►
From YouTube: Tutorial: Attacking and Defending Kube... Brad Geesaman, Jimmy Mesta, Tabitha Sable & Peter Benjamin
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Tutorial: Attacking and Defending Kubernetes Clusters: A Guided Tour - Brad Geesaman, Brad Geesaman Consulting; Jimmy Mesta, KSOC, Inc.; Tabitha Sable, Independent; & Peter Benjamin, Teradata (Limited Available Seating; First-Come, First-Served Basis)
Please bring your laptop fully charged as we will have limited charging stations available in the room. Is your Kubernetes cluster able to resist the most common attacks? And, are all the necessary detection mechanisms in place to know if a security issue did occur? In this hands-on workshop, the instructors will dive into the art and science of Kubernetes security through a series of interactive attack and defense scenarios. Attendees will learn through instructor-led exercises how to identify and exploit realistic misconfigurations in Kubernetes clusters to achieve full cluster compromise. Each attack step will be matched with hardening measures and specific methods for detection and response workflows. Each workshop attendee will be provided with a pre-configured Kubernetes cluster running realistic workloads in a cloud-based lab environment. The tools and methodologies covered by these exercises will directly help attendees secure their own organization's clusters.
https://sched.co/Uaew
A
Okay,
welcome.
Can
everyone
hear
me?
Okay,
I
think
we
have
reached
capacity
and
we
are
rolling.
Okay,
welcome
to
attacking
and
defending
kubernetes
clusters.
We're
gonna
get
back
to
this.
I
know.
People
are
still
trickling
in.
You
are
in
the
right
spot
if
this
looks
familiar
and
you
signed
up
on
this
for
this
particular
class
and
we're
gonna
have
a
lot
of
fun.
This
is
a
super
packed
house
and
we
have
lots
of
people
here
to
help
us
out
we're
gonna
do
a
quick,
intro
and
then
we're
gonna
dive
right
into
it.
A
C
D
A
A
A
I
feel
the
love
here
at
cube
con
all
right,
so
we
have
art
easily
crafted
to
scenarios
to
walk
through
step
by
step,
a
guided
tour.
That's
the
name!
That's
what
we're
gonna
do,
but
we
have
some
important
rules
to
follow.
Okay,
bring
it
down;
okay,
all
right,
so
we
have
instructions
and
we're
gonna
follow
those
pretty
closely
right.
Everything
is
copy
paste,
the
bowl.
We
have
zero
prerequisites
for
this
particular
course.
If
you've
never
used,
Q's
control
cube
cuddle
queue,
Bechdel,
whatever
you
want
to
call
it
we're
not
gonna.
Go
there.
That's
okay,
whisper!
A
Please!
When
we're
presenting
this
is
a
massive
room
and
we
just
want
to
make
sure
that
we're
getting
the
information
out
to
everybody
in
due
time.
If
you
need
help,
your
first
order
of
operation
should
be
to
look
at
a
neighbor
right,
you're
sitting
pretty
close
to
somebody
who
has
probably
solved
the
issue.
A
Unless
it's
on
Google
side,
then
we
have
some
Googlers
in
the
room
that
we
can
heckle
just
kidding
if
you're
completely
stuck
raise
your
hand,
so
that
we
have
room
monitors,
Duffy
and
Ian
and
a
few
others,
and
the
four
of
us
will
be
running
around
like
crazy
to
try
to
get
everybody
through
these
scenarios
and
attack
your
own
cluster.
Only
please
it's
not
cool
to
jump
around
and
try
to
drop
zero-day
and
do
crazy
things
on
other
people's
stuff.
That
is
really
cool,
but
not
for
today,
right.
A
We
put
a
lot
of
effort
into
getting
this
situated
isolated
and
please
respect
that
and
don't
attack
anything
from
your
cluster
either
right.
We're
gonna
be
doing
some
fun
scenarios
with
fake
Bitcoin
mining,
cryptocurrency,
mining,
pods
and
things
like
that.
Those
are
fake.
Please
don't
set
up
your
own
mining
rig
on
these
clusters.
That
would
get
really
expensive
really
fast
and
please
have
fun.
This
is
supposed
to
be
a
really
good
time.
A
We're
really
honored
to
be
here,
and
we
want
everybody
to
come
out
of
this
with
a
little
more
attack
under
their
belt
to
go
home
with
and
learn
about.
So
breaking
down
the
different
scenarios,
just
a
quick
rough
guideline
for
timing.
We
are
we're
operating
to
the
second
probably.
But
for
you
all
here
we
have
scenario
one
we're
going
to
do:
full,
guided
attack
in
defense,
we're
gonna,
put
on
a
red
hat,
blue
hat
and
walk
you
through
some
scenarios
about
25
minutes
there
and
then
we're
going
to
step
it
up
the
level.
A
We
have
special
flags
and
then
we're
gonna,
hopefully
squeeze
in
time
at
the
end,
to
walk
you
through
those
bonuses
as
well,
and
that
should
bring
us
right
up
until
the
very
very
end
and
hopefully
not
flow
over,
if
at
all
possible,
so
we're
gonna
walk
through
again
getting
connected
and
number
one
we're
gonna
start
with
this
lovely
domain
that
I
bought
a
long
time
ago
as
a
project
that
never
actually
occurred
called
secure.
Kubernetes
comm,
if
you
visit
that
you're
gonna
have
all
of
the
lab
material
necessary.
A
So
please
open
this
in
a
private
browsing
window
or
incognito
window.
If
you've
ever
experienced
cross
Google
accounts,
multiple
gmail
accounts,
corporate
accounts,
that's
going
to
get
messy.
