is more terrible.  There are already some excellent security projects like Vulhub (https://github.com/vulhub/vulhub), VulApps (https://github.com/Medicean/VulApps) in the open-source community, which pack vulnerable scenes into container images, so that researchers could utilize them and deploy scenes quickly.  However, these projects mainly focus on vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) in applications. What if we need to study the vulnerabilities in the infrastructures like Docker, Kubernetes and even Linux kernel?  Hence, we develop Metarget and hope to solve the deployment issue above to some extent. Furthermore, we also expect that Metarget could help to construct multilayer vulnerable cloud native scenes automatically.  \n1.2 Install Vulnerability!\n  In this project, we come up with concepts like installing vulnerabilities and installing vulnerable scenes. Why not install vulnerabilities just like installing softwares? We can do that, because our goals are security research and offensive security.  To be exact, we expect that:    metarget cnv install cve-2019-5736 will install Docker with CVE-2019-5736 onto the server.  metarget cnv install cve-2018-1002105 will install Kubernetes with CVE-2018-1002105 onto the server.  metarget cnv install kata-escape-2020 will install Kata-containers with CVE-2020-2023/2025/2026 onto the server.  metarget cnv install cve-2016-5195 will install a kernel with DirtyCoW into the server.    It's cool, right? No more steps. No RTFM. Execute one command and enjoy your coffee.  Furthermore, we expect that:    with Metarget's help, ethical hackers are able to deploy simple or complicated cloud native targets swiftly and learn by hacking cloud native environments.  metarget appv install dvwa will install a DVWA (https://github.com/digininja/DVWA) target onto our vulnerable infrastructure.  metarget appv install thinkphp-5-0-23-rce --external will install a ThinkPHP RCE vulnerability (https://www.kitploit.com/search/label/Vulnerability) with NodePort service onto our vulnerable infrastructure.    You can just run 5 commands below after installing a new Ubuntu and obtain a multi-layer vulnerable scene:  ./metarget cnv install cve-2016-5195 # container escape with dirtyCoW\n./metarget cnv install cve-2019-5736 # container escape with docker\n./metarget cnv install cve-2018-1002105 # kubernetes single-node cluster with cve-2018-1002105\n./metarget cnv install privileged-container # deploy a privileged container\n./metarget appv install dvwa --external # deploy dvwa target  RCE, container escape, lateral movement, persistence, they are yours now.  More awesome functions are coming! Stay tuned :)  Note:  Thie project aims to provide vulnerable scenes for security research. The security of scenes generated is not guaranteed. It is NOT recommended to deploy components or scenes with Metarget on the Internet.  \n2 Usage\n  \n2.1 Basic Usage\n  usage: metarget [-h] [-v] subcommand ...\n\nautomatic constructions of vulnerable infrastructures\n\npositional arguments:\n  subcommand     description\n    gadget       cloud native gadgets (docker/k8s/...) management\n    cnv          cloud native vulnerabilities management\n    appv         application vulnerabilities management\n\noptional arguments:\n  -h, --help     show this help message and exit\n  -v, --version  show program's version number and exit\n  Run ./metarget gadget list to see cloud native components supported currently.", "creation_timestamp": "2026-09-09T00:00:41.656305Z"}, {"uuid": "50f080f8-63d5-45a4-8dab-67745d7a1bcb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-1002105", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/11443", "content": "Run ./metarget appv list to see vulnerable scenes related to cloud native applications supported currently.  Note:  Before deploying application vulnerable scenes, you should install Docker and Kubernetes firstly. You can use Metarget to install Docker and Kubernetes.  \n2.4.1 Case: DVWA\n  Run:  ./metarget appv install dvwa  If the command above completes successfully, DVWA (https://github.com/digininja/DVWA) will be deployed as Deployment and Service resources in current Kubernetes.  Note:  You can specify --external option, then the service will be exposed as NodePort, so that you can visit it by IP of the host node.  By default, the type of service is ClusterIP.  \n2.5 Manage Vulnerable Cloud Native Target Cluster\n  Developing, currently not supported.  \n3 Installation\n  \n3.1 Requirements\n    Ubuntu 16.04 or 18.04  Python >= 3.5  pip3    \n3.2 From Source\n  Clone the repository and install requirements:  git clone https://github.com/brant-ruan/metarget.git\ncd metarget/\npip install -r requirements.txt  Begin to use Metarget and construct vulnerable scenes. For example:  ./metarget cnv install cve-2019-5736  \n3.3 From PyPI\n  Currently unsupported.  \n4 Scene List\n  \n4.1 Vulnerable Scenes Related to Cloud Native Components\n    Name  Class  Type  CVSS 3.x  Status      cve-2018-15664 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2018-15664.yaml)  docker  container_escape  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2018-15664)  \u2705      cve-2019-13139 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-13139.yaml)  docker  command_execution  8.4 (https://nvd.nist.gov/vuln/detail/CVE-2019-13139)  \u2705      cve-2019-14271 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-14271.yaml)  docker  container_escape  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2019-14271)  \u2705      cve-2020-15257 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2020-15257.yaml)  docker/containerd  container_escape  5.2 (https://nvd.nist.gov/vuln/detail/CVE-2020-15257)  \u2705      cve-2019-5736 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-5736.yaml)  docker/runc  container_escape  8.6 (https://nvd.nist.gov/vuln/detail/CVE-2019-5736)  \u2705      cve-2017-1002101 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2017-1002101.yaml)  kubernetes  container_escape  9.6 (https://nvd.nist.gov/vuln/detail/CVE-2017-1002101)  \u2705      cve-2018-1002105 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2018-1002105.yaml)  kubernetes  privilege_escalation  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2018-1002105)  \u2705      cve-2019-11253 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-11253.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-11253)  \u2705      cve-2019-9512 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9512.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9512)  \u2705      cve-2019-9514 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9514.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9514)  \u2705      cve-2020-8554 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8554.yaml)  kubernetes  man_in_the_middle  5.0 (https://nvd.nist.gov/vuln/detail/CVE-2020-8554)  \u2705      cve-2020-8557 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8557.yaml)  kubernetes  denial_of_service  5.5 (https://nvd.nist.gov/vuln/detail/CVE-2020-8557)  \u2705      cve-2020-8558 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8558.yaml)  kubernetes  exposure_of_service  8.8 (https://nvd.nist.gov/vuln/detail/CVE-2020-8558)  \u2705      cve-2016-5195 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kernel/cve-2016-5195.yaml)  kernel", "creation_timestamp": "2026-09-09T00:00:43.518959Z"}]}