Intelligent penetration testing system for container environments

Abstract

The application provides a kind of intelligent penetration testing system for container environment, comprising: environment detection module, information collection module and penetration testing module;The environment detection module is used for environment detection, assesses the confidence of being currently in the container environment inside;The information collection module is used to collect sensitive information inside the environment, match the container environment vulnerability preset by the system, and provide targeted penetration testing technical proposal;The penetration testing module is used for penetration testing, by automatic or user manual selection automatic penetration testing method.The application realizes more comprehensive information collection and environment detection, closely combines information collection with actual penetration testing, so as to realize automatic penetration testing.

Description

Technical Field

[0001] This invention relates to the field of network security, specifically to an intelligent penetration testing system for container environments, and more particularly to an intelligent penetration testing system based on container environment information collection. Background Technology

[0002] Currently, container technology is widely used in the foundational environments of enterprise development processes and application service deployments, and is tightly integrated with CI / CD processes. Through container technology, users can more easily deploy, manage, and scale applications, while also utilizing server resources more effectively. In cloud-native systems, container technology is one of the core technologies, with applications spanning multiple layers, including underlying infrastructure, middleware containers and their orchestration and management, and upper-layer applications. However, compared to the widespread adoption of container technology, ensuring container security still faces a series of challenges and issues.

[0003] Containers are isolated from the host machine through security mechanisms provided by Linux, such as namespaces and cgroups. However, container escape can bypass these security mechanisms, allowing attackers to directly execute malicious code on the host machine, posing a significant threat and damage to the host machine, containers, and applications running within them. If an application is deployed as a Pod in a Kubernetes cluster, attackers using container escape can not only control the host machine but also perform various attack methods such as information theft, lateral movement, privilege escalation, and persistence, thereby gaining control of the entire Kubernetes cluster and posing a fatal threat to the enterprise's business interests and security.

[0004] Meanwhile, an increasing number of penetration testing systems targeting container environments have emerged, such as the host configuration scanner dockscan, Docker image analysis tools Clair, trivy, and Dockle, container escape tools BotB, Metasploit modules, and Harpoon. However, these toolsets currently suffer from a separation between environment detection, information gathering, and actual penetration testing. They either focus on probing the container environment and detecting vulnerabilities and misconfigurations, or they focus on container escape itself. None of them effectively combine detection and exploitation, thus requiring users to use multiple tools and systems to complete a full penetration testing process for container environments. Summary of the Invention

[0005] In view of the shortcomings of the prior art, the purpose of this invention is to provide an intelligent penetration testing system for container environments.

[0006] The present invention provides an intelligent penetration testing system for container environments, comprising: an environment detection module, an information collection module, and a penetration testing module;

[0007] The environmental detection module is used for environmental detection and to assess the confidence level of being currently inside the container environment;

[0008] The information collection module is used to collect sensitive information within the environment, match pre-set container environment vulnerabilities, and provide targeted penetration testing technology suggestions.

[0009] The penetration testing module is used for penetration testing, and can automatically or manually select an automatic penetration testing method.

[0010] Preferably, the environment detection module comprehensively analyzes the container environment files under the file system, cgroups and apparmor configurations, file system mounts, and hardware device accessibility to determine whether the current environment is inside the container and provides a confident output.

[0011] Preferably, the environmental detection module determines whether the current environment is inside the container by:

[0012] Automatically search for files used by the container to set environment variables to verify if they are in the container environment;

[0013] The cgroups configuration file of the initial process is read and analyzed using regular expression matching techniques to determine whether the current environment is under the docker sub-control group;

[0014] Read the apparmor configuration file of the current process and use regular expression matching technology to analyze it, thereby determining whether the current environment is inside a container;

[0015] Iterate through all file systems mounted in the current environment and use regular expression matching techniques to analyze them, thereby determining whether there are Docker container types mounted in the current environment;

[0016] Iterate through all hardware devices in the current environment and attempt to access them, recording any hardware devices that cannot be accessed.

[0017] By weighing various indicators, a comprehensive evaluation result with confidence level is output.

[0018] Preferably, the information collected by the information collection module includes sensitive files and file information within the container environment, sensitive environment variables, sensitive directories, sensitive mounts, and sensitive sockets.

