KubeCapture: A Live Hacking Showcase on Kubernetes Security
summary
Live capture the flag demonstration shows a malicious CouchDB image with reverse shell deployed to Docker Hub and catching a cluster that pulls it; attacker can read NFS-mounted app data, lacks root and service account token but still finds flags by scanning service IPs with downloaded nmap, exposing the Kubernetes dashboard via an FRPC tunnel to expose dashboard, extracting secrets and Argo CD admin credentials from CI environment variables, pivoting into runner pods and validating multiple working escalation paths.
AI-written summary · about
chapters (7)
- 0:00Introduction and setup
- 3:06Breaking into the cluster
- 4:22Initial reconnaissance
- 10:27Network and service scanning
- 17:30Accessing the dashboard
- 22:21Pipeline exploration
- 26:54Social engineering and conclusion
related talks
55mThe Hacker's Guide to Kubernetes
38mA Treasure Map of Hacking (and Defending) Kubernetes
45mThe Hacker’s Guide to Kubernetes
49mAttacking and Detecting Attacks on Kubernetes Clusters
01h 24mTutorial: Attacking and Defending Kube...
19mHacking Kubernetes
20mUncovering a Sophisticated Kubernetes Attack in Real-Time
26mHacking into Kubernetes Security for Beginners