Kubernetes Hacking: From Weak Applications to Cluster Control
Source: YouTube · John Hammond · published Apr 18, 2023 · 36:23
The presenter executes a comprehensive Kubernetes penetration test, exploiting a command injection vulnerability to gain container access, stealing the Grafana service account token, and leveraging cluster administrator privileges to break out of the container and compromise the host machine. 0:25-0:35 4:00-4:05
Key Takeaways:
• A command injection vulnerability in the web service allowed the attacker to establish a reverse shell within the Docker container and discover Kubernetes configuration details. 1:12-1:37
• Installing kubectl and enumerating access revealed limited permissions, which were escalated by exploiting a Local File Inclusion (LFI) vulnerability in Grafana to read the service account token. 10:00-11:10 18:00-19:00
• Using the compromised token to authenticate with the API, the attacker obtained full Cluster Admin privileges and created a privileged pod that mounted the host's root filesystem to execute a container escape. 21:00-22:00 26:00-End
This walkthrough highlights the critical necessity of input validation and least-privilege service accounts in securing Kubernetes environments.
Sources:
- 0:30-1:12 Initial reconnaissance and exploiting the command injection vulnerability.
- 4:00-10:00 Establishing a shell and installing kubectl.
- 10:00-14:00 Identifying permissions and K8s secrets.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
kubernetes it is so cool how it can orchestrate and manage multiple software containers all these things hosted with Docker in production environments and Cloud all of this awesome stuff but in some cases as with all things depending on vulnerabilities may be present in that software or security stack potentially any individual or user threat actor hacker adversary could gain access and compromise an entire cluster in this video we're going to chat about it we're going to dive in we're gonna do some Show and Tell demonstrations of how you might hack kubernetes so I am inside of my Kali Linux virtual machine and I want to show you this IP address I fired up a terminal so I can do some cool stuff on the command line but this IP address 1010-23784 is our Target it's going to be our victim it'…