The Hand That Feeds: How to Misuse Kubernetes
summary
A vulnerable CI/CD web page allows command injection via a copied curl request and the attacker builds a reverse shell through angrock and Penelope, gaining an interactive session. A mounted service account token authenticates to the API (using Cube cuddle), the config Map named "emotions" is edited to add joy and sadness which triggers cluster reconciliation, and the container exposes /var/run/docker.sock so a Docker run with privileged container and host PID namespace gives root on the node — the attack chain works end to end.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:08Why misuse Kubernetes
- 3:59Control Plane and Hacking Kubernetes
- 6:25Breaking things with CTF
- 9:33Injection attack on CI/CD
- 22:20Kubernetes basics speed run
- 31:50Abusing service accounts and RBAC
- 40:02Containerization and Linux namespaces
- 42:51Container breakout via Docker socket
- 51:57Mitigations and defense strategies
- 54:01Q&A
related talks
34mHijack a Kubernetes Cluster - a Walkthrough
33mTutorial: Hack My Mis-Configured Kubernetes
01h 13mTutorial: Hands-on Hacking Kubernetes and Ways to Prevent It
38mA Treasure Map of Hacking (and Defending) Kubernetes
55mThe Hacker's Guide to Kubernetes
45mThe Hacker’s Guide to Kubernetes
40mHacking and Hardening Kubernetes Clusters by Example [I]
32mKubernetes Attack and Defense: Inception-Style