[0019] Preferably, during the process of constructing the container environment attribute domain, the information collection module records detailed information when sensitive information is collected, and sets the relevant flags in the attribute domain to obtain a container environment attribute domain with detailed log information at the sensitive information flag position.

[0020] Preferably, the information collection module matches the container environment attribute domains with the vulnerabilities pre-built into the system one by one, thereby finding all known vulnerabilities in the current environment; and provides corresponding penetration testing technology suggestions according to the penetration testing techniques corresponding to the system's built-in vulnerabilities in a one-to-one mapping.

[0021] Preferably, the information collection module constructs container environment information attribute domains by comprehensively evaluating container environment permissions, traversing the container environment file system, collecting mounted file system information, searching for sensitive information in the container environment, and obtaining container environment kernel version data. It then matches these domains with pre-set container environment vulnerabilities to provide users with targeted penetration testing technical suggestions.

[0022] Preferably, the construction of the container environment information attributes includes:

[0023] Automatically read and parse the current environment permissions to determine whether it is a privileged container;

[0024] Automatically traverse the current environment's file system to check if docker.sock exists and is mounted inside the container;

[0025] Automatically detect whether there is a procfs type mount in the current environment's mounted file system;

[0026] Automatically retrieve environment variables from the environment;

[0027] Automatically obtain and parse the current kernel version.

[0028] Preferably, the penetration testing module includes multiple penetration testing techniques at three levels: application layer, service layer, and system layer. Users can select a penetration testing method for actual operation based on the recommendations of the information collection module.

[0029] Preferably, the penetration testing module selects the CAP_DAC_READ_SEARCH escape module, the privileged container escape module, and the mounted docker.sock escape module from the container environment attribute domain constructed by the information gathering module to attempt penetration testing.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] 1. This invention achieves more comprehensive information collection and environmental monitoring; compared with the prior art, this invention achieves more comprehensive information collection and environmental monitoring, performs environmental monitoring from multiple dimensions, and collects information with finer granularity, thereby providing users with richer container environment information.

[0032] 2. This invention integrates information gathering and penetration testing processes. Compared with existing technologies, this invention closely combines information gathering with actual penetration testing, allowing users to gather information within the same system and perform actual penetration testing based on the collected recommendations.

[0033] 3. This invention enables automated penetration testing. Compared with existing technologies, this invention can also achieve automated penetration testing. The system will select several penetration testing techniques that do not require manual intervention and try them one by one based on the vulnerability information obtained by the information collection module to complete the automated penetration test. Attached Figure Description

[0034] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0035] Figure 1 This is a flowchart of the intelligent penetration testing system disclosed in this invention;

[0036] Figure 2 This is a flowchart of the system environment detection process disclosed in this invention;

[0037] Figure 3 This is a flowchart of the system information collection process of the present invention. Detailed Implementation

[0038] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0039] This invention discloses an intelligent penetration testing system for container environments. Based on container environment information collection and a constructed container environment attribute domain, the system provides feasible penetration testing technique suggestions and executes automated penetration testing attempts. The system runs in user space. First, the system performs environment detection, assessing the confidence level of being within a container environment. Then, the system collects information, gathering sensitive files and file information, sensitive environment variables, and sensitive directories within the environment. It constructs a container environment attribute domain and matches it against known vulnerabilities built into the system to identify vulnerabilities present in the current environment, providing users with practical penetration testing technique suggestions. Users can utilize the system's penetration testing module to select a suggested technique or attempt automated penetration testing to complete the subsequent penetration testing process.

[0040] Reference Figure 1 As shown, the present invention provides an intelligent penetration testing system for container environments, including an environment detection module for container environments, an information collection module for container environments, and a penetration testing module.

[0041] The environmental detection information includes container environment variable file information, system resource control group information, system security module configuration information, system mounted file system information, and system hardware device information. The environmental detection module does not rely solely on a single metric to determine whether the current environment is inside the container; instead, it weighs various metrics (each with different weights, and the weight distribution may not be the same) to arrive at a comprehensive assessment result with confidence.

