Pentesting Azure Container Services
summary
Live demos show how to pull an ACR image, modify its layer and manifest to add an ld_preload trojan, recalculate layer hashes, repush with az acr login credentials recovered from a workstation, then run it in ACI and AKS to get a reverse shell. kubectl tokens in ~/.kube allow quick cluster access; lateral movement uses nmap/netdiscover to find a Redis backend and manipulate votes. Tools and mitigations shown: docker, kubectl, kubehunter, Azure Defender, content trust, private links, and network policies.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 3:15Containers 101
- 7:23Quick Hits
- 11:23Container Registry
- 13:34Portal
- 15:33Credentials
- 20:10Preload
- 22:23Testing
- 25:57Update Registry
- 27:39Create Container Instance
- 29:42Monitor the progress
- 30:34Testing the trojan
- 32:06Testing on Kubernetes
- 33:17Installing Curl
- 34:44Testing Kubernetes
- 36:12Installing nmop
- 36:53Scanning the network
- 37:33Scanning the address
- 38:05Checking the port
- 39:11Testing the application
- 42:19Mitigations
- 45:13Content Trust
- 48:17Azure Defender
related talks
48mPentesting Azure Container Services
59mPentesting Azure Container Services
47mBest-practices for securing your Azure Container Services
43mSecuring container deployments on Azure Kubernetes Service with open-source tools
23mContainer code with confidential containers on Azure
35mHijack a Kubernetes Cluster - a Walkthrough
34mHijack a Kubernetes Cluster - a Walkthrough
51mAdvanced Attack Vectors in Azure Environments