Post-Exploiting a Compromised ETCD
Talkat KubeCon + CloudNativeCon + Open Source Summit China 2023 · on Wednesday, 2023-09-27· at 14:45· 3层 301明珠厅| 3F The Pearl Hall 301·
summary
Requires access to etcd TLS certs and a reachable etcd instance in a self‑managed cluster; serialized Kubernetes objects in etcd are protobuf blobs that can be edited and reinserted. Uses an etcd⇄YAML tool originally from Joe B plus a custom wrapper (qcd / cubetcd) that randomizes UIDs and strips Pod hashes to avoid API inconsistencies. Demonstrates injecting a privileged Pod into a restricted namespace, creating fake etcd paths so the API can’t delete pods, spawning a reverse shell and gaining root on a node. Doesn’t work on managed control planes.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:24Post-exploitation requirements
- 3:09ETCD in Kubernetes
- 5:42Kubernetes-ETCD interaction
- 8:10Prototext serialization
- 10:37ETCD exploitation tool
- 12:48Modifying ETCD entries
- 16:48Security context & admission
- 19:41Live ETCD exploitation
- 27:35Why this technique works
- 29:48Mitigating threats
- 30:33Conclusions
- 31:37Q&A
related talks
31mA Hacker's Guide to Kubernetes and the Cloud
50mThe Hacker’s Guide to Kubernetes Reloaded
55mThe Hacker's Guide to Kubernetes
50mBeyond the Pod: Privilege Escalation in Kubernetes
01h 13mTutorial: Hands-on Hacking Kubernetes and Ways to Prevent It
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
33mTutorial: Hack My Mis-Configured Kubernetes
49mAttacking and Detecting Attacks on Kubernetes Clusters