The Path Less Traveled: Abusing Kubernetes Defaults
summary
Live demos exploit common defaults: using sigs.k8s.io/kind (kubeadm-backed) to direct-schedule a pod onto the control plane and read etcd, extract a clusterrole aggregation-controller token, mount hostPath /var/run/docker.sock to spawn containers as root on the node, and use hostPID + nsenter to jump into pid 1 and gain host root. PodSecurityPolicies (admission control) block many of these, but static pod manifests and kubelet-hosted pods can bypass admission control and persist backdoors.
AI-written summary · about
chapters (35)
- 0:00Introduction
- 0:46Thank you
- 1:06Introductions
- 1:56Check your assumptions
- 2:19Kubernetes defaults
- 3:28What is Kubernetes
- 4:21What does Kubernetes mean
- 4:41How does Kubernetes work
- 6:43Kubernetes components
- 9:03Kubernetes API
- 9:23Kubernetes Misconfigurations
- 9:54CubeKettle
- 10:33Apply
- 12:54API Server
- 14:08Pod Scheduling
- 14:37Demonstration
- 14:55Pod manifest
- 16:01Deploy Pod
- 16:35System Access
- 17:15Enumeration Tool
- 18:15Summary
- 19:15Host Path
- 20:46Docker
- 21:30Docker manifest
- 26:00Takeaway
- 27:05Container Parts
- 30:56Lets play with it
- 35:03Takeaways
- 36:04Is there any way to mitigate
- 36:14Admission Control
- 38:01Hide Security Policies
- 38:47Restrict Security Policies
- 42:12Quit 5 Security Policies
- 42:23Conclusions
- 42:46Does Admission Control Fix Everything
related talks
28mThe Path Less Traveled: Abusing Kubernetes Defaults
50mBeyond the Pod: Privilege Escalation in Kubernetes
30mSecuring^WAttacking Kubernetes
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
40mHacking and Hardening Kubernetes Clusters by Example [I]
33mTutorial: Hack My Mis-Configured Kubernetes
50mThe Hacker’s Guide to Kubernetes Reloaded
44mStranger Danger - hack my misconfigured Kubernetes