Insekube

Introduction

Start Machine

The learning objectives for this room are:

  • Interacting with the cluster using kubectl

  • Reading Kubernetes secrets

  • Doing recon inside the cluster

  • Switching service accounts to escalate your privileges

  • Lateral movement into other workloads

  • Gaining access to the Kubernetes nodes

We assume basic knowledge of the Kubernetes architecture and some experience running Kubernetes administration tools like kubectl.

Disclaimer: Due to this room running on a VM it uses minikube which is not exactly the same as running a fully fledged Kubernetes cluster so you might experience some minor differences with a real cluster.

This machine can take a while to boot up (Give it 4 or 5 minutes)

Scan the machine. (If you are unsure how to tackle this, I recommend checking out the Nmap room)

Answer the questions below

What ports are open? (comma separated)

22,80

RCE

Visit the website, it takes a host and returns the output of a ping command.

Use command injection to get a reverse shell. For more information on command injection attacks take a look at this room

You will find the flag in an environment variable.

Answer the questions below

What is flag 1?

flag{5e7cc6165f6c2058b11710a26691bb6b}

Interacting with kubernetes

Kubernetes exposes an HTTP API to control the cluster. All resources in the cluster can be accessed and modified through this API. The easiest way to interact with the API is to use the kubectl CLI. You could also interact with the API directly using curl or wget if you don't have write access and kubectl is not already present, Here is a good article on that.

The kubectl install instructions can be found here. However, the binary is located in the /tmp directory. In the event you run into a scenario where the binary is not available, it's as simple as downloading the binary to your machine and serving it (with a python HTTP server for example) so it is accessible from the container.

Now let's move to the /tmp directory where the kubectl is conveniently located for you and try the kubectl get pods command. You'll notice a forbidden error which means the service account running this pod does not have enough permissions.

Insekube

You can check your permissions using kubectl auth can-i --list. The results show this service account can list and get secrets in this namespace.

Insekube

Answer the questions below

No answer needed

Completed

Kubernetes Secrets

Kubernetes stores secret values in resources called Secrets these then get mounted into pods either as environment variables or files.

You can use kubectl to list and get secrets. The content of the secret is stored base64 encoded.

You will find flag 2 in a Kubernetes secret.

Insekube

Use kubectl describe secret secretflag to list all data contained in the secret. Notice the flag data isn't being outputted with this command, so let's choose the JSON output format with: kubectl get secret secretflag -o 'json'

Answer the questions below

What is flag 2?

flag{df2a636de15108a4dc41135d930d8ec1}

Recon in the cluster

Some interesting Kubernetes objects to look for would be nodes, deployments, services, ingress, jobs... But the service account you control does not have access to any of them.

However, by default Kubernetes creates environment variables containing the host and port of the other services running in the cluster.

Running env you will see there is a Grafana service running in the cluster.

Insekube

Kubernetes will create a hostname for the name of the service so you can access the service at http://grafana:3000 or the Grafana endpoint in my case http://10.108.133.228:3000.

Do some enumeration to find out the version. Curl the /login page and look for the version.

Google for known CVEs for this Grafana version. It is vulnerable to LFI (Local File Inclusion).

Answer the questions below

What is the version of Grafana running on the machine?

8.3.0-beta2

What is the CVE you've found?

CVE-2021-43798

Lateral Movement

Kubernetes stores the token of the service account running a pod in /var/run/secrets/kubernetes.io/serviceaccount/token.

Use the LFI vulnerability to extract the token. The token is a JWT signed by the cluster.

Use the --token flag in kubectl to use the new service account. Once again use kubectl to check the permissions of this account.

Insekube

The account can do * verb on *.* resource. This means it is a cluster-admin. With this service account, you will be able to run any kubectl command. For example, try getting a list of pods.

Insekube

Use kubectl exec to get a shell in the Grafana pod. You will find flag 3 in the environment variables.

Insekube

Answer the questions below

What is the name of the service account running the Grafana service?

developer

How many pods are running?

2

What is flag 3?

flag{288232b2f03b1ec422c5dae50f14061f}

Escape to the node

You can now close the Grafana pod shell and continue using the first one since it is more stable.

Having admin access to the cluster you can create any resources you want. This article explains how to get access to the Kubernetes nodes by running a pod that mounts the node's file system.

You can create a "bad" pod based on their first case example. You will need a slight modification because the VM does not have an internet connection, therefore it is not able to pull the ubuntu container image. The image is available in minikube's local docker registry therefore you just need to tell Kubernetes to use the local version instead of pulling it. You can achieve this by adding imagePullPolicy: IfNotPresent to your "bad" pod container. Once that is done you can run kubectl apply to create the pod. Then kubectl exec into the new pod, you will find the node's file system mounted on /host.

Insekube

Insekube

Get the root flag!

Answer the questions below

What is root.txt?

flag{30180a273e7da821a7fe4af22ffd1701}

[[TakeOver]]

PreviousSQLMAPNextTakeOver

Last updated

Was this helpful?