Hack Back; Let’s Learn Security With CTFs!
summary
A runnable CTF repo demonstrates a real chain: GitLab credentials harvested via OSINT lead to a leaked kubeconfig in an S3 bucket, giving kubectl access; misconfigured RBAC and a writable Deployment let attackers apply a manifest with privileged pod + hostPID/hostNetwork, use crictl and nsenter to pivot from container to host root, and exfiltrate secrets and flags. The demo uses kubectl/crictl, AWS S3, nsenter, ChainGuard images and suggests Tetragon for detection.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:50Speakers and CTF overview
- 3:58What is a CTF
- 6:26Realistic CTF setup
- 7:07FUBAR Taxi scenario
- 12:05Kubernetes pod exploits
- 21:18Container to host compromise
- 24:06Boombox service exploit
- 26:38Attack path summary
- 27:21CTF resources
- 29:07Q&A
related talks
19mHacking Kubernetes
26mHacking into Kubernetes Security for Beginners
49mAttacking and Detecting Attacks on Kubernetes Clusters
38mA Treasure Map of Hacking (and Defending) Kubernetes
55mThe Hacker's Guide to Kubernetes
50mThe Hacker’s Guide to Kubernetes Reloaded
45mThe Hacker’s Guide to Kubernetes
44mStranger Danger - hack my misconfigured Kubernetes