Stranger Danger - hack my misconfigured Kubernetes
summary
Starts from a web app with remote command execution and uses curl to read in-pod env vars and the auto-mounted service account token, then configures kubectl and runs kubectl auth/can-i and access-matrix to map permissions. Uses nmap and socat to pivot (port-forwarding to a second pod), launches arbitrary pods, abuses missing allowPrivilegeEscalation and lax pod security policies to mount hostPath and inspect kubelet/etcd, extracts a cluster role aggregation token from etcd and obtains cluster-admin — full takeover on a kind demo, all steps succeed.
AI-written summary · about
chapters (7)
- 0:00Start
- 6:35Timeline of Doom
- 14:27The Access Matrix Plugin
- 18:57Create Container Config Error
- 21:13Run a Non-Root Non-Privileged Pod
- 26:57Construct a Tunnel
- 40:06Is this the Same on all Kubernetes Platforms
related talks
33mTutorial: Hack My Mis-Configured Kubernetes
01h 13mTutorial: Hands-on Hacking Kubernetes and Ways to Prevent It
34mHijack a Kubernetes Cluster - a Walkthrough
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
50mBeyond the Pod: Privilege Escalation in Kubernetes
30mSecuring^WAttacking Kubernetes
19mHacking Kubernetes
50mThe Hacker’s Guide to Kubernetes Reloaded