So
just
do
this
in
either
a
brand
new
fresh
browser
or
in
an
incognito
window
or
bright
private
experience
got
that
secured
kubernetes,
calm
cool,
alright.
So
let's
dive
right
into
scenario.
One
this
scenario
is
called
free
compute
and
we
have
a
lot
of
fun
to
do
with
this
particular
scenario.
A
So
if
you
head
on
over
to
secure
kubernetes
comm,
you
can
see
our
helpers
are
going
out
into
the
field
getting
ready
to
help
everybody.
So
if
you
go
to
secure
kubernetes
comm,
we
are
going
to
see
scenario.
1
and
I
will
go
there
as
well
and
you
can
follow
along.
So
here
we
are
secure,
kubernetes
comm.
This
is
assuming
we
are
all
set
up,
so
I
think
most
of
us
in
the
room
with
the
number
of
hands
and
in
g-cloud
kind
of
worries
we
had
a
little
earlier.
Hopefully
those
are
subsiding.
A
We
were
get
running
into
that
too,
but
things
do
settle
down
and-
and
we
will
get
our
our
cloud-
shell
account
so
we're
gonna
get
connected,
so
you
should
all
have
a
credential
card.
Does
anybody
not
a
credential
card?
Yet
we
have
one
right
here:
okay,
you
might
be
number
401
in
this
event
and
but
we
have
some
overflow
so
we'll
get
you
hooked
up,
maybe
hopefully
so
so
we're
gonna
open
cloud
shell.
So
when
we
do
that
this
button
love
this
lovely
button
here,
it's
gonna
do
some
very
special
things
for
us.
A
If
you
look
at
the
URL,
you
can
see
that,
but
for
the
sake
of
this
we're
gonna
open
cloud
shell,
and
it
should
look
something
like
this
right,
so
we
have
cloud
shell
up
and
running.
I
am
cube
con
4:01.
The
naming
convention
is
not
that
important.
Just
know
that
you
are
dropped
into
your
own
special
project.
We
had
to
go
through
a
lot
of
Hoops
to
get
that
to
work
but
we're
there
and
then
we're
going
to
get
set
up.
A
So
when
you
have
cloud
shell
open
you're
going
to
be
presented
with
a
login
page
right,
this
is
where
we're
gonna
enter
that
email
on
the
card
and
the
password
as
well.
If
that
doesn't
work
for
some
reason
again,
that's
a
hand
up
situation.
A
lot
of
snow
will
get
you
figured
out
and
then
we
follow
through
the
prompts.
We
accept
our
terms
and
conditions,
simple
stuff.
We've
all
read
this
in
great
detail.
I'm
sure
then
select
your
country,
United
States,
and
you
agree
to
the
GCP
Terms
of
Service
great.
Then
we
start
cloud
shell.
A
So,
as
you
start
cloud
shell,
we
have
a
very
special
cloud.
Shell
setup.
That's
going
to
run
for
you
be
pulled
into
cloud
shell
with
a
lot
of
helper
scripts
and
things
that
get
you
up
and
running
really
really
fast.
So
the
key
here
is
this
command
cube
control,
get
pods
all
namespaces
if
you're
used
kubernetes,
which
most
of
us
have
we've
run
this,
and
this
is
just
to
prove
that
we
have
connectivity
to
our
cluster
and
oh
I
asked
if
this
last
time
so
set
up
dot
sh
so
set
up
dot.
A
Sh
is
a
really
important
script
and
I'm
gonna
run
these
with
you.
So
in
this
secure,
kubernetes
page
right
here,
you
could
use
the
copy
and
paste
straight
from
here.
This
is
the
easiest
way.
So
when
I
copy
to
clipboard
go
over
to
my
cloud,
shell
make
sure
everything
is
good
paste
it
in
this
is
setting
my
project
ID
to
the
one
that
was
provide
and
a
couple
other
helpers
for
you
to
get
you
connected
to
your
gke
cluster.
So
our
google
google
kubernetes
engine
cluster,
so
we're
gonna.
A
Let
this
run,
and
this
is
what
will
enable
us
to
run
the
cube.
Patrol
get
pods
all
namespaces
and
I
know
we're
going
kind
of
fast
through
this
section
because
we
really
want
to
get
to
the
meat
of
it
and
anybody
not
have
access
to
a
cloud
shell.
Yet
this
is
just
a
total
okay,
that's
not
bad
Google's
catching
up!
That's
good!
That's
good!
That's
only
a
few!
So
for
now,
please
just
work
with
your
neighbor
until
your
cloud,
shell
comes
up.
I'm
glad
we're
at
critical
mass
with
that.
A
A
This
is
going
to
show
that
we
have
pods
running
right
and
these
pods
are.
Some
of
them
are
used
in
class.
Some
are
part
of
of
the
kubernetes
gke
version
we're
using,
but
something
should
show
up
here
right
if
you've
used
kubernetes
you're
used
to
this.
So
let's
press
on
and
that's
it
we've
we've
done
the
getting
connected
step.
A
A
Okay,
so
let's
dive
right
in
this
is
going
to
be
as
roleplay
E
as
possible,
while
still
kind
of
breaking
the
fourth
wall
and
helping
people
along
the
way
I'm
going
to
take
over
scenario
one
as
the
attacker
I'm,
a
newbie
just
opportunist
attacker
right
and
the
backstory
here,
really
quite
simple:
I
just
find
automated
scans
and
scripts
off
the
shelf
and
I
run
them
against
vulnerable
IP
addresses
or
infrastructure
right
I.
Don't
have
a
lot
of
skill
and
I
have
very
limited,
kubernetes
knowledge.
