Skip to content

Commit 3d71bb5

Browse files
zaza
committed
Improve access-kubernetes-goat.sh script to check for pod running status
before doing port-forward. madhuakula#178
1 parent e354b86 commit 3d71bb5

File tree

1 file changed

+113
-9
lines changed

1 file changed

+113
-9
lines changed

‎access-kubernetes-goat.sh‎

Lines changed: 113 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,31 +17,135 @@ echo 'Creating port forward for all the Kubernetes Goat resources to locally. We
1717

1818
# Exposing Sensitive keys in code bases Scenario
1919
export POD_NAME=$(kubectl get pods --namespace default -l "app=build-code" -o jsonpath="{.items[0].metadata.name}")
20-
kubectl port-forward $POD_NAME --address 0.0.0.0 1230:3000 > /dev/null 2>&1 &
20+
while true; do
21+
POD_STATUS=$(kubectl get pod "$POD_NAME" -o jsonpath='{.status.phase}')
22+
if [ "$POD_STATUS" == "Running" ]; then
23+
READY=$(kubectl get pod "$POD_NAME" -o jsonpath='{.status.containerStatuses[*].ready}')
24+
if [[ "$READY" == *"true"* ]]; then
25+
kubectl port-forward $POD_NAME --address 0.0.0.0 1230:3000 > /dev/null 2>&1 &
26+
break
27+
else
28+
echo "Pod $POD_NAME is running but not all containers are ready."
29+
fi
30+
else
31+
echo "Pod $POD_NAME is not in Running state. Current state: $POD_STATUS"
32+
fi
33+
echo "Retrying $POD_NAME in 10s"
34+
sleep 10
35+
done
2136

2237
# Exposing DIND (docker-in-docker) exploitation Scenario
2338
export POD_NAME=$(kubectl get pods --namespace default -l "app=health-check" -o jsonpath="{.items[0].metadata.name}")
24-
kubectl port-forward $POD_NAME --address 0.0.0.0 1231:80 > /dev/null 2>&1 &
39+
while true; do
40+
POD_STATUS=$(kubectl get pod "$POD_NAME" -o jsonpath='{.status.phase}')
41+
if [ "$POD_STATUS" == "Running" ]; then
42+
READY=$(kubectl get pod "$POD_NAME" -o jsonpath='{.status.containerStatuses[*].ready}')
43+
if [[ "$READY" == *"true"* ]]; then
44+
kubectl port-forward $POD_NAME --address 0.0.0.0 1231:80 > /dev/null 2>&1 &
45+
break
46+
else
47+
echo "Pod $POD_NAME is running but not all containers are ready."
48+
fi
49+
else
50+
echo "Pod $POD_NAME is not in Running state. Current state: $POD_STATUS"
51+
fi
52+
echo "Retrying $POD_NAME in 10s"
53+
sleep 10
54+
done
2555

2656
# Exposing SSRF in K8S world Scenario
2757
export POD_NAME=$(kubectl get pods --namespace default -l "app=internal-proxy" -o jsonpath="{.items[0].metadata.name}")
28-
kubectl port-forward $POD_NAME --address 0.0.0.0 1232:3000 > /dev/null 2>&1 &
58+
while true; do
59+
POD_STATUS=$(kubectl get pod "$POD_NAME" -o jsonpath='{.status.phase}')
60+
if [ "$POD_STATUS" == "Running" ]; then
61+
READY=$(kubectl get pod "$POD_NAME" -o jsonpath='{.status.containerStatuses[*].ready}')
62+
if [[ "$READY" == *"true"* ]]; then
63+
kubectl port-forward $POD_NAME --address 0.0.0.0 1232:3000 > /dev/null 2>&1 &
64+
break
65+
else
66+
echo "Pod $POD_NAME is running but not all containers are ready."
67+
fi
68+
else
69+
echo "Pod $POD_NAME is not in Running state. Current state: $POD_STATUS"
70+
fi
71+
echo "Retrying $POD_NAME in 10s"
72+
sleep 10
73+
done
2974

