Intrusionz3r0-VaultGithubLinkedlnHackthebox

SteamCloud

Detailed Walkthrough

Initial Access

Upon establishing a connection to the VPN, the tester initiated the assessment by performing a service enumeration. This process revealed the following open ports:

  • 22/tcp open OpenSSH 7.9p1

  • 2379/tcp open etcd

  • 8443/tcp open API server

  • 10250/tcp open kubelet

  • 10256/tcp open kube-proxy

The presence of these ports indicated that a kubernets cluster was running on the target server.

Kubelet API

The kubelet runs on every cluster node, typically on 10250/tcp. It manages pods on the node and communicates with the Kubernetes API server. Also it was identified that the kubelet API was reachable, which can permit unauthenticated execution of commands if improperly secured.

Using kubeletctl to inspect the node configuration, it was discovered a dangerous permissions settings.

  • Authentication methods present included webhook (bearer token-based), anonymous access, and x.509 client certificates.

  • The authorization mode was configured as AlwaysAllow, which effectively permits all requests without enforcing RBAC checks.

Given the kubelet configuration, the tester ran an automated scan and found pods with accessible exec endpoints. kubeletctl reported that the nginx pod in the default namespace exposed an exec interface.

If you have compromised access to a machine the user may have access to some Kubernetes platform. The token is usually located in a file pointed by the env var KUBECONFIG or inside ~/.kube. on other hand If you have compromised a pod inside a kubernetes environment you can find for Service Account Tokens usually stored on

  • /run/secrets/kubernetes.io/serviceaccount

  • /var/run/secrets/kubernetes.io/serviceaccount

  • /secrets/kubernetes.io/serviceaccount

The tester look for ServiceAccount credentials in pod and found the default ServiceAccount token and CA certificate at the usual path:

  • ca.crt: It's the ca certificate to check Kubernetes communications

  • namespace: It indicates the current namespace

  • token: It contains the service token of the current pod.

Privilege escalation

Once obtained the certificate and token, It was discovered that the current session had get, create, and list permissions, which opened an opportunity to escape the node and compromise the cluster.

Additionally, The running pods was enumerated on the node to verify the list permissions.

In order to escape the node, the tester obtained the pod’s image version and then deployed a specially crafted pod designed to mount the host system at /root, enabling access to the underlying node.

Finally, The pod was deployed using a YAML that granted access to the host filesystem, resulting in full compromise of the server..

Credentials

Username
Password
Methods
Scope
Notes

👤 Users wordlist

🔑 Password wordlist

Subdomains / Hosts

Subdomain / Host
Host
Description
Notes

Host Discovered

Nombre
IP
Domain
Low Access
High Access
OS

SteamCloud

10.10.11.133

SteamCloud.htb
Linux

Scans

Scripts / Automations / Resources

attack.yaml

Flag Discovered

Flag #
Host
Flag location
Method used
Value

User

10.10.11.133

user

Malicious pod

<SNIF>

Root

10.10.11.133

root

Malicious pod

<SNIF>

PreviousCloud TrackNextEpsilon

Last updated