A
So
this
is
something
you'll
probably
be
up
against
in
your
own
clusters,
but
we
want
to
learn
kind
of
the
how
this,
how
this
plays
out
for
somebody
who
is
an
opportunist
right
and
cryptocurrency
mining
is
my
game
right.
That's
my
jam.
I
have
to
make
rent
next
month,
so
I
need
to
get
these
cryptocurrency
miners
installed
on
somebody's
cluster.
So
red
has
been
mining
bit
Bitcoin
arrow
for
a
few
months
right,
so
we're
mining,
Bitcoin
and-
and
we
are
using
a
service
that
is
selling
shells
for
us
right.
A
We
can
purchase
a
shell
or
a
friend
gives
us
a
shell
that
they
have
gone
out
and
exploited,
and
we
have
access
to
that
now
right,
that's
really
cool
right,
because
I,
don't
know
a
whole
lot
about
what
I'm
doing
and
as
an
attacker,
I'm
gonna
utilize
that
shell
to
do
some
bad
things.
So
a
brief
note
on
attack
patterns
right,
if
you,
if
you
attended
Ian's
talk
this
morning,
we
a
little
bit
of
this
thinking
and
graphs.
A
A
sort
of
mentality
was
mentioned
right,
so
attackers
thinking
graphs,
so
we're
studying
our
target,
we're
doing
a
lot
of
research
on
what's
going
on
and
we're
actually
planning
our
attack
in
great
detail
before
we
just
go
and
throw
our
exploit
or
our
code
on
to
that
target.
So
and
if
you
see
me
skip
over
something
in
the
tutorial,
it's
here
for
you
all
later
and
we
can
that'll
be
available
for
you.
So
the
key
is
we
want
to
attack
something
right.
A
We
want
to
get
our
payload
or
our
cryptocurrency
miner
running
on
this
vulnerable
cluster.
We
want
to
persist
as
well.
That's
going
to
come
into
play
in
scenario,
two
so
attack
persist
and
then
win
and
win
for
us
right
now
is
straight-up
money
right,
cryptocurrency
mining,
and
this
is
something
we
see
very,
very
often
in
the
kubernetes
space.
So
we
are
going
to
do
some
steps
to
get
an
endpoint
that
we
have
compromised
already.
This
is
a
web
shell,
that's
running
in
the
kubernetes
cluster.
That
is
your
target.
A
A
Okay,
this
is
the
email
for
my
friend,
my
friend,
that
I
purchased
this
shell
from
right.
So
here
we
have
an
IP
address,
35
to
36
114
113,
with
a
special
port.
So
when
we
visit
this,
we
can
actually
get
a
web
show.
So
if
you
run
check
email
get
your
IP
address
with
your
port
and
click
on
that
as
a
URL
you're
going
to
be
presented
with
this
HTTP
basic
auth
login
screen
right.
So
this
is
where
we
need
to
enter
credentials.
These
credentials
will
match
what's
on
here.
A
A
So
whew
a
web
shell,
so
this
is
a
web
shell
running
in
the
browser
right.
So
this
this
could
be
seen
as
an
exploit
some
sort
of
backdoor
there's
a
number
of
ways
through
an
attackers
lens
that
you
can
get
to
this
destination,
but
we're
not
going
to
go
over
that
in
great
detail
today.
This
is
our
foothold
into
the
cluster.
This
is
our
entry
point
as
an
attacker.
A
The
way
we
have
access
to
this
cluster
from
the
outside
world-
and
we
see
this
all
the
time
out
in
the
wild
as
well,
so
we
should
all
be
looking
at
a
web
shell
like
this
and
if
you
don't
and
if
you're
really
kind
of
wondering
where
you're
at
raise
your
hand
everything's
laid
out
in
the
tutorial
and
in
great
detail,
so
we
want
to
mind
some
Bitcoin
right.
We've
studied
our
target.
We
have
our
web
shell
and
we
want
to
get
some
loot
right
so
as
an
attacker.
A
The
very
first
step
is
not
just
throwing
a
Bitcoin
a
script.
That's
going
to
go
my
Bitcoin
into
this
environment.
We
have
to
learn
a
little
bit
about
it.
So
here
we
have
a
list
of
common
commands.
We
can
run
once
we're
dropped
into
a
shell
right.
We
don't
know
what
user
we
are.
We
don't
know
what
group
we're
in.
We
don't
know
if
we're
on
a
VM
or
on
a
container
in
kubernetes
and
whatever
right.
So
we
got
to
do
some.
Some
some
background
check.
Rice.
A
We
have
to
check
out
where
we're
at
so
we've
run.
Two
commands
like
ID
right,
I'm,
gonna
copy
that
to
the
clipboard
and
I'm
not
going
to
go
through
all
these
in
these
commands
at
this
part
of
the
walk
through
these
commands
are
run
in
this
web
shell
in
the
browser
so
ID
right
same,
but
who
could
tell
me
what
what
what
I'm
looking
at
now
UID
1,000
dashboard
a
my
route?
No,
not
route.
Okay,
that's
interesting
right!
So
I'm
gonna
run.
Let's
do
PS
EF.
A
What's
this
what's
PS
EF,
anybody
have
a
guess
process.
Is
this
typical
of
a
virtual
machine
or
a
container?
Probably
a
container
there's
not
that
many
processes
running
right?
So
that's
interesting
right
and
as
an
attacker
I'm
writing
this
stuff
down
right
step
by
step
by
step.
So
as
I
go
down
my
list
and
we
can
run
more
and
more
commands
if
we
so
wish,
but
we're
gonna
keep
digging
in
right.