[0042] Reference Figure 2 As shown, in a preferred embodiment, the environment detection module comprehensively analyzes container environment files under the file system, cgroups and apparmor configurations, file system mounts, and hardware device accessibility to determine whether the current environment is located inside the container. This module can generate formatted logs and provide confident output for users to perform in-depth analysis and processing.

[0043] Specifically, the environment detection module automatically searches for files used by the container to set environment variables. The / .dockerenv file is automatically created when Docker creates a container, and the system searches for it in the current file system to verify whether it is in a container environment.

[0044] The environment detection module automatically parses the cgroups configuration information of the current environment. The system reads the cgroups configuration file of the initial process and uses regular expression matching technology to analyze it, thereby determining whether the current environment is under the docker sub-control group.

[0045] The environment detection module automatically parses the apparmor configuration information of the current environment. In Docker, containers use an apparmor configuration named docker-default by default. The system reads the apparmor configuration file of the current process and uses regular expression matching technology to analyze it, thereby determining whether the current environment is inside a container.

[0046] The environment detection module automatically checks whether any file systems mounted in the current environment are Docker container mounts. The system will traverse all file systems mounted in the current environment and use regular expression matching techniques to analyze them, thereby determining whether any Docker container mounts exist in the current environment.

[0047] The environment detection module automatically detects whether all hardware devices in the current environment are accessible. The system will iterate through all hardware devices in the current environment and attempt to access them, recording any hardware devices that cannot be accessed.

[0048] The system uses a comprehensive evaluation and analysis approach to output a container environment assessment result with confidence. It does not determine whether the current environment is inside a container based on a single indicator, but rather weighs various indicators (each indicator has different weights, and the weight distribution may not be the same) to arrive at a comprehensive assessment result with confidence.

[0049] The information collection module gathers information including sensitive files and file information within the container environment, sensitive environment variables, sensitive directories, sensitive mounts, and sensitive sockets. Specifically, during the construction of container environment attribute domains, the information collection module records detailed information for each piece of sensitive information it collects and sets the relevant flags in the attribute domain. Ultimately, the information collection module obtains container environment attribute domains with detailed log information and the sensitive information flags set.

[0050] The process by which the information gathering module identifies vulnerabilities in the current environment is as follows: The set flags in the completed container environment attribute fields indicate which vulnerabilities exist in the current environment, and a vulnerability consists of several vulnerabilities. Therefore, the information gathering module matches the container environment attribute fields with the vulnerabilities pre-built into the system to find all known vulnerabilities in the current environment.

[0051] The process by which the information gathering module provides penetration testing technique recommendations is as follows: All known vulnerabilities have corresponding penetration testing techniques, and the system has written corresponding penetration testing techniques for all built-in vulnerabilities. Therefore, by simply finding all the vulnerabilities existing in the current environment and mapping them one-to-one, corresponding penetration testing technique recommendations can be provided.

[0052] Reference Figure 3As shown, in a preferred embodiment, the information collection module constructs a container environment information attribute domain by comprehensively evaluating container environment permissions, traversing the container environment file system, collecting mounted file system information, searching for sensitive information in the container environment, and obtaining data such as the container environment kernel version. This module uses professional techniques and algorithms to match pre-installed container environment vulnerabilities and provides users with targeted penetration testing technical suggestions. The information collection module can generate formatted logs, facilitating in-depth analysis and processing by users. Furthermore, this module provides a variety of optional penetration testing technical suggestions to meet different user needs and application scenarios.

[0053] Specifically, the information gathering module can automatically read and parse the current environment permissions to determine whether it is a privileged container. The system reads the state information file exposed to the current process and uses regular expression matching technology to analyze it, thereby extracting the process's capabilities information and parsing it into a human-readable format. Next, the system compares it with the default set of capabilities for Docker containers to identify any added or removed capabilities in the current container. Based on this analysis result, the system will determine whether the container is a privileged container and add the relevant information to the attribute field.

[0054] The information gathering module can automatically traverse the current environment's file system to check for the existence of docker.sock mounted inside the container. The system will traverse the file system, identify all socket type files, further filter out docker.sock sockets, and add relevant information to the attribute field.

[0055] The information collection module automatically detects whether there are procfs type mounts in the current environment. The system will traverse all mounted file systems in the current environment and use regular expression matching technology to analyze them, thereby determining whether there are procfs type mounts in the current environment, and adding the relevant information to the attribute field.

