Hijack a Kubernetes Cluster - a Walkthrough
summary
Exploit uses Log4Shell via LDAP/JNDI to trigger a remote class load (public POC LDAP+HTTP server), spawns a reverse shell (netcat on 443), reads the in‑pod service account token and cert, calls the Kubernetes API (curl, kubectl), creates a privileged pod that mounts the containerd socket, enumerates other containers, steals a Redis key and reads data, mounts the host disk to grab /etc/kubernetes/azure.json, uses Azure IMDS one‑time token to call the Azure API and create a storage account — end‑to‑end exploit succeeds.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:33Why do we need to care about security?
- 22:41Ensure secure application code
- 23:21Build secure container images
- 24:50Ensure secure deployment code
- 26:01Kubernetes policies
- 27:23Network Policies
related talks
34mHijack a Kubernetes Cluster - a Walkthrough
01h 13mTutorial: Hands-on Hacking Kubernetes and Ways to Prevent It
49mAttacking and Detecting Attacks on Kubernetes Clusters
55mThe Hacker's Guide to Kubernetes
50mBeyond the Pod: Privilege Escalation in Kubernetes
50mThe Hacker’s Guide to Kubernetes Reloaded
30mSecuring^WAttacking Kubernetes
44mStranger Danger - hack my misconfigured Kubernetes