So
one
of
the
main
ones
here
I
want
to
run
I'm
gonna
bring
in
a
tool
from
somebody
else
right.
A
Just
I
think
this
is
just
Brazil's
tool.
Right
am
I
contained
I
want
to
curl
this
using
the
curl
utility,
which
is
going
to
go
download
this
file
on
to
my
shell.
Well,
you
know,
I
think
it's
a
container
I
hope
it's
a
container
and
it's
going
to
tell
me
a
bunch
of
information
about
the
space
I'm
in
right.
The
space
I'm
operating
as
so
I
copy
this.
A
This
curl
command
and
I'm
gonna,
pull
this
down
and
I
see
a
bunch
of
interesting
things
and
for
the
sake
of
not
going
through,
every
single
assist,
call
and
and
and
things
like
that,
there's
an
interesting
piece
here
container
run
time
is
cube
right.
What?
What
is
that?
What
does
that
tell
me
as
an
attacker,
probably
running
in
a
container
inside
of
kubernetes
right?
Well,
we
are
at
cube
Khan's.
So
that's
a
given,
but
this
is
the
process
right.
A
So
I'm
gonna
go
back
to
my
scenario
and
now
I
know
that
I'm
in
kubernetes,
I'm
gonna
run
some
very
specific
kubernetes
commands
and
I
suggest
I'm
kind
of
blabbing
and
talking
up
here
but
I
suggest
you
run
the
commands
I'm
skipping
over
as
well
to
kind
of
get
a
feel
for
what
that
looks
like
as
well
so
I'm
gonna,
look
at
my
environment
variables
and
I'm
gonna.
Look
for
the
word
cube
and
when
I
do
that
interesting
right.
A
Those
of
us
who
administer
kubernetes
clusters
have
seen
these
things:
kubernetes,
ports,
IP
addresses
and
all
sorts
of
interesting
internal
IP
address
space
that
is
running
kubernetes
right,
so
I'm,
gonna
log
that
and
put
that
in
my
memory
and
in
my
notebook
write
it
as
part
of
my
attack
and
then
I'm
gonna
look
at
the
version.
This
is
a
really
interesting
one,
so
this
command
is
going
to
give
me
one
special
thing:
right
get
version.
This
is
version
113,
dot,
11,
gke,
14,
I'm
running
in
kubernetes,
but
I'm
also
running
on
gke.
A
That
narrows
my
attack
surface
even
more
right.
If
I
know,
there's
a
gke
exploit,
which
there,
of
course
would
never
be
one
right.
The
then
I'm
gonna
target
that
right.
If
I
know
the
kubernetes
version
I'm
going
to
the
CVE
list
and
I'm
gonna
check
and
see
if
there's
anything
out
there
in
the
wild
that
I
can
exploit
right.
This
is
really
really
really
useful
stuff.
So
I'm
gonna
keep
digging
in
and
see
what
I
can
do
on
the
actual
machine
right.
A
So,
to
do
that,
I
want
to
interact
with
the
API
server
and
how
do
we
interact
with
the
API
server
in
this
context?
What
tool
do
we
typically
want
to
use
cute
cube
control
right?
That's
what
we
are
keep
CTL
I,
don't
know!
This
is
a
tough
crowd
with
the
how
to
pronounce
that
so
I'm
gonna
copy
this
and
I'm
gonna
go
grab
cube
control.
This
is
going
to
install
the
coop
control
binary
on
to.
A
It's
already
installed
because
this
is
our
testing
cluster,
but
we're
gonna
have
cube
control
installed
onto
our
running
container.
That's
in
a
pod.
That's
on
our
gke
cluster.
With
that
comes
a
lot
of
power
right.
We
have
cube
control
and
we
can
start
to
test
out
permissions
and
see
what
we
can
actually
provision
on
to
the
cluster.
So
once
cube,
control
is
installed.
I'm
just
gonna
go
down
the
list
right,
I'm
gonna
go
to
do
a
cube
control
get
all.
This
is
a
great
nifty
little
command.
A
What
can
I
see
right
as
this,
this
user
with
us?
The
service
account.
So
here
we
have
a
pretty
comprehensive
list.
We
have
replica,
sets
deployment,
services
etc,
and
we
have
the
running
applications
and
now
I
want
to
get
namespaces.
So
I'm
gonna
run
cube
control,
get
namespaces,
interesting,
I
am
forbidden,
I'm
not
allowed
to
run
this
command.
What's
going
on
here
right,
so
namespaces
is
forbidden
for
user
systems.
Service
account
PRD
default.
So
this
is
saying
there.
A
There
exists
a
PRD
namespace
and
I
don't
have
access
to
go,
get
get
a
list
of
all
the
namespaces
running
in
this
particular
cluster.
So
that's
really
interesting.
I
need
to
elevate
my
privileges
or
figure
out
something
else
to
do
right.
If
I
want
to
see
everything,
so
you
know
kind
of
throwing
it
back
to
this
cube
off.
Can
I,
from
a
little
earlier
today,
if
you've
been
around
this?
Is
all
the
attackers
love
this
tool?
This
is
going
to
just
tell
me
straight
up.
A
What
can
I
do
right
and
the
real
thing
is
I
want
to
create
a
pod.
The
end
of
the
day,
I
want
to
get
my
own
work
load
running
on
this
cluster
I
need
to
make
money,
I,
don't
care
about
my
elite.
I
am
I,
just
need
to
get
things
rolling,
so
I
want
to
use
cube
off,
can
I
create
pods,
so
imma
copy
this
command?
