Red Teaming Kubernetes From App-Level CVEs to Full Cluster Takeover
Instructions
- The
kalitab offers a fully functional Kali Linux environment. - All flags are in the format
flag{...}. - Happy hacking 🏴☠️💻.
🌐 Open the web apps on your external browser and use all your favorite tools.
Welcome to the Red Teaming Kubernetes challenge! This scenario is designed to simulate a realistic, multi-stage attack against a modern cloud-native environment. Your goal is to start with a single application-level vulnerability and progressively pivot, escalate, and compromise your way to a full cluster takeover.
Your mission is to find the five flags hidden throughout the environment. Each one will require a new technique to uncover.
Challenge 1: Initial Access
Compromise the public-facing DVWA web application and gain Remote Code Execution (RCE). The first flag is hidden on the container's local file system.
Hint 1
Credentials:
- Username:
admin - Password:
password
Challenge 2: Lateral Movement
Leverage your initial access to pivot and exploit a vulnerability in the ingress-nginx controller. This flag is waiting for you inside the compromised controller's container.
References
Challenge 3: Credential Exfiltration
With control of the Ingress controller, you can now interact with the Kubernetes API. Exfiltrate the service account token associated with ingress-nginx and use it to read a specific Kubernetes Secret containing this flag.
References
Challenge 4: Privilege Escalation
Use your newfound API access to find and compromise a highly privileged GitOps service (ArgoCD). Steal its powerful credentials and use them to execute commands in other pods across the cluster. This flag is hidden inside one of those pods.
References
Challenge 5: Cluster Takeover
Achieve the ultimate objective. Use the highly privileged ArgoCD service account to deploy a malicious pod, break out onto the underlying control plane node, and gain root access. The final flag is located on the node's file system.
References