infosec&anti_malware

12 февраля в 06:21

icon.com/Privilege_escalation/hostPath_mount.html">hostPath mount; ➡Access cloud resources. • Defense evasion: ➡Clear container logs; ➡Delete events; ➡Pod name similarity; ➡Connect from proxy server. • Credential access: ➡List K8S secrets; ➡Access node information; ➡Container service account; ➡Application credentials in configuration files; ➡Access managed identity credentials; ➡Malicious admission controller. • Discovery: ➡Access Kubernetes API server; ➡Access Kubelet API; ➡Network ...

337946168">➡Application credentials in configuration files; ➡Writable hostPath mount; ➡CoreDNS poisoning; ➡ARP poisoning and IP spoofing. • Collection: ➡Images from a private registry; ➡Collecting data from pod. • Impact: ➡Data destruction; ➡Resource hijacking; ➡Denial of service. • Fundamentals: ➡Nodes; ➡Services; ➡etcd; ➡RBAC; ➡Kubelet; ➡Namespaces; ➡Secrets; ➡Interesting Files. #Kubernetes