A
And
yes
right,
that's
really
all
I
care
about
to
mine
cryptocurrency,
as
my
unskilled
self
right,
so
I'm
gonna
go
create
a
pot
and
if
you're
you're,
privy
to
this,
you
probably
notice
this
is
already
running,
but
that's
okay,
and
in
this
section
here
this
is
my
Bitcoin
err.
Cryptocurrency
mining
deployment,
I
know
I
can
create
pods
I.
Have
this
running
web
show
I,
have
access
to
this
cluster
I
might
not
be
cluster
admin,
but
that
doesn't
matter
for
me
right
now.
A
A
Okay,
so
to
pass
this
on
along
to
my
defensive
counterpart
as
far
as
the
script
kiddies
concerned,
I'm
already
mining
cryptocurrency
in
this
cluster,
using
my
Bitcoin
arrow
deployment
right.
This
is
running.
It's
not
sophisticated.
I
got
it
from
the
internet,
but
it's
getting
the
job
done
right.
So
hopefully
you
were
able
to
follow
step
by
step
and
now
we're
going
to
talk
a
little
bit
about
the
defensive
tactics
as
part
of
this
walkthrough
to
my
lovely
counterpart,
Brad.
D
Hi,
my
name
is
blue
and
I'm
an
overworked
sysadmin,
oh
whoa.
What's
that
hold
on
what
time?
Is
it
hey,
yeah
boss,
oh
the
web
site,
slow
got
it
which
web
site
you
don't
know?
Okay,
you
know
it's
1:00
a.m.
right.
Okay,
I'll
get
right
on
it,
life
of
a
sysadmin.
Okay,
generally
speaking,
I
can
only
do
the
bare
minimum.
D
There's
only
one
of
me,
so
this
is
kind
of
how
I
roll-
and
this
is
this
is
just
par
for
the
course,
but
we'll
see
what
we
can
do,
because
I'm
pretty
confident
we're
doing
everything
right,
but
we'll
see
so
without
a
lot
of
details,
I
sort
of
have
to
figure
out
which
cluster
which
deployment
what's
going
on
like.
Why
is
this
slow,
so
we're
gonna
switch
gears
here.
So
take
off
your
red
hat,
put
on
your
blue
hat,
we
are
going
to
be
using
the
same
cloud.
Shell
as
the
administrator
at
this
point.
D
Okay,
so
now
you're
switching
into
the
administrator,
you
fire
up
cloud
shell.
You
have
your
credentials
to
the
cluster
so
follow
along
in
this
sense,
so
I'm
gonna
run
coop
control
get
pods
all
namespaces
I'm
gonna
do
one
more
zoom.
That's
too
many
okay,
I
am
in
the
web.
Shop,
not
in
the
cloud
show
see,
don't
follow
that
what
I'm
gonna
do
is
zoom
this
in
a
little
bit,
and
you
can
do
this
too.
D
If
your
eyes
are
like
mine,
okay,
get
pods
all
new
spaces,
all
right,
so
I'm,
the
SIS
I,
don't
know,
and
what
I'm
looking
for
here
on
the
left
is
the
running.
Now
it's
on
the
right,
okay
looks
good
everything
looks
good.
It's
running
this
cluster
doesn't
look
bad
from
any
there's
no
crash.
Looping
pods!
You
know
what
else
is
next
well,
they
said
it
was
performance
related.
So
let's
use
cout
control
top
okay.
D
D
D
D
D
It
is
our
oops
stress,
ng
is
a
is
a
cpu
stressor
or
it
stresses
a
bunch
of
different
things,
but
it's
it's.
You
know
its
elite
and
there
we
go
avert
your
eyes.
This
may
or
may
not
be
part
of
a
bonus
bypass.
That's
a
clue
for
you!
Okay!
That's
why
it's
not
running
anybody.
Tell
me
what's
running,
that's
blocking
shout
it
out
say:
louder,
OPA,
gatekeeper!
D
What
we're
looking
at
here
and
while
we're
purposely
not
stressing
these
nodes
too
much,
is
a
deployment,
that's
using
a
bit
more
CPU
than
the
rest,
so
it
does
stick
out
right.
So
that's
a
little
suspicious
and
I'm
not
really
sure
what
the
image
might
look
like
from
where
that's
coming
from.
So
how
many
of
you
have
run
this
command
to
get
pods
all
namespaces,
looking
for
just
the
image,
and
then
you
trade,
the
space
for
a
new
line,
and
then
you
sort
unique.
D
D
So
what
we
want
to
do
is
copy
this
if
you're,
following
along
copy
this
in
your
buffer,
this
is
a
stackdriver
filter
and
then
we're
going
to
open
this
link
in
a
new
tab.
Now
I
have
already
in
incognito.
You
might
need
to
do
in
incognito.
If
you
want
to
remove
this
over
here
and
kill
the
show
now
go
to
the
right
hand,
side
convert
to
advanced
filter,
select
all
replace,
and
this
is
going
to
look
at
the
kubernetes
cluster
logs,
so
our
backlogs
and
looking
for
permission
for
deployments
create
in
the
last
hour.
D
Okay,
so
there
were
two,
as
you
saw,
I'd
created
it
and
the
deleted
it
created
and
deleted
it.
So
what
I
wanted
to
look
at
was
who
created
this
this?
The
prod
default
service
account
in
the
prod
namespace,
that's
kind
of
weird
a
service
account
created
this
them.
That's
not
a
human,
it
didn't
say
my
name
at
it
said
a
service
account.
D
So
I
want
to
sort
of
see.
Okay,
tell
me
all
the
deployments,
our
pods
that
are
running
with
the
default
service
account
in
the
prod
namespace.
