How to take ownership of an entire Kubernetes cluster
summary
A single remote code execution in an internet‑exposed app allows pulling tools (curl, kubectl), creating an SSH pod, mounting the node with a hostPath mount, escaping the container to become root on the node, finding /etc/rancher/k3s/k3s.yaml, using its client certs to talk to the API and obtain cluster-admin rights, and then binding that role back to the original service account. The demo uses apk/curl/kubectl/ssh on a k3s cluster and the attack chain succeeds end‑to‑end.
AI-written summary · about
chapters (12)
- 0:00Start
- 0:46Kubernetes Hacking
- 3:22Small Kubernetes Cluster
- 6:36Image Scanning
- 9:50Package Managers
- 11:10Cubecontrol
- 17:16Connect to a Container
- 24:01Use a Proxy Container Registry
- 24:56Process Listing
- 25:46Searching Files
- 28:32Node Affinity
- 34:36Static Manifests
related talks
01h 13mTutorial: Hands-on Hacking Kubernetes and Ways to Prevent It
44mStranger Danger - hack my misconfigured Kubernetes
40mHacking and Hardening Kubernetes Clusters by Example [I]
30mSecuring^WAttacking Kubernetes
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
33mTutorial: Hack My Mis-Configured Kubernetes
34mHijack a Kubernetes Cluster - a Walkthrough
35mHijack a Kubernetes Cluster - a Walkthrough