Understanding and Mitigating Privilege Escalation Threats in Kubernetes
summary
Demonstrations show full cluster compromise from simple misconfigurations: using kubectl impersonation and a mis-scoped RBAC to list secrets, extracting a JWT HS256 secret from a backend Secret and minting tokens via jwt.io, deploying a privileged pod with hostPID/hostNetwork/hostPath to nsenter the node, find kubeconfigs and kubeadmin creds, and read etcd; then sniffing pod traffic with tcpdump on flannel interface and getting a reverse shell back to an attacker ncat listener. All exploits work live against the demo cluster.
AI-written summary · about
chapters (13)
- 0:00Introduction to talk
- 2:42Kubernetes architecture overview
- 7:26Privilege escalation explained
- 14:16Threat modeling in Kubernetes
- 18:29Demo vulnerable app setup
- 23:21Exploiting RBAC misconfigurations
- 25:47Escaping to node from pod
- 34:59Secrets management failures
- 36:23Reverse shell for cluster access
- 42:10Sniffing traffic via CNI
- 48:07Pod security configuration risks
- 51:05Secure cluster configurations
- 52:31Final security recommendations
related talks
50mBeyond the Pod: Privilege Escalation in Kubernetes
13mBreaching the sky’s limit on your cloud: privilege escalation in Kubernetes
50mThe Hacker’s Guide to Kubernetes Reloaded
55mThe Hacker's Guide to Kubernetes
51mThe Hacker’s Guide to Insecure Workload Configuration in Kubernetes
30mSecuring^WAttacking Kubernetes
49mAttacking and Detecting Attacks on Kubernetes Clusters
33mTutorial: Hack My Mis-Configured Kubernetes