Now
this
is
a
one-liner
you
can
parse
later,
but
basically
it's
JSON
path
and
we're
looping
through
looking
for
the
service
account
name
default
listed
and
it's
the
service
account
name.
A
lot
of
these
commands
are
very
dense
and
we're
not
gonna,
explain
every
single
thing,
but
the
and
is
this
website
is
public.
If
you
want
to
go
run
these
at
home.
D
D
Okay,
four
minutes
ago,
so
that
was
recent.
Somebody
just
attacked
us
didn't
they.
We
don't
really
know,
though,
for
sure.
So,
let's
go
ahead
and
get
rid
of
this
now
they're
telling
me
that
bitcoin
arrow
they
haven't
so
I
texted
the
developers.
They
have
no
idea
what
bitcoin
arrow
a
so
I'm
gonna
go
ahead
and
delete
that
deployment.
D
D
That's
kind
of
weird:
why
would
they
let
external
access
to
a
dashboard
directly
in
the
cluster
that
kind
of
seems
suspicious,
but
we'll
get
rid
of
that
now,
I,
don't
know
who
did
this
I?
Don't
have
a
lot
of
visibility
of
exactly
what
happened.
I
can
see
the
surface
account
when
it
happened
where
it
came
from,
but
actually
physically,
which
person
or
user
did
this.
So
what
I'm
gonna
do
is
run
a
deployment
that
we
have,
that
is
a
Falco
installation,
anybody
who's
running
Falco
in
their
own
clusters.
D
Anybody
you've
heard
of
Falco,
but
is
not
yet
running
Falco.
Well,
if
you
have
cloud
shell
today,
you
will
be
running
Falco
for
the
first
time.
What
we
have
packaged
for
you
or
a
lovely
prominent
blogger
is
packaged,
for
you
is
what
we
affectionately
like
to
call.
Coop
control
apply.
Security,
MO
and
security
is
now
installed.
Give
yourselves
a
round
of
applause,
Hey.
D
So,
being
a
good
sis
at
min
and
now
that
it's
getting
like
3
a.m.
in
my
and
my
brain
here,
I'm
just
gonna
check
the
logs,
and
this
is
getting
the
pods
name
and
then
using
that
name,
because
it's
dynamic
and
then
piping
it
through
logs
looks
good
everything
looks
happy.
It's
got
loading
some
rules.
I
do
briefly
want
to
show
you
what
the
rules
look
like
actually
take
that
back
now
that
that's
logging
to
the
Container
logs.
D
We
want
to
also
see
that
in
stackdriver,
so
we're
going
to
copy
that
here
we're
back
on
the
advanced
filter.
So
by
now
it
takes
about
one
second
or
two.
Depending
every
time
standard
out
hits
for
Falco.
It
takes
about
one
or
two
seconds
it
gets
over
to
stackdriver.
So
everything
that's
running
cout
control
logs
those
logs
get
sent
to
stackdriver.
If
you
have
the
right
filter
submit
the
filter
wow,
it
looks
good
looks
like
we're
getting
some
stuff
right.
Security
is
happening.
We
are
ready
to
go.
D
Everything
is
happy
and
I'm
gonna
run
one
more
command
here.
For
you,
this
is
the
Falco
rules.
We
combine.
We
concatenated
a
few.
The
config
map
rules
into
one
line
or
sorry
one
manifest
and
I
just
want
to
grep
through
the
rules
for
you,
because
this
is
important
for
what
you're
going
to
be
doing
later.
D
Things
like
privilege,
containers,
sensitive
mounts
and
disallowed
containers,
bash
history
and
those
kinds
of
things
are
present.
So
with
that
I'm
going
to
you
know
say
that
that's
good
I'm
going
to
go
to
sleep
and
everything
is
fine.
That's
what
I'm
gonna
trust
right!
Okay,
now
I'm
gonna
hand
it
over
to
Tammy.
B
Alright
I'm
glad
he
thinks
it's
all
fine,
because
I'm
dark
red,
I'm,
a
skilled
and
experienced
criminal
attacker
and
my
associate
red
has
contacted
me
because
they
needed
some
help
about
a
week
ago.
They
popped
a
box
and
they
put
some
some
cryptocurrency
miners
on
it
and
they
were
mining
away,
but
they
got
themselves
caught.
They
got
themselves,
kicked
out
and
they're
pretty
sad
about
that.
So
they
tell
me
hey,
can
you
can
you
help
out
I'll
make
it
worth
your
while?
B
If
you
can
get
me
back
into
this
cluster
and
get
my
miners
running
again,
so
I'm
going
to
go
back
and
review
my
notes
over
here
on
mine
machine,
clear
out
the
screen
and
review
the
notes
that
I
took
from
when
I
was
looking
at
my
associates,
my
associates
email,
so
they
passed
along
the
IP
address.
You
can
see
mine
here
on
the
screen.
B
Yours
will
appear
on
your
screen
and
so
I
did
some
did
some
reconnaissance
on
it
did
some
studying
on
it
found
a
fountain
found
something
that
was
found,
something
that
was
vulnerable
so
to
get
an
idea
of
a
little
bit
of
what
that
looked.
Like
we'll,
do
a
quick
port
scan
on
this
on
this
IP
address
and
we'll
see
it
looks
like
within
this
range
of
a
hundred
ports.
B
B
Web
applicant
rested
in
this
one
here
that
says
dashboard,
because
it
seems
to
me
that
if
it's
a
dashboard,
a
it's
probably
kind
of
neglected,
not
taken
care
of
not
monitored
closely
the
way
the
production
application
is
and
be,
it
may
have
some
kind
of
heightened
access
into
something
in
the
environment,
into
kubernetes
or
into
some
kind
of
automation
framework.