[0056] The information collection module automatically retrieves environment variables from the environment. The environment variables of the business container typically store sensitive information; the system automatically exports these environment variables and adds the relevant information to the attribute fields.

[0057] The information gathering module automatically obtains and parses the current kernel version. Different kernel versions have different kernel vulnerabilities. The system reads a file containing system information and uses regular expression matching to parse the current Linux kernel version number, while adding the relevant information to the attribute fields.

[0058] The information gathering module provides users with customized penetration testing technique suggestions. During the information gathering process, the system gradually constructs the container environment information attribute domain. After the construction of the container environment attribute domain is completed, it matches it with the system's pre-set vulnerabilities one by one to identify potential vulnerabilities in the current environment and outputs corresponding penetration testing technique suggestions.

[0059] The penetration testing module includes nine different penetration testing techniques for container environments. The system covers three layers—application layer, service layer, and system layer—comprising nine penetration testing techniques. Users can select the appropriate penetration testing method based on the recommendations from the information gathering module and perform the actual operation.

[0060] The automated penetration testing process of the penetration testing module is as follows: Through information gathering, the system has mastered several penetration testing techniques that can be performed in the current environment. Further screening is then conducted, and available penetration testing techniques that do not require manual intervention are tried in sequence, thus completing the automated penetration testing process.

[0061] In a preferred embodiment, the penetration testing module includes multiple sub-modules, such as the CAP_DAC_READ_SEARCH escape module, the CAP_SYS_ADMIN escape module, the CAP_SYS_PTRACE escape module, the privileged container escape module, the docker.sock mount escape module, the procfs mount escape module, and escape modules targeting CVE-2020-15257, CVE-2022-0847, and CVE-2022-0492 vulnerabilities. Users can select appropriate penetration testing methods based on the recommendations of the information gathering module. Furthermore, the system also features an automatic penetration testing function, which can automatically attempt different penetration testing techniques according to user needs.

[0062] The invention will be further illustrated below with reference to a specific implementation example.

[0063] First, the system's environment detection module runs on the target container. This module sequentially detects environment information across various dimensions, including container environment files, cgroups and apparmor configurations, file system mounts, and hardware device accessibility. The system searches for .dockerenv files in the current file system; it reads the cgroups configuration file of the initial process and analyzes it using regular expressions to identify the Docker control group; it reads the apparmor configuration file of the current process and analyzes it using regular expressions to identify the default configuration for the docker-default container; it traverses all mounted file systems in the current environment and analyzes them using regular expressions to identify overlay or aufs type mounts; and it traverses all hardware devices in the current environment and attempts to access them using the stat system call, identifying inaccessible hardware devices. Subsequently, based on the detected information across these dimensions, and according to the weight of each dimension, it outputs the confidence level that the current environment is likely a container environment, along with a detailed formatted log of the environment information.

[0064] Subsequently, an information gathering module runs on the target container. This module collects container environment information from various dimensions and progressively constructs the container environment attribute domain. The system reads the state information file accessible to the current process and analyzes it using regular expression matching to extract the process's capabilities. This information field is in hexadecimal format, which the system parses into a human-readable form and compares with the 14 capabilities assigned by default to the Docker container. The system traverses the file system, matching all Unix socket type files, and further filters out the docker.sock socket through interaction. The system traverses all file systems mounted in the current environment and analyzes them using regular expression matching to match the procfs file system mounted inside the container. The system automatically exports sensitive environment variables of the current environment. The system reads files containing system information and parses the current Linux kernel version number using regular expression matching. During the collection of the above environment information, the system abstracts them into different vulnerabilities and progressively constructs the container environment attribute domain. Finally, the system matches the container environment attribute fields with the vulnerabilities pre-built into the system to discover all known vulnerabilities in the current environment, outputs recommended penetration testing techniques, and provides user-readable container environment attribute field information.

