Exploit Reference:

https://github.com/kubernetes/kubernetes/issues/113757 https://github.com/kubernetes/kubernetes/issues/119640 https://github.com/kubernetes/sig-security/blob/main/sig-security-external-audit/security-audit-2021-2022/findings/Kubernetes%20v1.24%20Final%20Report.pdf

Enumeration:

1. Get master node's IP, master node usually hosts the kube-apiserver:

kubectl get nodes
kubectl config view # Kubectl stores a config file so that it can use it to authenticate and make api calls to the kube-apiserver

2. If you are already in the pod, you can check the environmental variables for the kubernetes api server variable.

printenv
cat /proc/self/environ

3. $tkn variable should be a service account token.

   1. The token should be able to create nodes/proxy
   2. The token should be able to update/create/patch nodes/status

4. Check if the $tkn has the appropriate permissions:

kubectl --token=$tkn auth can-i --list