Tutorial: Hack My Mis-Configured Kubernetes
summary
A vulnerable web app with remote command execution exposes environment variables, letting an attacker read the auto-mounted service account token, curl the API, and create a kubeconfig; kubectl, port-forward, nmap and socat map the cluster and tunnel to another vulnerable app, whose token grants access to the default namespace. Weak pod security policies (missing allowPrivilegeEscalation false) and permissive image/network rules let the attacker deploy a privileged pod, mount the host root, become node root, query etcd for controller tokens and achieve cluster-admin total compromise.
AI-written summary · about
chapters (5)
related talks
44mStranger Danger - hack my misconfigured Kubernetes
01h 13mTutorial: Hands-on Hacking Kubernetes and Ways to Prevent It
30mSecuring^WAttacking Kubernetes
34mHijack a Kubernetes Cluster - a Walkthrough
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
50mThe Hacker’s Guide to Kubernetes Reloaded
55mThe Hacker's Guide to Kubernetes
40mHacking and Hardening Kubernetes Clusters by Example [I]