first commit

Author: Robthreefold

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @snyk/devrel

.github/workflows/log4shell-goof-server-docker-image.yaml

@@ -0,0 +1,70 @@
+name: log4shell-goof-server Docker image build and test
+
+on:
+  push:
+    branches:
+      - 'main'
+    paths:
+      - 'log4shell-goof/log4shell-goof-server/**'
+      - '.github/workflows/log4shell-goof-server-docker-image.yaml'
+  pull_request:
+    branches:
+      - 'main'
+    paths:
+      - 'log4shell-goof/log4shell-goof-server/**'
+      - '.github/workflows/log4shell-goof-server-docker-image.yaml'
+jobs:
+
+  build-log4shell-server-image:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: log4shell-goof/log4shell-server
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Build
+        uses: docker/build-push-action@v2
+        with:
+          load: true
+          context: log4shell-goof/log4shell-server
+          push: false
+          tags: log4shell-server:latest
+
+      - name: Run container
+        run: docker run -d --rm --name log4shell-server log4shell-server:latest && sleep 5
+
+      - name: Smoke test LDAP running in container
+        run: docker logs log4shell-server | grep "LDAP server listening on 0.0.0.0:8000"
+
+      - name: Smoke test HTTP running in container
+        run: docker logs log4shell-server | grep "HTTP server listening on 0.0.0.0:9999"
+
+      - name: Cleanup container
+        run: docker kill log4shell-server
+
+      - name: Start minikube
+        uses: medyagh/setup-minikube@master
+        with:
+          cni: calico
+
+      - name: Deploy to minikube
+        run: |
+          sed -i 's/${DOCKER_ACCOUNT}\///' k8s/deploy.yaml
+          sed -i 's/imagePullPolicy: Always/imagePullPolicy: Never/' k8s/deploy.yaml
+          minikube image load log4shell-server:latest
+          kubectl apply -f k8s/deploy.yaml
+
+      - name: Test pods came up cleanly
+        run: |
+          kubectl get all --namespace=darkweb && \
+          kubectl wait --namespace=darkweb --for=condition=ready pod --selector=app=log4shell --timeout=90s
+
+      - name: Dump pod description
+        if: ${{ failure() }}
+        run: |
+          kubectl describe pod --namespace=darkweb --selector=app=log4shell
+          kubectl describe deploy --namespace=darkweb --selector=app=log4shell

.github/workflows/todolist-goof-docker-image.yaml

@@ -0,0 +1,65 @@
+name: todolist-goof Docker image build and test
+
+on:
+  push:
+    branches:
+      - 'main'
+    paths:
+      - 'todolist-goof/**'
+      - '.github/workflows/todolist-goof-docker-image.yaml'
+  pull_request:
+    branches:
+      - 'main'
+    paths:
+      - 'todolist-goof/**'
+      - '.github/workflows/todolist-goof-docker-image.yaml'
+
+jobs:
+  build-todolist-image:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: todolist-goof
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Build
+        uses: docker/build-push-action@v2
+        with:
+          load: true
+          context: todolist-goof
+          push: false
+          tags: java-goof:latest
+
+      - name: Run container
+        run: docker run -d --rm --name java-goof -p 8080:8080 java-goof:latest
+
+      - name: Smoke test container
+        run: sleep 5 && curl -s --retry 5 --retry-delay 1 --retry-max-time 30 http://localhost:8080/todolist/ 
+
+      - name: Teardown container
+        run: docker kill java-goof
+
+      - name: Start minikube
+        uses: medyagh/setup-minikube@master
+        with:
+          cni: calico
+
+      - name: Deploy to minikube
+        run: |
+          sed -i 's/${DOCKER_ACCOUNT}\///' k8s/java-goof.yaml
+          sed -i 's/imagePullPolicy: Always/imagePullPolicy: Never/' k8s/java-goof.yaml
+          minikube image load java-goof:latest
+          kubectl apply -f k8s/java-goof.yaml
+
+      - name: Test pod came up cleanly
+        run: |
+          kubectl get all
+          kubectl wait --for=condition=ready pod --selector=app=goof --timeout=90s
+
+      - name: Dump pod description
+        if: ${{ failure() }}
+        run: kubectl describe pod --selector=app=goof

