Attacking and Detecting Attacks on Kubernetes Clusters
summary
Demonstrates a complete exploit chain on a DEF CON Kubernetes CTF cluster from Internet-facing web API to host compromise: nmap and curl find ports, dirb and wfuzz (34 requests) enumerate user/pass and get RCE via Base64 payloads, kubectl tokens stolen from pod-mounted service-account tokens let attackers list secrets and exec into pods, service selector editing creates an HTTP monkey-in-the-middle with netcat, node-serialize RCE on a Node.js pod spawns shells, hostPath manifests lead to privileged pod and nsenter breakout, and Peirates automated node takeover grabs kubeconfigs and secrets.
AI-written summary · about
chapters (12)
- 0:00Introduction and context
- 2:36Initial foothold
- 7:33Namespace traversal
- 10:45Vault and secret theft
- 15:34Network traffic manipulation
- 20:53Abusing services and logic
- 25:20Exploiting application flaws
- 28:44Configuration exploitation
- 30:40Container breakout
- 35:01Node access and automation
- 37:57Defensive strategies
- 46:22Detection and logging
related talks
38mKubernetes Security: Attacking and Defending K8s Clusters
29mKubernetes Security: Attacking and Defending K8s Clusters
19mHacking Kubernetes
38mKubernetes Security: Attacking and Defending K8s Clusters
45mThe Hacker’s Guide to Kubernetes
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
01h 37mLines of Defence – Securing Your Kubernetes Clusters
50mThe Hacker’s Guide to Kubernetes Reloaded