Enumeration from a Pod
In a situation where you have managed to break into a Kubernetes Pod you could start enumerating the kubernetes environment from within.
Service Account Tokens
Before continuing, if you don't know what is a service in Kubernetes I would suggest you to follow this link and read at least the information about Kubernetes architecture.
ServiceAccount is an object managed by Kubernetes and used to provide an identity for processes that run in a pod. Every service account has a secret related to it and this secret contains a bearer token. This is a JSON Web Token (JWT), a method for representing claims securely between two parties.
Usually in the directory /run/secrets/kubernetes.io/serviceaccount
or /var/run/secrets/kubernetes.io/serviceaccount
you can find the files:
ca.crt: It's the ca certificate to check kubernetes communications
namespace: It indicates the current namespace
token: It contains the service token of the current pod.
The service account token is being signed by the key residing in the file sa.key and validated by sa.pub.
Default location on Kubernetes:
/etc/kubernetes/pki
Default location on Minikube:
/var/lib/localkube/certs
Taken from the Kubernetes documentation:
“When you create a pod, if you do not specify a service account, it is automatically assigned the default service account in the same namespace.”
Hot Pods
Hot pods are pods containing a privileged service account token. A privileged service account token is a token that has permission to do privileged tasks such as listing secrets, creating pods, etc.
RBAC
If you don't know what is RBAC, read this section.
Enumeration CheatSheet
To enumerate the environment you can upload the kubectl binary and use it. Also, using the service token obtained before you can manually access some endpoints of the API Server.
In order to find the the IP of the API service check the environment for a variable called KUBERNETES_SERVICE_HOST
.
Differences between list
and get
verbs
list
and get
verbsWith get
permissions you can access the API:
If you have the list
permission, you are allowed to execute these API requests:
If you have the watch
permission, you are allowed to execute these API requests:
They open a streaming connection that returns you the full manifest of a Deployment whenever it changes (or when a new one is created).
The following kubectl
commands indicates just how to list the objects. If you want to access the data you need to use describe
instead of get
Using kubectl
when using kubectl it might come in handy to define a temporary alias, if the token used is different to the one defined in /run/secrets/kubernetes.io/serviceaccount
or /var/run/secrets/kubernetes.io/serviceaccount
.
Get namespaces
Get secrets
If you can read secrets you can use the following lines to get the privileges related to each to token:
Get Current Privileges
Once you know which privileges you have, check the following page to figure out if you can abuse them to escalate privileges:
Get Current Context
Get deployments
Get pods
Get services
Get nodes
Get daemonsets
Get "all"
Pod Breakout
If you are lucky enough you may be able to escape from it to the node:
Escaping from the pod
If you are able to create new pods you might be able to escape from them to the node. In order to do so you need to create a new pod using a yaml file, switch to the created pod and then chroot into the node's system. You can use already existing pods as reference for the yaml file since they display existing images and pathes.
Then you create your attack.yaml file
After that you create the pod
Now you can switch to the created pod as follows
And finally you chroot into the node's system
Information obtained from: Kubernetes Namespace Breakout using Insecure Host Path Volume — Part 1 Attacking and Defending Kubernetes: Bust-A-Kube – Episode 1
Sniffing
By default there isn't any encryption in the communication between pods .Mutual authentication, two-way, pod to pod.
Create a sidecar proxy app
Create your .yaml
Edit your .yaml and add the uncomment lines:
See the logs of the proxy:
More info at: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
Search vulnerable network services
As you are inside the Kubernetes environment, if you cannot escalate privileges abusing the current pods privileges and you cannot escape from the container, you should search potential vulnerable services.
Services
For this purpose, you can try to get all the services of the kubernetes environment:
Scanning
The following Bash script (taken from a Kubernetes workshop) will install and scan the IP ranges of the kubernetes cluster:
References
Last updated