metarget - Metarget is a framework providing automatic constr

项目说明

<p align="center">
<img src="images/metarget-logo.svg" alt="metarget-logo" height="250" />
</p>

中文 | English

1 Introduction

Metarget = meta- + target, a framework pro automatic constructions of infrastructures, used to deploy simple or complicated cloud nati swiftly and automatically.

1.1 Why Metarget?

During security researches, we might find that the deployment of en often takes much time, while the time spent on testing PoC or ExP is comparatively short. In the field of cloud nati, thanks to the complexity of cloud nati, this issue is more terrible.

There are already some excellent security projects like , in the open-source community, which pack scenes into container images, so that researchers could utilize them and deploy scenes quickly.

However, these projects mainly focus on in applications. What if we need to study the in the infrastructures like Docker, Kubernetes and e kernel?

Hence, we develop Metarget and hope to solve the deployment issue above to some extent. Furthermore, we also expect that Metarget could help to construct multilayer cloud nati automatically.

1.2 Install !

In this project, we come up with concepts like *installing * and *installing scenes*. Why not install just like installing softwares? We can do that, because our goals are security research and offensi.

To be exact, we expect that:

metarget cn c will install Docker with C onto the server.

metarget cn c will install Kubernetes with C onto the server.

metarget cn kata-escape-2020 will install Kata-containers with C/2025/2026 onto the server.

metarget cn c will install a kernel with DirtyCoW into the server.

It's cool, right? No more steps. No RTFM. Execute one command and enjoy your coffee.

Furthermore, we expect that:

with Metarget's help, ethical hackers are able to deploy simple or complicated cloud nati swiftly and learn by hacking cloud nati.

metarget app dvwa will install a DVWA target onto our infrastructure.

metarget app thinkphp-5-0-23-rce --external will install a ThinkPHP RCE with NodePort service onto our infrastructure.

You can just run 5 commands below after installing a new Ubuntu and obtain a multi-layer scene:

RCE, container escape, lateral mo, persistence, they are yours now.

More awesome functions are coming! Stay tuned :)

Note:

This project aims to provide scenes for security research. The security of scenes generated is not guaranteed. It is NOT recommended to deploy components or scenes with Metarget on the Internet.

2 Installation

2.1 Requirements

Ubuntu 20.04 / 22.04 / 24.04 (recommended), 18.04 also supported

- for some cases (e.g. new kernel ) specific Ubuntu distributions are needed
- you can read the note for specific (prompted by an asterisk (\*)) for details

Python >= 3.7 (Python 2.x is unsupported!)

pip3

2.2 From Source

Clone the repository and install requirements:

Begin to use Metarget and construct scenes. For example:

2.3 From PyPI

Currently unsupported.

3 Usage

Metarget needs to be run as root.

It is recommended to add -- option when debugging.

3.1 Basic Usage

Run ./metarget gadget list to see cloud nati supported currently.

3.2 Manage Cloud Nati

> Run./metarget gadget list docker/k8s/containerd/runc/kernelto see cloud nati' supported currently.
#### 3.2.1 Case: Install Docker with Specified

Run:

If the command abo successfully, 18.03.1 Docker will be installed.

#### 3.2.2 Case: Install Kubernetes with Specified

Run:

If the command abo successfully, a 1.28.4 Kubernetes single-node cluster will be installed.

Supported Kubernetes range: 1.9 – 1.33.

Note:

Metarget provides the following options for Kubernetes installation:

Container runtime selection:

k8s < 1.24: Uses Docker by default (must be pre-installed via metarget gadget install docker). Use --runtime containerd to force containerd.

k8s >= 1.24: containerd is automatically installed and configured as the CRI (--runtime auto default). No manual Docker installation needed.

k8s >= 1.24 + --runtime docker: Automatically installs cri-dockerd as the CRI shim (Docker must be pre-installed). Use --runtime- to pin a specific cri-dockerd .

Examples:

Metarget supports deployment of multi-node cluster. If you want to add more nodes into the cluster, you can copy tools/install_k8s_worker.sh script and run it on each worker nodes after the successful installation of single-node cluster.

#### 3.2.3 Case: Install Kata-containers with Specified

Run:

If the command abo successfully, 1.10.0 Kata-containers will be installed.

Note:

You can also specify the type of kata runtime (qemu/clh/fc/...) with --kata-runtime-type option, which is qemu by default.

#### 3.2.4 Case: Install Linux Kernel with Specified

Run:

If the command abo successfully, 5.7.5 kernel will be installed.

Note:

Currently, Metarget installs kernels in 2 ways:

1. apt
2. if apt package is not a, download \*.deb remotely from Ubuntu and try to install

After successful installation of kernel, reboot of system is needed. Metarget will prompt to reboot automatically.

#### 3.2.5 Case: Install containerd/runc with Specified

Run:

If the command abo successfully, 1.7.14 containerd will be installed and automatically configured as a Kubernetes CRI runtime (SystemdCgroup = true), ready to use with metarget gadget install k8s.

Run:

If the command abo successfully, 1.1.6 runc will be installed.

