My Third Try on Multipass

After a few rounds of testing, you will find yourself repeating a lot of similar actions whenever creating an instance. For example:

• creating new user
• adding ssh public key
• install Python, htop, Nodejs.....

YES, we can pre-configure all the actions every time a new instance is created. This is done via cloud-init.

First, create a YAML file called "cloud_init.yaml" with the following content.

users:
  - default
  - name: xx
    groups: sudo
    shell: /bin/bash
    sudo: ['ALL=(ALL) NOPASSWD:ALL']
    ssh_authorized_keys:
      - ssh-rsa <rsa keys in one line>
package_update: true
package_upgrade: true
packages:
  - nodejs
  - python3

Second, create a new instance.

multipass launch -c 2 -m 2G -d 10G -n jimny --cloud-init cloud_init.yaml

Last, login to new instance and you will find that apt is both updated and upgraded. Nodejs and Python3 are there waiting for you.

multipass info jimny

multipass shell jimny

ubuntu@jimny:~$ apt list python3 nodejs 

Links:

• First Try on Multipass
• My Second Try on Multipass

My Second Try on Multipass

All these below happen after I install Multipass (on my Windows machine).

To list images available:

multipass find

 

Next is to trying on creating different instance with different config.

To start an instance of Ubuntu:

multipass launch 

To start an instance of Ubuntu with a given name: jimny

multipass launch --name jimny

To start an instance of Ubuntu with specific config

multipass launch -c 2 -m 2G -d 10G -n jimny

To start an instance of docker environment with Portainer

multipass launch docker

Then, to list all the instances

multipass list

To stop and start specific instance

multipass stop jimny

multipass start jimny

In order to login and connect to specific instance

multipass shell jimny

Last to delete the instance

multipass stop jimny

multipass delete jimny

multipass purge 

multipass stop docker

multipass delete --purge docker 

 

Links:

• First Try on Multipass
  

Kubernetes crash course: In less than 15 minutes

One of the best video that talks about Kubernetes (within 15 min), which covers the architecture or relationship between API, Scheduler, Controller, Data Store (etcd), Kubelet, KubeProxy, Docker, Pod, Container, Cluster.

Lets understand containers (10 min)

 

Learn and understand about containers, and start creating a docker container with 5 simple steps. It compares between physical machines, virtual machines, and containers.

Container features 

• Logical packaging
• Faster/lightweight than VM
• Less memory intensive
• Easy deployment
• Reduce delivery time
• Help Dev/IT-ops
• Less bugs

5 steps to create container:

1. Develop app.
2. Create Dockerfile.
3. Build a docker image.
4. Run a docker container
5. Push to docker hub.

 

Kubernetes Attack and Defense: Break Out and Escalate!

My notes:

• Pod vs container.
• Pod has a IP address.
• Nodes run kubelet, container runtime, kube-proxy
• Attack K8s from a compromised node
• break out of a container (5 CVEs)
  
• over-privilege pod - mount /dev, access to node filesystem, use of node's network namespace, load module, root access, hostPID, hostNetwork Pods
  
• phish login access to node
• steal kubelet and kube-proxy auth cred, /var/lib/kubelet, service account token
  
• steal secrets from other pods with env
  
• run programs on the node
• create "mirror pods"
• steal cred to the vault
• pull cred for nod's cloud IAM account, http://169.254.169.254/latest/meta-data/iam/security-credentials/<name>/
  
• access to bucket storage/S3
  
• Defenses:
• Admission control, SeccompDefault, Security Profiles Operator, Steering Workloads to Nodes, Upgrade the Cluster.
• Pod Security Policy, Pod Security Standards.
• Open Policy Agent (OPA) Gatekeeper
• Kyverno
  

Links:

• https://www.youtube.com/watch?v=B1hRgTmhPlU
• Attacking K8s - https://github.com/inguardians/peirates
• https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
  

First Try on Multipass

Multipass is simple a docker alternative from Canonical projects. It is a lightweight cross-platform VM manager, and is designed for developers who want a fresh Ubuntu environment with a single command.

A cloud-init can be used for post-install configuration, such as setup SSH public key or mounting a disk.

$ sudo snap install multipass --classic 

$ sudo snap refresh multipass --channel stable

$ multipass find

$ multipass launch --name kk focal

$ multipass ls

$ multipass ls --format json 

$ multipass shell kk 

$ multipass launch --name jj --cpus 2 --mem 2G 

$ multipass ls --format yaml

$ multipass info kk

$ multipass exec kk -- lsb_release -a 

$ multipass list 

$ multipass stop jj kk

$ multipass list 

$ multipass delete --purge kk

$ multipass delete --purge jj 

So fun 😜😜 and I love its' simplicity.

Links:

• https://multipass.run/docs/installing-on-linux
• https://multipass.run/docs/create-an-instance
  

GHA Runners - Security In Action

An excellent write up, from Magno Logan, about the GitHub Actions (GHA), one of the commonly used CI tools today.

This article covers some security risks and best practices about using GHA as your primary CI tool.

About GitHub Actions (GHA)

GitHub Actions released in 2019. Working as CI tools, tt helps developers automate tasks within the software development life cycle (SDLC). One advantage of GHA is that developers do not need a separate CI tool but executes the workflow directly from GitHub. 

Actions are formed by a set of components. These are the six main components of a GHA:

• Workflows: Automated procedure added to the repository, and is the actual Action itself
• Events: An activity that triggers a workflow; these can be based on events such as push or pull requests, but they can also be scheduled using the crontab syntax
• Jobs: A group of one or more steps that are executed inside a runner
• Steps: These are tasks from a job that can be used to run commands
• Actions: The standalone commands from the steps
• Runners: A server that has the GHA runner application installed

 

The full article contains many more information including:

1. GitHub Actions (GHA) and its components
2. GitHub Action (GHA) runners
3. Cryptomining with GitHub Actions
4. Ubuntu Runner reconnaissance
5. Scanning for vulnerabilities
6. Setting up a reverse shell with Netcat and more
7. The Mono Web Server XSP
8. Scanning other runners
9. Conclusions and recommendations
10. Trend Micro solutions
    

GitHub Action Runners

Links:

• GitHub Action Runners - Analyzing the Environment and Security in Action
  

Start Your Own Pentest on Cloud and Container with Atomic Red Team

Atomic Red Team is a collection of small, highly portable detection tests mapped to MITRE ATT&CK®. This gives defenders a highly actionable way to immediately start testing their defenses against a broad spectrum of attacks.

MITRE ATT&CK™ offers the security community a common language to communicate about adversary tactics, techniques, and behaviors. In the articles and resources below, we offer guidance on how security teams can use the framework to expand detection coverage and increase visibility.

Links:

• https://redcanary.com/blog/art-cloud-containers/
• https://redcanary.com/atomic-red-team/ 
• https://redcanary.com/mitre-attack/
  
• https://github.com/redcanaryco/atomic-red-team/
• https://attack.mitre.org/resources/updates/