RCE and the Full Cluster Breach: Don't Let Your Security Be the Punchline of a Joke
summary
A concrete exploit chain demonstrates user-controllable expression language leading to reverse shell via one-liner that lands root in an Alpine pod, then downloads kubectl with curl, uses the default service account token and readable ConfigMaps to harvest secrets, installs openssl to craft node bootstrap certs (pre-1.26) to impersonate nodes, and abuses Carpenter plus the EC2 metadata to extract AWS keys via AWS CLI and STS, resulting in a full cluster breach and AWS role takeover.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 2:06Adventure overview
- 3:54Web app and cluster overview
- 7:56Injection vulnerability
- 10:44Remote code execution
- 11:48Post-exploitation in Kubernetes
- 13:14Default token risks
- 15:26ConfigMaps and secrets exposure
- 17:11Node impersonation
- 21:45Carpenter tool exploitation
- 26:01EC2 metadata risks
- 28:52User data secrets
- 29:33Recap and treasure hunt
- 29:53Security takeaways
- 31:18Q&A
related talks
49mAttacking and Detecting Attacks on Kubernetes Clusters
46mAttacking AWS: The Full Cyber Kill Chain
38mKubernetes Security: Attacking and Defending K8s Clusters
33mHack Back; Let’s Learn Security With CTFs!
19mHacking Kubernetes
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
01h 00mThe Hand That Feeds: How to Misuse Kubernetes
38mA Treasure Map of Hacking (and Defending) Kubernetes