| name | k8s-postexploit |
| description | Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence |
| category | post-exploitation |
| tags | ["kubernetes","k8s","container","post-exploitation","rbac","escape","etcd","secrets","daemonset","cronjob"] |
| tech_stack | ["kubernetes","kubectl","etcdctl"] |
| cwe_ids | ["CWE-269","CWE-522","CWE-693","CWE-250"] |
| chains_with | ["T1611","T1552.007","T1613","T1610","T1053.007"] |
| prerequisites | ["T1610","T1078"] |
| version | 1.0 |
Kubernetes Post-Exploitation Methodology
Kubernetes post-exploitation targets cluster resources, RBAC misconfigurations, container security boundaries, and etcd for secret extraction. After compromising a pod or obtaining kubeconfig, these tools provide cluster enumeration, privilege escalation, container escape, and persistent access.
Prerequisites
- Kubernetes access — kubeconfig file, service account token, or in-cluster config
- Python packages —
pip3 install kubernetes etcd3
- Current context — verify access via
kubectl auth can-i --list
kubectl cluster-info
kubectl auth can-i --list
python3 -c "from kubernetes import client; print('OK')"
Kill Chain Phases
Phase 1 — Cluster Enumeration
| Action | Command | Purpose |
|---|
| Full enumeration | kubehook k8s_enum | Map namespaces, pods, services, RBAC, ingress |
| Secret metadata | kubehook k8s_enum --namespace kube-system | Focus on high-value system namespace |
Phase 2 — Secret Extraction
| Action | Command | Purpose |
|---|
| K8s Secrets | kubehook k8s_secrets | Extract and decode all Kubernetes Secrets |
| etcd dump | kubehook etcd_dump --endpoint ENDPOINT | Direct etcd access for all secrets |
Phase 3 — Privilege Escalation
| Action | Command | Purpose |
|---|
| Container escape | kubehook k8s_escape | Detect escape vectors (privileged, hostPID, docker socket) |
| RBAC abuse | kubehook k8s_privesc --method bind_admin | Create ClusterRoleBinding for cluster-admin |