[0065] Finally, the penetration testing module runs on the target container, selecting the penetration testing techniques recommended by the information gathering module, or using automated penetration testing to complete the entire penetration testing process. For automated penetration testing, if the information gathering module recommends using the CAP_DAC_READ_SEARCH penetration testing module, the system will attempt to use this module to read sensitive files on the system, including but not limited to / etc / passwd and / etc / shadow. If the information gathering module recommends using the privileged container escape module, the system will attempt to use this module to directly mount the host file system into the container. If the information gathering module recommends using the mount docker.sock penetration testing module, the system will attempt to use this module to pull the container image, start a high-privilege container, and mount the host file system. The system will try the above penetration testing sub-modules in sequence to complete one automated penetration testing attempt.

[0066] Those skilled in the art will understand that, besides implementing the system and its various devices, modules, and units provided by this invention in the form of purely computer-readable program code, the same functions can be achieved entirely through logical programming of the method steps, making the system and its various devices, modules, and units of this invention function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, the system and its various devices, modules, and units provided by this invention can be considered as a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component; alternatively, the devices, modules, and units for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0067] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. An intelligent penetration testing system for container environments, characterized in that, include: Environmental monitoring module, information collection module, and penetration testing module; The environmental detection module is used for environmental detection and to assess the confidence level of being currently inside the container environment; The information collection module is used to collect sensitive information within the environment, match pre-set container environment vulnerabilities, and provide targeted penetration testing technology suggestions. The penetration testing module is used for penetration testing, and can automatically or manually select an automatic penetration testing method. The environment detection module comprehensively analyzes the container environment files under the file system, cgroups and apparmor configurations, file system mounts, and hardware device accessibility to determine whether the current environment is inside the container and provides output with confidence. The environment detection module determines whether the current environment is inside the container by including: Automatically search for files used by the container to set environment variables to verify if they are in the container environment; The cgroups configuration file of the initial process is read and analyzed using regular expression matching techniques to determine whether the current environment is under the docker sub-control group; Read the apparmor configuration file of the current process and use regular expression matching technology to analyze it, thereby determining whether the current environment is inside a container; Iterate through all file systems mounted in the current environment and use regular expression matching techniques to analyze them, thereby determining whether there are Docker container types mounted in the current environment; Iterate through all hardware devices in the current environment and attempt to access them, recording any hardware devices that cannot be accessed. By weighing various indicators, a comprehensive evaluation result with confidence level is output. During the process of constructing the container environment attribute domain, the information collection module records detailed information when sensitive information is collected, and sets the relevant flags in the attribute domain to obtain the container environment attribute domain with detailed log information at the sensitive information flag positions. The information collection module matches the container environment attribute domains with the vulnerabilities pre-built into the system one by one, thereby finding all known vulnerabilities in the current environment; and provides corresponding penetration testing technology suggestions according to the one-to-one mapping of the penetration testing techniques corresponding to the system's built-in vulnerabilities.

2. The intelligent penetration testing system for container environments according to claim 1, characterized in that, The information collection module collects information including sensitive files and file information within the container environment, sensitive environment variables, sensitive directories, sensitive mounts, and sensitive sockets.

3. The intelligent penetration testing system for container environments according to claim 1, characterized in that, The information gathering module comprehensively assesses container environment permissions, traverses the container environment file system, collects mounted file system information, searches for sensitive information in the container environment, and obtains container environment kernel version data. It then constructs container environment attribute domains, matches them with pre-set container environment vulnerabilities, and provides users with targeted penetration testing technical suggestions.

4. The intelligent penetration testing system for container environments according to claim 3, characterized in that, The construction of the container environment property domain includes: Automatically read and parse the current environment permissions to determine whether it is a privileged container; Automatically traverse the current environment's file system to check if docker.sock exists and is mounted inside the container; Automatically detect whether there is a procfs type mount in the current environment's mounted file system; Automatically retrieve environment variables from the environment; Automatically obtain and parse the current kernel version.

5. The intelligent penetration testing system for container environments according to claim 1, characterized in that, The penetration testing module includes various penetration testing techniques at three levels: application layer, service layer, and system layer. Users can select a penetration testing method based on the recommendations of the information collection module to perform the actual operation.

6. The intelligent penetration testing system for container environments according to claim 1, characterized in that, The penetration testing module selects the CAP_DAC_READ_SEARCH escape module, the privileged container escape module, and the mounted docker.sock escape module from the container environment attribute domain constructed by the information collection module to attempt penetration testing.

Images