Owning Gluster FS with GEVAUDAN

### Attack Surfaces in Distributed Storage Clusters At 00:00, security researcher Mauro Caseres demonstrates vulnerabilities in GlusterFS distributed file systems and introduces the GEVAUDAN exploitation toolkit at the Data Duplication Village. Caseres highlights how distributed storage clusters represent critical infrastructure targets.

### GlusterFS Architecture and Containerized Environments At 05:08, the presentation examines GlusterFS clustering architecture. Caseres explains how GlusterFS aggregates storage bricks across multiple network nodes using Docker containers and remote procedure call (RPC) daemons to serve petabyte-scale file systems.

### Remote RPC Vulnerabilities and Authentication Bypasses At 10:31, Caseres demonstrates how default GlusterFS deployments (specifically version 3.8.8) expose unauthenticated RPC listener ports. An attacker with network access can send crafted RPC packets to query cluster topologies, read volume parameters, and interact directly with internal daemons.

### Exploitation Mechanics with the GEVAUDAN Framework At 15:54, Caseres details the design of GEVAUDAN, an exploit toolkit designed to compromise vulnerable GlusterFS instances. He demonstrates how GEVAUDAN executes arbitrary commands, alters access control lists, and extracts stored files directly from network storage volumes.

### Metasploit Integration and Cluster Hardening Concluding between 20:59 and 26:26, Caseres showcases both standalone Python and Metasploit implementations of GEVAUDAN. He outlines defensive mitigations, advising administrators to configure strict firewall filtering around RPC ports, enable TLS communication between nodes, and upgrade to patched GlusterFS releases.

(AI summary — Gemini Flash)