Added K8s privesc technique via Create & Read secrets

[VL4DYSL4V]

No description provided.

[carlospolop]

Thanks for the PR!
One question about this technique if you don't mid @VL4DYSL4V, if you have permissions to get the secrets why do you need to create that special secret to get the token of the SA? Why can't you just get the value?

[VL4DYSL4V]

Hi @carlospolop ! It is highly unlikely for the SA token to be already present in the K8s secrets. If an SA is meant to be used by pods/jobs/etc, the SA token is mounted as a file using the serviceAccountName directive in the pod's specification. In addition, there are mechanisms like impersonate and create token that allow people to use SAs without creating a secret with a token. So this combination of permissions allows an attacker to get all tokens of all SAs regardless of how they are used

[carlospolop]

Thanks!