3.3 Manage Scenes Related to Cloud Nati

Run ./metarget cnv list to see scenes related to cloud nati supported currently.

#### 3.3.1 Case: C

Run:

If the command abo successfully, Docker with C will be installed。

#### 3.3.2 Case: C

Run:

If the command abo successfully, Kubernetes with C will be installed。

#### 3.3.3 Case: Kata-containers Escape

Run:

If the command abo successfully, Kata-containers with C/2025/2026 will be installed。

#### 3.3.4 Case: C

Run:

If the command abo successfully, kernel with C will be installed。

3.4 Manage Scenes Related to Cloud Nati

Run ./metarget appv list to see scenes related to cloud nati supported currently.

Note:

Before deploying application scenes, you should install Docker and Kubernetes firstly. You can use Metarget to install Docker and Kubernetes.

#### 3.4.1 Case: DVWA

Run:

If the command abo successfully, DVWA will be deployed as *Deployment* and *Service* resources in current Kubernetes.

Note:

You can specify --external option, then the service will be exposed as NodePort, so that you can visit it by IP of the host node (By default, the type of service is ClusterIP).

You can specify --host-net option, then the appv will share the host network namespace.

You can specify --host-pid option, then the appv will share the host pid namespace.

3.5 en image

Depending on the user's network en, ubuntu , and Docker , one-click installation of the en through automated scripts still occasionally fails, so we provide the en image for the first time.

Run the following command to build the target en image:

Run the following command to run the target en image:

3.6 Manage Cloud Nati Cluster

De, currently not supported.

4 Scene List

4.1 Scenes Related to Cloud Nati

If there is an asterisk (\*) following the name of one scene, you need to read the note related to it below the whole table for further details.

|Name|Class|Type|CVSS 3.x|Writeup|ATT&CK map|
|:-:|:-:|:-:|:-:|:-:|:-:|
|c|docker|container_escape|7.5||pri escalation/escape to host <br> Persistence/escape to host <br> Lateral mo/escape to host <br> Defense Bypass/Build an image on the host|
|c|docker|command_execution|8.4|link|
|c|docker|container_escape|9.8|link|
|c|docker/containerd|container_escape|5.2|link|
|c|docker/runc|container_escape|8.6||
|c|docker/runc|container_escape|7.5||
|c\*|docker/runc|container_escape|7.6|link|
|c|docker/runc|container_escape|8.6||
|c|k8s|container_escape|9.6|link|
|c|k8s|pri|9.8||
|c|k8s/kubectl|container_escape|5.5||
|c|k8s/kubectl|container_escape|5.5||
|c|k8s/kubectl|container_escape|6.5||
|c|k8s/kubectl|container_escape|6.5||
|c|k8s/kubectl|container_escape|5.7||
|c|k8s|denial_of_service|7.5||
|c|k8s|denial_of_service|7.5||
|c|k8s|denial_of_service|7.5||
|c|k8s|traffic_interception|7.5||
|c|k8s|man_in_the_middle|5.0||
|c|k8s/kubernetes-cni|man_in_the_middle|6.0||
|c|k8s|ser|6.3||
|c|k8s|denial_of_service|5.5||
|c|k8s|exposure_of_service|8.8||
|c|k8s|pri|6.8||
|c|k8s|container_escape|8.1||
|c|k8s|container_escape|8.8|link|
|c|kernel|container_escape|7.8||
|c|kernel|pri|7.8||
|c|kernel|pri|7.8||
|c|kernel|container_escape|7.8|link|
|c|kernel|pri|7.8||
|c|kernel|container_escape|7.0|link|
|c|kernel|pri|7.0||
|c|kernel|container_escape|7.8||
|c|kernel|pri|7.8|link|
|c|kernel|pri|-||
|c|kernel|container_escape|7.8||
|c|kernel|container_escape|8.4||
|c|kernel|container_escape|7.8|link|
|c|kernel|container_escape|7.8|link|
|c\*|kernel|pri|7.1||link
|c\*|kernel|pri|7.8||
|c|kernel|pri|7.8||
|c\*|kernel|pri|7.8||
|c\*|kernel|pri|7.8||
|kata-escape-2020|kata-containers|container_escape|6.3/8.8/8.8||
|c|kata-containers|container_escape|8.8||
|cap_dac_read_search-container|config|container_escape|-|link|
|cap_sys_admin-container|config|container_escape|-||
|cap_sys_ptrace-container|config|container_escape|-||
|cap_sys_module-container|config|container_escape|-|link|
|pri|config|container_escape|-|link|
|k8s_backdoor_daemonset|config|persistence|-|link|
|k8s_backdoor_cronjob|config|persistence|-|link|
|k8s_shadow_apiserver|config|persistence|-|link|
|k8s_node_proxy|config|pri|-|link|
|mount-docker-sock|mount|container_escape|-|link|
|mount-host-etc|mount|container_escape|-||
|mount-host-procfs|mount|container_escape|-|link|
|mount-|mount|container_escape|-|link|

Note:

Currently writeups are in Chinese.

It is recommended to add -- option when debugging.