In
order
to
be
able
to
do
its
dashboard
a
job,
so
you
can
open
up
these
web
applications
in
your
browser
cruise
around
in
them.
B
If
you
want
to
a
little
bit,
but
back
earlier,
I
found
this
dashboard
application
used
some
web
application
and
tools
on
it
found
that
it
was
based
on
a
server
side.
The
template
that
had
some
remote
code,
execution
vulnerability
and
it
wrote
a
exploit
for
that
vulnerability.
Shelled
the
server
and
installed
a
web
show
just
because
it's
a
lot
more
convenient
to
log
into
a
web
show
so
we'll
go
now,
and
we
will
log
into
this
web
show
that
I
have
left
for
myself.
B
I'm
right
so
here,
I
am
and
whenever
I
catch
a
show
on
something
that
I
haven't
been
on
before
you
know,
there's
a
whole
series
of
enumeration
commands
that
I
like
to
that
I
like
to
run
just
to
get
a
little
bit
of
a
feeling
for
where
we
are
so
I'll
go
into
my
notes:
grab
those
paste
them
in
and
review
the
output.
So
it
looks
like
I'm
running
as
a
user
dashboard.
B
It's
a
little
disappointing
I
would
rather
be
rude,
but
that's
what
privilege
escalation
exploits
were
made
for
I
noticed
that
the
distribution
says
it's
a
bun
too,
but
a
bun
too
doesn't
appear
in
the
kernel.
Build
string,
that's
a
little
suspicious.
If
this
were
a
normal,
a
bunting
machine.
The
bun
too,
would
also
appear
in
the
kernel.
Build
string
and
psdf
is
showing
four
processes.
So
certainly
this
is
a
container,
because
I
can't
imagine
a
VM
that
a
VM
or
a
physical
machine
that
was
only
running
four
processes
and
I
see.
B
We've
got
some
kubernetes
environment
variables.
All
of
that
matches.
Up
with
what
my
associate
read
reported
the
problem
they
were
having
so
I
feel
like
we're
in
the
right
place,
but
a
little
worried
that
there's
not
a
lot
we
can
do
in
here.
So
we'll
do
a
little
bit
more
of
poking
around.
If
it's
kubernetes
and
I'm
lucky
then
maybe
the
surface
account
that
is
mounted
into
this
container
will
have
some
access
on
its
own.
You
don't
always
get
lucky,
but
never
discount.
The
possibility
of
getting
lucky
always
got
a
check.
B
B
So
that
means
I'm
at
least
not
global
admin.
But
when
I
run
the
coop
CTL
get
coop
CTL
off.
Can
I
list
there's
a
lot
of
stuff
in
here,
so
that
makes
me
feel
pretty
good.
Like
probably
I
am
a
namespace
admin.
I
would
rather
be
cluster
admin,
but
with
namespace
admin
at
least
I
should
be
able
to
deploy
something.
B
So
brief,
little
aside
to
talk
about
InfoSec
twitter,
there's
a
lot
of
jokes
there's
a
lot
of
a
lot
of
silly
things
on
InfoSec
twitter,
but
also
there's
a
lot
of
there's
a
lot
of
neat
tech
tips.
So
I
found
a
great
one
here
on
too
and
I'm.
Just
gonna
paste
this
right
in
here
and
we'll
look
at
it
a
bit
before
we
run
it.
B
So
you
can
only
see
the
few
pins
that
are
running
inside
your
container
and
that's
really
why
we
want
to
think
that
it's
contained,
but
when
we
pass
House
bid.
True
in
here,
this
container
is
going
to
be
run
in
the
host
namespace,
so
technically
speaking,
it's
a
container,
but
it's
a
container
that
doesn't
really
have
walls
on
the
sides
of
it
once
we're
in
the
host
namespace.
B
So
it's
it
feels
like
schroot,
but
it's
much
more
fundamental
and
powerful
than
shrute,
so
we're
gonna
move
into
a
different
one,
because
the
container
runtime
puts
us
in
our
own
private
one
that
doesn't
have
anything
cool,
but
we
want
to
get
everything
cool.
So
what
amount
name
space?
Are
we
gonna
move
into
we're
gonna
move
into
the
same
mount
namespaces
in
it
is
in
because
that's
guaranteed
to
be
a
process
that
exists,
and
we
know
that
it's
the
main
one
of
the
system.
B
So
by
running
this
NS
enter
with
mount,
then
we
can
switch
into
the
host
mount
namespace.
So
now,
if
we
started
with
a
container
with
four
walls,
and
if
we
took
two
of
them
off
with
host
pit,
we
just
took
the
other
two
walls
off
with
NS
enter.
So
technically
speaking,
we're
going
to
be
in
a
container,
but
it's
a
container
that
doesn't
contain
anything,
isn't
is
really
just
the
host
and
once
we've
taken
all
the
walls
off
our
container,
then
we're
gonna
run
bash.
So
we'll
hit
enter
on
this.
B
It's
going
to
run
a
pod,
and
here
it
is,
it
says
right
so
I,
don't
really
know
I,
just
typed
that
so
maybe
it's
lying,
but
we
can
use
some
of
these
same
enumeration
commands
that
we
would
usually
use
in
order
to
explore.
What's
in
our
shell
now
so
a
lot
of
stuff.
So,
there's
a
good
sign,
we'll
scroll
up
here
to
the
top,
which
is
going
to
take
awhile
and
we
see
who
are
we
root?
