Pentesting Azure Container Services
summary
Live demos show downloading an Azure Container Registry image, extracting layer.tar, inserting a shared object and LD_PRELOAD to get a reverse shell, recalculating layer hashes, pushing the poisoned image back to ACR, and deploying it to Azure Container Instance and AKS where a kube token and a Redis instance on port 6379 reveal keys. Commands use Docker, kubectl and curl; the attacks succeed in the demo. Mitigations: private link, image signing, least-privilege and network policies.
AI-written summary · about
chapters (5)
- 0:00Introduction and setup
- 2:58Stealing credentials
- 8:55Container image poisoning
- 30:01Execution and lateral movement
- 45:38Mitigation and best practices
related talks
52mPentesting Azure Container Services
48mPentesting Azure Container Services
47mBest-practices for securing your Azure Container Services
35mHijack a Kubernetes Cluster - a Walkthrough
43mSecuring container deployments on Azure Kubernetes Service with open-source tools
57mWhat vulnerabilities? Live hacking of containers and orchestrators
32mKubeCapture: A Live Hacking Showcase on Kubernetes Security
41mUncovering Azure's Silent Threats: A Journey into Cloud Vulnerabilities