You might find that some kernel are marked as pri, while others container_escape. The essential difference is the payload (get a shell with high pri or escape first).

- Thanks to default security mechanisms (e.g. Seccomp, Capabilities) in containers, some kernel may be hard or almost not to exploit.
- Hence, are marked as container_escape if we could reproduce the whole process with Metarget, others temporarily marked as pri.

For c, after cn c (which installs Docker),

- you'd better install a K8s manually, for exploitation (e.g. cn c or gadget install k8s -- 1.16.5 with Metarget).

For kernel below, Ubuntu 21.10 is needed to run Metarget (tested):

- c
- c
- c

4.2 Scenes Related to Cloud Nati

These scenes are mainly derived from other open-source projects:

DVWA

We express sincere gratitude to projects above!

Metarget converts scenes in projects above to *Deployments* and *Services* resources in Kubernetes (thanks to kompose).

To list scenes related to cloud nati supported by Metarget, just run：

Note:

For the deployment of Confluence's C, you may refer to , while the address of PostgreSQL should be c, not db in .

5 DEMO

![asciicast]()

6 De Plan

[x] deployments of basic cloud nati (docker, k8s)

[x] integrations of scenes related to cloud nati

[x] integrations of RCE scenes in containers

[x] cloud nati images

[x] automatic construction of multi-node cloud nati cluster

[ ] integration of complex cloud nati scenarios

integrations of other cloud nati scenes (long term)

7 Maintainers

-ruan

@L

8 Contribution

One of Metarget's goals is to facilitate more rapid construction of en when occur. Also, it could be used to construct all the integrated scenes whenever you want.

To keep Metarget up-to-date, the scenes lists (both cnv and appv) will be maintained.

*YAML* is used in Metarget to describe & integrate scenes. Currently, scenes in two layers, cnv (in /) and appv (in /), are supported.

Maintenance from the community is appreciated and welcome. Hope that we can gather and share our knowledge and researches in the context of Metarget, and promote the de of cloud nati.

Currently, you can contribute to Metarget in two ways:

1. Submit YAML files of new cloud nati (cnv).
2. Submit YAML files of new cloud nati (appv).

Please see CONTRIBUTING.md for details.

9 Collaboration (Contact us at )

We eagerly welcome collaboration with uni, research institutions, and other academic entities! Metarget is dedicated to being an ideal experimental platform for cutting-edge research in the field of cloud-nati. We believe that cloud-nati will be a forefront topic in the future of network security, and Metarget provides an ideal research en for this.

Through our robust and flexible framework, you can delve into the security challenges of cloud-nati, discover and explore inno solutions, and contribute your expertise and findings to the entire industry's de.

Metarget offers the following distincti to collaborators:

1. Diverse experimental scenarios: Utilize Metarget to effortlessly build cloud-nati en, co a spectrum of experiment scenarios from simple to complex, such as cloud-nati platform and cloud-nati course system.

2. cloud nati images： Without any scripting assistance, the en is readily a

3. Support for multiple of Kernel, Kubernetes, and other cloud-nati: Metarget consistently updates to support the latest of components, ensuring that you can use the latest technologies in your experiments.

4. Customization of Ubuntu : We will tailor Ubuntu based on your experimental requirements, pro you with a more flexible experimental en configuration.

5. Automatic generation of multi-node cloud-nati: Metarget offers the functionality to automatically create multi-node cloud-nati clusters, enhancing the realism and depth of your research.

6. ...

Joining Metarget provides you with comprehensi support and abundant collaboration opportunities, allowing you to explore the forefront of cloud-nati and contribute your unique insights to the future de of network security. We look forward to your participation in collectively shaping a new chapter in cybersecurity research!

10 About Logo

It is not a Kubernetes, but a infrastructure with three gears which could not work well () :)

10 License

Metarget is licensed under Apache License 2.0. See LICENSE for the full license text.

11 Events

KCon 2021 Arsenal

URL:

OpenInfra Days Asia 2021

Topic: Metarget: Auto-construction of Cloud Nati

Video:

PPT: OID-Asia-2021-Metarget.pdf

OpenInfra Days China 2021

Topic: Metarget：构建云原生基础设施靶场

PPT: OID-China-2021-Metarget.pdf

CCF BDTC 2021

Topic: 构建云原生基础设施靶场

Reference in Paper (IEEE TPS-ISA 2021)

Paper: Security Challenges in the Container Cloud

PDF: TPS21.pdf

CSDN Cloud Nati Summit 2022

Topic: 攻方视角：从开源靶场看云原生安全

PPT: CSDN云原生安全技术峰会-2022-攻方视角：从开源靶场看云原生安全.pdf

Reference in Paper (IC2E 2022)

Paper: PACED: Pro Automated Container Escape Detection

PDF: IC2E-2022.PACED.pdf

CIS 2022

Topic: Metarget: 云原生安全研究与自动化

URL:

Metarget Joins CNCF Landscape

URL:

KCD Shanghai 2024

项目信息

开发语言：Python

Star 数：1420

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Metarget is a framework providing automatic constructions of vulnerable infrastructures.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。