Offensive K8S Attacks
Kubernetes cluster attack techniques covering the full attack lifecycle from initial...
Install
npx skills add SnailSploit/Claude-Red --skill offensive-k8s-attacks -g -a claude-code -y- Repository
- SnailSploit/Claude-Red10.2k
- Category
- Security
- Updated
- 23d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Kubernetes cluster attack techniques covering the full attack lifecycle from initial foothold in a pod to cluster-wide compromise. Covers service account token theft and impersonation, RBAC misconfiguration exploitation including wildcard permissions and privilege escalation via role binding, direct etcd access for secret extraction, kubelet API abuse on port 10250 and read-only port 10255, pod escape via hostPID hostNetwork and hostPath volume mounts, Kubernetes secrets enumeration and decoding, admission controller bypass techniques, network policy bypass and lateral movement, cloud metadata service access from pods for credential theft on AWS EKS GCP GKE and Azure AKS, CRD and operator abuse for persistence, and node compromise via DaemonSet deployment. Tools include kubectl, kube-hunter, peirates, kubeaudit, kdigger, kubeletctl. Maps to MITRE ATT&CK T1609 Container Administration Command, T1610 Deploy Container, T1613 Container and Resource Discovery. Use this skill when assessing Kubernetes clusters, attacking from within a compromised pod, exploiting RBAC or kubelet misconfigurations, or performing cloud-native lateral movement.
Kubernetes Cluster Attacks
You have access to a Kubernetes environment, either through a compromised pod, stolen kubeconfig, or exposed API server. Your objective is to escalate privileges, move laterally, and compromise the cluster or underlying cloud infrastructure. Kubernetes security depends on RBAC policies, network policies, admission controllers, pod security standards, and cloud IAM integration. Each misconfiguration opens a path to deeper access. This skill covers systematic enumeration, privilege escalation, secret extraction, and cluster-wide compromise techniques.
Quick Workflow
- Determine your initial position: pod shell, stolen token, exposed API, or kubeconfig file.
- Enumerate service account permissions, cluster roles, and accessible resources.
- Identify escalation vectors: RBAC gaps, kubelet exposure, hostPath mounts, cloud metadata access.
- Escalate privileges by chaining misconfigurations or abusing overprivileged service accounts.
- Extract secrets, pivot to other namespaces, and target the control plane.
- Leverage cloud metadata or etcd access for infrastructure-wide compromise.
Phase 1: Initial Enumeration
Determining Your Position
# Check if you are inside a pod
ls /var/run/secrets/kubernetes.io/serviceaccount/ 2>/dev/null
cat /var/run/secrets/kubernetes.io/serviceaccount/token
cat /var/run/secrets/kubernetes.io/serviceaccount/namespace
cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
# Environment variables set by Kubernetes
env | grep -i kube
env | grep -i kubernetes
# Service host and port are injected into every pod
echo $KUBERNETES_SERVICE_HOST
echo $KUBERNETES_SERVICE_PORT
# DNS resolution for API server
nslookup kubernetes.default.svc.cluster.local
# Determine if kubectl is available
which kubectl 2>/dev/null
# If not, use curl with the service account token
