Skip to main content
In this lesson, we explore the high-level attack surface of Kubernetes through a live demonstration of an attack. We break down the events, analyze exploited vulnerabilities, and highlight the security measures that could have prevented this breach. Imagine an election between cats and dogs. Voters cast their ballots via a web portal hosted at www.vote.com, and the results are published on www.result.com. On the results page, despite thousands of votes, the dogs are leading by a significant margin.
The image shows a poll result: 29% for cats and 71% for dogs, with a total of 2501 votes.

​
Reconnaissance and Infrastructure Discovery

Meet “cat girl,” a determined individual who believes it’s time for cats to win. With only the domain names vote.com and result.com, she starts her investigation into the underlying architecture. These applications might be built using technologies such as WordPress, PHP, Python, Ruby, or Java and could be hosted across various platforms including cloud services, PaaS, on-premises systems, physical hosts, virtual machines, or containers. The possibilities are endless. Her investigation begins by identifying the IP addresses of these applications. Using a terminal, she pings both domains and discovers that they resolve to the same IP address, implying a shared hosting infrastructure.
Next, she performs a comprehensive port scan on the server to identify potential entry points. During the scan, she uncovers that port 2375—the default port for Docker—is open. This indicates that the applications are most likely running inside containers.
Ensure that Docker ports are not exposed to the public internet without proper authentication as it can lead to unauthorized access.

​
Exploiting the Open Docker Port

With the Docker port accessible and left unsecured (due to default settings with no authentication), she executes a command to list the running containers on the host powering the voting application.
The output reveals a long list of running containers. To gather more information about the Docker engine, she checks its version:
Output:
Realizing the potential to leverage the open Docker port, she launches a privileged container using the Ubuntu image. This container provides a pathway to escape into the host system.
Once inside the container, she confirms access by checking for the root shell prompt:

​
Attempting Container Escape with Dirty COW

Her next move is to download an exploit script targeting the Dirty COW vulnerability to escape the container. Initially, she attempts to use curl:
She also tries wget:
Since the container lacks these utilities and there are no restrictions on installing binaries, she proceeds to install curl. Once installed, she downloads the Dirty COW exploit script and executes it to break out of the container into the host environment. During the installation process, the output includes:
With the exploit executed, she successfully escapes from the container and gains a shell on the underlying host.

​
Host Reconnaissance and Kubernetes Discovery

Now on the host, she explores the environment further by inspecting disk usage and volume mounts:
Output:
Executing the hostname command, she discovers that the machine is named “worker,” indicating that she is operating on a worker node within a Kubernetes cluster. Investigation of the running containers reveals several with names starting with “k8s,” including one instance of the Kubernetes dashboard. Notably, the dashboard is exposed on port 30080 of the node.
A dark interface with a superhero emoji, a tilde, and two website links: "www.vote.com" and "www.result.com," each with a colored square beside them.
To confirm the open access, she inspects the node’s iptables rules:
The iptables output verifies that the Kubernetes dashboard is accessible publicly on port 30080. When accessed, the dashboard displays detailed cluster information including node status, deployments, and namespaces.
The image shows a Kubernetes dashboard displaying node information, including names, labels, readiness, CPU, and memory usage for "worker" and "master" nodes.
The dashboard confirms that this is a single-master, single-worker Kubernetes cluster. Alongside the voting application, the deployment includes a database (DB) service, a ready service, and a worker. Given her objective, she focuses on the DB service.

​
Database Compromise

By inspecting the environment variables of the DB pod, she discovers the database credentials. After identifying the corresponding database container, she uses the PSQL utility to connect to the database. Inside the database, she locates the table storing votes and verifies that all votes currently favor dogs. Acting quickly, she writes and executes a script that updates the vote counts, effectively switching dog votes to cat votes.
With the database manipulation complete, the election results are set to be overturned.
Misconfigured and unsecured containers or services can lead to severe breaches. Always ensure that appropriate security measures are in place to restrict unauthorized access.

​
Conclusion

This high-level overview illustrates how the absence of proper security practices can lead to a catastrophic breach in containerized environments. In the remainder of this lesson, we will dive deeper into each attack vector, understand how the vulnerabilities were exploited, and outline best practices to secure each component of such systems. That’s it for now—until the next part of this lesson.

Watch Video