CVE-2019-1002101 PoC — kubectl cp path traversal

Source

https://github.com/brompwnie/CVE-2019-1002101-Helpers

Associated Vulnerability

Title:kubectl cp path traversal (CVE-2019-1002101)
Description:The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. The issue is resolved in kubectl v1.11.9, v1.12.7, v1.13.5, and v1.14.0.

Description

PoC helper scripts and Dockerfile for CVE-2019-1002101

Readme

# kubectl_cp_CVE-2019-1002101
PoC helper scripts and Dockerfile for CVE-2019-1002101

For detailed info, goto https://www.twistlock.com/labs-blog/disclosing-directory-traversal-vulnerability-kubernetes-copy-cve-2019-1002101/ and https://discuss.kubernetes.io/t/announce-security-release-of-kubernetes-kubectl-potential-directory-traversal-releases-1-11-9-1-12-7-1-13-5-and-1-14-0-cve-2019-1002101/5712

## Usage
These steps will help you get a shell via one technique, there are many others.
- Step 1, on your target host, execute setupTar.sh to get your evul tar file and make sure badbin is available
- Step 2, prep the target host to execute your evul "tar" binary by running setupTar.sh (you need perms to write to /bin/tar)
- Step 3, Wait for target to run ```kubectl cp``` and a new bash session to be started

# Extras
- 'Dockerfile' can be used to replace all available path commands to execute your malicious binary, phun to test if a system is executing binaries in user supplied containers.
- replace.sh is a script which can be used to replace all binaries in the current path and ensure that any calls to /bin/abinary instead calls your binary i.e baddbin

File Snapshot


 [4.0K]  /data/pocs/8f79f092c7fa8854036a0d1aea459f1e99200585
├── [  22]  badbin
├── [ 426]  createPwnTar.sh
├── [ 189]  Dockerfile
├── [1.1K]  README.md
├── [ 446]  replace.sh
└── [  69]  setupTar.sh

0 directories, 6 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!