Tutorial: Hands-on Hacking Kubernetes and Ways to Prevent It
summary
Walks through exploiting a contrived Python remote code execution to steal a mounted service account token, use curl and kubectl (via kind 1.24 on Docker Desktop) to query the API, run nmap and socat to pivot, port‑forward into other pods, grab a kubelet token and deploy an etcd client to escalate to cluster admin — the full chain works end‑to‑end in the demo. Shows PSPs blocking some steps but notes PSP deprecation and recommends pod security policy replacements, network policies, disabling automountServiceAccountToken, and readOnlyRootFilesystem.
AI-written summary · about
chapters (9)
- 0:00Kubernetes security risks
- 1:48Vulnerable demo setup
- 9:58Exploiting app vulnerability
- 15:17Accessing Kubernetes API
- 24:20Privilege escalation in cluster
- 34:15Attack expansion in cluster
- 45:09Owning control plane
- 53:01Security hardening mitigation
- 1:06:04Q&A
related talks
33mTutorial: Hack My Mis-Configured Kubernetes
40mHacking and Hardening Kubernetes Clusters by Example [I]
30mSecuring^WAttacking Kubernetes
45mThe Hacker’s Guide to Kubernetes
44mStranger Danger - hack my misconfigured Kubernetes
19mHacking Kubernetes
46mThe Hacker's Guide to Kubernetes
38mA Treasure Map of Hacking (and Defending) Kubernetes