3075
# Exposing Container escape to access host system Scenario
3176
export POD_NAME=$(kubectl get pods --namespace default -l "app=system-monitor" -o jsonpath="{.items[0].metadata.name}")
32-
kubectl port-forward $POD_NAME --address 0.0.0.0 1233:8080 > /dev/null 2>&1 &
77+
while true; do
78+
POD_STATUS=$(kubectl get pod "$POD_NAME" -o jsonpath='{.status.phase}')
79+
if [ "$POD_STATUS" == "Running" ]; then
80+
READY=$(kubectl get pod "$POD_NAME" -o jsonpath='{.status.containerStatuses[*].ready}')
81+
if [[ "$READY" == *"true"* ]]; then
82+
kubectl port-forward $POD_NAME --address 0.0.0.0 1233:8080 > /dev/null 2>&1 &
83+
break
84+
else
85+
echo "Pod $POD_NAME is running but not all containers are ready."
86+
fi
87+
else
88+
echo "Pod $POD_NAME is not in Running state. Current state: $POD_STATUS"
89+
fi
90+
echo "Retrying $POD_NAME in 10s"
91+
sleep 10
92+
done
3393

3494
# Exposing Kubernetes Goat Home
3595
export POD_NAME=$(kubectl get pods --namespace default -l "app=kubernetes-goat-home" -o jsonpath="{.items[0].metadata.name}")
36-
kubectl port-forward $POD_NAME --address 0.0.0.0 1234:80 > /dev/null 2>&1 &
96+
while true; do
97+
POD_STATUS=$(kubectl get pod "$POD_NAME" -o jsonpath='{.status.phase}')
98+
if [ "$POD_STATUS" == "Running" ]; then
99+
READY=$(kubectl get pod "$POD_NAME" -o jsonpath='{.status.containerStatuses[*].ready}')
100+
if [[ "$READY" == *"true"* ]]; then
101+
kubectl port-forward $POD_NAME --address 0.0.0.0 1234:80 > /dev/null 2>&1 &
102+
break
103+
else
104+
echo "Pod $POD_NAME is running but not all containers are ready."
105+
fi
106+
else
107+
echo "Pod $POD_NAME is not in Running state. Current state: $POD_STATUS"
108+
fi
109+
echo "Retrying $POD_NAME in 10s"
110+
sleep 10
111+
done
37112

38113
# Exposing Attacking private registry Scenario
39114
export POD_NAME=$(kubectl get pods --namespace default -l "app=poor-registry" -o jsonpath="{.items[0].metadata.name}")
40-
kubectl port-forward $POD_NAME --address 0.0.0.0 1235:5000 > /dev/null 2>&1 &
115+
while true; do
116+
POD_STATUS=$(kubectl get pod "$POD_NAME" -o jsonpath='{.status.phase}')
117+
if [ "$POD_STATUS" == "Running" ]; then
118+
READY=$(kubectl get pod "$POD_NAME" -o jsonpath='{.status.containerStatuses[*].ready}')
119+
if [[ "$READY" == *"true"* ]]; then
120+
kubectl port-forward $POD_NAME --address 0.0.0.0 1235:5000 > /dev/null 2>&1 &
121+
break
122+
else
123+
echo "Pod $POD_NAME is running but not all containers are ready."
124+
fi
125+
else
126+
echo "Pod $POD_NAME is not in Running state. Current state: $POD_STATUS"
127+
fi
128+
echo "Retrying $POD_NAME in 10s"
129+
sleep 10
130+
done
41131

42132
# Exposing DoS resources Scenario
43133
export POD_NAME=$(kubectl get pods --namespace big-monolith -l "app=hunger-check" -o jsonpath="{.items[0].metadata.name}")
44-
kubectl --namespace big-monolith port-forward $POD_NAME --address 0.0.0.0 1236:8080 > /dev/null 2>&1 &
134+
while true; do
135+
POD_STATUS=$(kubectl get pod "$POD_NAME" --namespace big-monolith -o jsonpath='{.status.phase}')
136+
if [ "$POD_STATUS" == "Running" ]; then
137+
READY=$(kubectl get pod "$POD_NAME" --namespace big-monolith -o jsonpath='{.status.containerStatuses[*].ready}')
138+
if [[ "$READY" == *"true"* ]]; then
139+
kubectl --namespace big-monolith port-forward $POD_NAME --address 0.0.0.0 1236:8080 > /dev/null 2>&1 &
140+
break
141+
else
142+
echo "Pod $POD_NAME is running but not all containers are ready."
143+
fi
144+
else
145+
echo "Pod $POD_NAME is not in Running state. Current state: $POD_STATUS"
146+
fi
147+
echo "Retrying $POD_NAME in 10s"
148+
sleep 10
149+
done
45150

46-
47-
echo "Visit http://127.0.0.1:1234 to get started with your Kubernetes Goat hacking!"
151+
echo "Visit http://127.0.0.1:1234 to get started with your Kubernetes Goat hacking!"

0 commit comments

Comments
 (0)