.gitignore

@@ -0,0 +1,4 @@
+*.iml
+.idea
+**/target/**
+**/.DS_Store

README-K8S.md

@@ -0,0 +1,47 @@
+# Kubernetes based Todolist + Log4Shell exploit
+To deploy Todolist on Kubernetes along with the needed ldap backend for exploiting the Log4shell
+vulnerability:
+
+## Prerequisites
+1. A kubernetes cluster where you have permissions to create namespaces, deployments and services
+2. The `kubectl` client and credenials configuration
+3. Docker Desktop or docker-ce (for building and pushing images)
+4. A DockerHub account that you are logged in with at the command prompt (via `docker login`)
+
+## Quickstart
+Assuming you have your kubernetes cluster up and ready, from the top level of this repo you can run `./k8s-quickstart.sh` which will do the following:
+1. Builds todolist-goof image and pushes it to Docker Hub. _(see below for account/tagging info)_
+2. Deploys the todolist to the `default` namespace in your kubernetes cluster along with a LoadBalancer type service
+3. Builds the log4shell-server image and pushes to Docker Hub. _(see below for account/tagging info)_
+4. Deploys the log4shell-server and a pair of ClusterIP type services into a new namespace named `darkweb` in your Kubernetes cluster.
+
+NOTE: You will be prompted for your DockerHub account in order for the scripts to tag, push and pull the images.
+If you set and environmental variable named `DOCKER_ACCOUNT` to that account name, the script will pre-populate that prompt with it.
+```bash
+export DOCKER_ACCOUNT="yourdockeraccount"
+```
+## Accessing the application
+Once complete, run `kubectl get svc` and note the IP Address or hostname of the `goof` service.
+
+You should be able to open a browser to http://{svc-ip-addr}/todolist and see the app
+
+#### EKS cluster notes
+* In order to perform NetworkPolicy egress examples, you will need to deploy the Calico CNI plugin as EKS does not implement NetworkPolicy by default.
+  The `eks-calico.sh` script in `todolist-goof/k8s` will deploy this for you. (that script is sym-linked to the top level here too)
+* You should log into the AWS console and change inbound access for the good service's ELB to only allow your home IP, otherwise you *will* have audience members trying to mess with it.
+
+#### Docker Desktop Kubernetes notes
+* Docker Desktop automatically serves the goof service loadblancer external IP to your workstation's localhost so the app will be available at http://localhost/todolist
+* Docker Desktop Kubernetes CNI does not implement Network Policy so you will not be able to demonstrate any mitigation techniques that use that.
+
+#### Kind (Kubernetes on Docker) notes
+* Kind's default CNI does not currently support Network Policy so you should deploy your own using the instructions on their website.
+* If running Kind on top of Docker Desktop, you will need to run a port-forward to access the app.  For example, use something like this: `kubectl port-forward service/goof 8000:80` and then access it via browser at http://localhost:8000/todolist
+
+## Quick cleanup
+Run the `/.k8s-quickstop.sh` script at the top level of this repo which will do the following:
+1. Deletes the todolist deployment and associated service in the `default` namespace
+2. Deletes the log4shell deployment and associated services in the `darkweb` namespace and deltes the namespace as well
+   **Note:** This will not delete any additional objects you may have deployed such as NetworkPolicies.
+
+It is up to you to shut down your Kubernetes cluster as appropriate.

README.md

@@ -0,0 +1,9 @@
+## Java Goof
+
+This is a collection of Java demo apps that are vulnerable in different ways.
+
+It's divided into modules, each one having its own README:
+
+* [Todolist Goof](todolist-goof/README.md)
+* [Log4Shell Goof](log4shell-goof/README.md)
+* [Quickstart for running both Todolist with Log4Shell in Kubernetes](README-K8S.md)

eks-calico.sh

@@ -0,0 +1 @@
+todolist-goof/k8s/eks-calico.sh

k8s-quickstart.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+TOP_LEVEL_MYDIR=$(dirname $0)
+if [[ "$1" == "" ]]; then
+  read -e -i "${DOCKER_ACCOUNT}" -p "Please enter your DockerHub user/account name: " input
+  name="${input:-$DOCKER_ACCOUNT}"
+else
+  DOCKER_ACCOUNT=$1
+fi
+$TOP_LEVEL_MYDIR/todolist-goof/k8s/quickstart.sh $DOCKER_ACCOUNT
+$TOP_LEVEL_MYDIR/log4shell-goof/log4shell-server/k8s/quickstart.sh $DOCKER_ACCOUNT

k8s-quickstop.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+TOP_LEVEL_MYDIR=$(dirname $0)
+$TOP_LEVEL_MYDIR/todolist-goof/k8s/shutdown.sh
+$TOP_LEVEL_MYDIR/log4shell-goof/log4shell-server/k8s/shutdown.sh

kind-init.sh

@@ -0,0 +1 @@
+todolist-goof/k8s/kind-init.sh