Kubernetes Cluster Attacks

You have access to a Kubernetes environment, either through a compromised pod, stolen kubeconfig, or exposed API server. Your objective is to escalate privileges, move laterally, and compromise the cluster or underlying cloud infrastructure. Kubernetes security depends on RBAC policies, network policies, admission controllers, pod security standards, and cloud IAM integration. Each misconfiguration opens a path to deeper access. This skill covers systematic enumeration, privilege escalation, secret extraction, and cluster-wide compromise techniques.

Quick Workflow

1. Determine your initial position: pod shell, stolen token, exposed API, or kubeconfig file.
2. Enumerate service account permissions, cluster roles, and accessible resources.
3. Identify escalation vectors: RBAC gaps, kubelet exposure, hostPath mounts, cloud metadata access.
4. Escalate privileges by chaining misconfigurations or abusing overprivileged service accounts.
5. Extract secrets, pivot to other namespaces, and target the control plane.
6. Leverage cloud metadata or etcd access for infrastructure-wide compromise.

Phase 1: Initial Enumeration

Determining Your Position