feat: add Kubernetes toolbox - #662
Conversation
|
Great addition to Kubernetes pentesting ! Just a question, I don't use this tool often or in different context. How can you use trivy or KubeBench inside a container that not related to the k8s cluster ? Kubeletctl, Kube-hunter can be launched into remote environment but I have a doubt for some in this list ! Maybe I'm wrong but the doc and blog post about this two tools doesn't mention remote access. Thanks :) |
Hi Both Trivy and kube-bench are useful even outside a live Kubernetes cluster, especially in pentest / audit contexts. Trivy can scan large sets of Kubernetes YAML manifests offline (from leaked repos, CI/CD artifacts, backups, etc.) to detect dangerous misconfigurations (privileged pods, host mounts, insecure securityContext, etc.). This is a very common pre-access or supply-chain attack phase. kube-bench provides a CIS benchmark reference that helps identify missing or weak hardening in configuration files or extracted node/control-plane configs, and is often used during design reviews or offline assessments. |
ShutdownRepo
left a comment
ShutdownRepo
left a comment
There was a problem hiding this comment.
Thanks for this PR! Thank you @cHJlaXpoZXI for your question, I was wondering the same thing 😁
@tristanqtn can you please switch to dynamic latest version? You got the right instinct fixing the version to save some time in the future, however maintaining stuff that happens to break is our job and we prefer doing that rather than missing out on new additions and features that future release might bring. You can take a look at the "Download release" install method in the contribution docs to find out some code you could use to achieve that
|
Hey lads, a few updates have been made. @ShutdownRepo I’ve switched the tool downloads to use dynamic release installation. Still open to discussion regarding the relevance of some tools included in this PR. |
|
Hey guys, after some reflection, I realized that a few tools in this PR were too specific and probably don’t belong in Exegol. I’ve reduced the PR to the bare minimum. @ShutdownRepo does this look good to you? |
ShutdownRepo
left a comment
ShutdownRepo
left a comment
There was a problem hiding this comment.
Almost there, let's do this small change and we'll be good to go
|
|
||
| curl -LO "$URL" | ||
| mv kubeletctl_linux_* kubeletctl | ||
| install -o root -g root -m 0755 kubeletctl /usr/local/bin/kubeletctl |
There was a problem hiding this comment.
we need to move binaries in /opt/tools/bin/
| colorecho "Installing kubeletctl" | ||
| mkdir -p /opt/tools/kubeletctl | ||
| cd /opt/tools/kubeletctl || exit | ||
|
|
||
| local URL="" | ||
| curl --location --silent --output /tmp/meta.json "https://api.github.com/repos/cyberark/kubeletctl/releases/latest" | ||
|
|
||
| if [[ $(uname -m) = 'x86_64' ]] | ||
| then | ||
| URL=$(cat /tmp/meta.json | grep 'browser_download_url' | grep -o 'https://[^"]*' | grep 'linux' | grep "amd64") | ||
| elif [[ $(uname -m) = 'aarch64' ]] | ||
| then | ||
| URL=$(cat /tmp/meta.json | grep 'browser_download_url' | grep -o 'https://[^"]*' | grep 'linux' | grep "arm64") | ||
| else | ||
| criticalecho-noexit "This installation function doesn't support architecture $(uname -m)" && return | ||
| fi | ||
|
|
||
| if [[ -z "$URL" ]]; then | ||
| cat /tmp/meta.json | ||
| fi | ||
|
|
||
| curl -LO "$URL" | ||
| mv kubeletctl_linux_* kubeletctl |
There was a problem hiding this comment.
The /opt/tools/kubeletctl directory is not needed since the binary can be downloaded in /tmp/ then moved in /opt/tools/bin and then chmod +x, see
|
Hey @ShutdownRepo, requested changes have been made. Should we also refactor |
Yes please!! 🙏 |
|
Just a basic refactor of |
|
Hey team, in the end what should we do with this PR ? |
3 participants
K8S Tools Improvements
This PR extends adds new Kubernetes pentest tools to the environment.
New tools added
History improvements
Dedicated history entries have been added for each new tool. The existing kubectl history has been enriched with additional practical commands.
Related issues
N/A (feature enhancement)
Point of attention
Most tools in this PR use version-pinned GitHub release assets to ensure build reproducibility and avoid upstream breaking changes.
Happy reviewing!