Kubelet Attack

Light kubeletctl tool

Info: Kubelet exposes its API over the default port 10250/TCP and this is one of the things that we will check when attacking the Kubernetes cluster. Privileged access to kubelelt’s port, whether as a result of no authentication or as a result of possessing the required permissions, will allow us to list the pods, access them, and maybe even breakout to the host (if one of the containers is privileged).

Research about kubelet - https://www.cyberark.com/resources/threat-research-blog/using-kubelet-client-to-attack-the-kubernetes-cluster

Requirements:

1. /etc/kubernetes/kubelet.conf

apiVersion: kubelet.config.k8s.io/v1beta1
authentication:
  anonymous:
    enabled: true      -> allow anonymous calls to kubelet
    ...
authorization:
    mode: AlwaysAllow   -> make sure this line exists, allow authorization to any request
    #mode: Webhook      -> make sure this is set as a comment

This configuration allows any call to access

Exploit:

1. Establish connection with kubelet endpoint
2. Use the available options:
   1. Scan for containers with RCE
   2. Scan for Pods and containers
   3. Scan for tokens from all available containers
   4. Run command with multiple options