Hijack a Kubernetes Cluster - a Walkthrough
summary
A vulnerable ping web app allows command injection (semicolon) to spawn /bin/bash and open a reverse shell to an attacker VM; from the container the mounted service account token and cert are read and curl/kubectl talk to the API, creating a privileged pod with hostPath to /run/containerd so containerd CLI lists node containers and reveals env secrets. Mounting the node disk exposes cloud creds and a stolen Azure managed identity token usable to create cloud resources. Fixes: shift‑left, minimal images, network policies, readOnlyRootFS, Falco, OPA/Gatekeeper/Kyverno.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 0:18Overview
- 3:31Ping
- 5:01Enrich
- 8:55Bash
- 10:37Prevention
- 12:59API Access
- 20:12Privileged Pot
- 21:47Install Tools
- 22:50Container List
- 23:34Policies
- 24:50Getting access to another container
- 28:13Getting container info
- 29:19Accessing other cloud resources
related talks
35mHijack a Kubernetes Cluster - a Walkthrough
30mSecuring^WAttacking Kubernetes
33mTutorial: Hack My Mis-Configured Kubernetes
38mA Treasure Map of Hacking (and Defending) Kubernetes
01h 00mThe Hand That Feeds: How to Misuse Kubernetes
01h 13mTutorial: Hands-on Hacking Kubernetes and Ways to Prevent It
44mStranger Danger - hack my misconfigured Kubernetes
19mHacking Kubernetes