Beyond the Pod: Privilege Escalation in Kubernetes
summary
Four live demos show concrete escalation paths: using a misconfigured impersonate permission to mint JWTs and hijack multiple accounts, reading the demo secret from etcd to forge tokens, deploying a privileged pod with hostPID hostPath hostNetwork to nsenter the node and retrieve an admin kubeconfig, and running a reverse shell plus tcpdump to steal bearer tokens. Tools used: kubectl, nsenter, tcpdump and a simple attack server; each exploit succeeds and leads to full cluster or node compromise.
AI-written summary · about
chapters (11)
- 0:00Introduction and setup
- 2:13Kubernetes architecture overview
- 6:19Privilege escalation explained
- 9:09Kubernetes threat landscape
- 14:38Demo 1: Token hijacking
- 25:22Demo 1 analysis and lessons
- 26:50Demo 2: Node escape via pod
- 36:22Node escape risks and resources
- 38:29Demo 3: Reverse shell to node
- 47:13Security best practices summary
- 47:56Closing and Q&A
related talks
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
50mThe Hacker’s Guide to Kubernetes Reloaded
30mSecuring^WAttacking Kubernetes
55mThe Hacker's Guide to Kubernetes
13mBreaching the sky’s limit on your cloud: privilege escalation in Kubernetes
51mThe Hacker’s Guide to Insecure Workload Configuration in Kubernetes
40mHacking and Hardening Kubernetes Clusters by Example [I]
46mThe Hacker's Guide to Kubernetes