Now,
that's!
That's!
That's
more
like
what
I
wanted
to
see.
B
Now
we
see
a
lot
of
release
information,
something
something
chromos.
So
that's
not
the
same
as
the
abun
that
was
talking
about
before
and
PS
yep
we've
got
hundreds
of
processes.
This
is
what
I
expect
from
a
VM.
We
we're
inside
the
host.
Now
we
just
broke
out
of
the
container
and
routed
the
host.
Let's
take
a
minute
and
appreciate
that,
raise
your
hand
if
this
is
the
first
time
you've
ever
broken
out
of
a
container
or
popped
a
root.
Shell!
B
Congratulations
to
all
of
you!
Alright!
So
now
that
we're
rude
on
the
host
now
we
can
start
to
do
something
fun.
So
you
know
red.
Had
this
Bitcoin
arrow
minor
packaged
up
as
a
container,
because
containers
make
running
and
deploying
your
applications
easy-
and
you
know
that's
that's
fine
and
dandy,
but
they
did
it
a
little
too
easy
because
I
think
they
probably
just
deployed
it
through
kubernetes
and
then
of
kubernetes
admin
saw
it
and
deleted
it.
Well.
B
I
know
that
usually
kubernetes
admins
don't
want
to
go
SSH
into
their
nodes,
that's
what
they
have
kubernetes
for.
So
if
we
have
access
to
docker
and
we
do
because
we
root
on
the
host,
we
can
just
run
a
container
right
here.
That's
gonna
be
a
container
and
it's
going
to
be
running,
but
it's
not
gonna
be
under
the
management
of
kubernetes.
B
B
All
right,
so
we've
got
our
miner
running
now,
but
it's
not
running
in
kubernetes.
It's
just
running
in
docker
on
the
host,
so
hopefully
that'll
make
it
a
little
less
likely
that
the
SIS
admin's
are
gonna
notice
us.
So
we
could
just
quit
now
because
we
fulfilled
our
end
of
the
promise.
But
this
has
been
a
lot
of
work
for
nothing,
but
a
few
cryptocurrency
coins
that,
let's
face
it,
they're
gonna
crash
in
a
week
or
so
and
not
be
worth
anything
anyway.
B
So,
let's
see
if
we
can
do
something
else,
I
want
to
get
some
better
kubernetes
creds
I'm,
a
namespace
admin
and
I'm
root
on
the
host,
but
I
would
really
also
like
to
be
cluster
admin,
so
one
place
that
we
can
get
some
creds
is
from
the
couplet
cool.
It
runs
on
the
runs
on
the
node.
It
needs
to
authenticate
to
the
API
server.
So
if
we
look
here,
it's
got
a
coop
config
file
on
that
coop
config
files
got
creds
associated
with
it,
so
using
the
coop
config
option:
coop
CTL.
B
Let's
try
connecting
to
kubernetes
as
if
we
were
the
couplet
and
see
what
we
can
do
can
I
create
a
potty
in
coop
system
I,
like
the
look
of
that.
So
maybe
this
is
gonna,
help
us
out.
Let's
try
and
actually
run
a
pod
in
coop
system
using
the
couplets
creds,
so
we
got
coop
config
with
the
path
to
the
couplets
coop
config
and
we're
just
gonna
run
a
busybox
image.
B
No
and
part
of
the
reason
for
this
is
if
this
had
been
poorly
configured,
the
couplet
might
have
been
cluster
admin
and
we
would
have
just
won
the
game,
but
in
this
particular
instance,
because
it
is
a
gke
cluster,
the
couplet
can
create
pods,
but
it
can
only
create
mirror
pods,
which
are
like
fake
metadata
only
pods
that
represent
the
existence
of
static
pods.
It's
a
neat
thing
go
read
about
it
if
you
haven't,
because
it's
lovely
but
but
I'm
not
really
happy,
because
I
wanted
to
become
cluster
admin
and
I'm.
B
Not
so
are
there
any
other
creds
that
we
can
steal
well
we're
root
on
the
host.
So
if
you've
ever
looked
at
the
mount
table
on
a
docker
host,
you
see
that
it's
crazy,
because
every
one
of
your
containers
has
many
things
mounted
into
it
in
order
to
build
up
the
union
file
systems.
So
one
of
the
things
that
we'll
see
in
there
is
secrets
secret
is
not
a
command,
but
grep
is
a
command
that
you
can
use
to
find
only
the
secrets.
B
So
naively,
we
could
go
through
all
of
these
files
and
copy
out
the
secrets
and
try
them,
and
you
know
when
I
was
just
a
beginning
hacker,
that's
the
sort
of
thing
that
I
would
do,
but
since
I
do
this
professionally
I'll
go
into
my
notes
and
I'll
get
this
handy.
Unix
one-liner
that
is
going
to
search
for
the
Kubb
system
default
token
snag
it
automatically
and
stick
it
into
an
environment
variable
for
me
and
there
it
is
I'll,
probably
want
to
copy
this
for
later.
B
So
I
can
do
whatever
I
want
and
that's
great,
but
most
of
the
time
folks
are
smart
enough
not
to
keep
their
API
server
on
the
Internet,
but
right
now
I
can
access
it
because
I'm
inside
the
cluster
I'm
inside
this
host,
that's
in
the
cluster
but
I'm
feeling
a
little
worried.
I
want
to
get
logged
out
of
this
web
shell
and
disappear
soon,
because
the
longer
I'm
in
here
the
more
logs
I'm
going
to
leave
I,
don't
get
myself
busted.
B
B
So
I've
been
a
little
busy.
That's
that's
a
thing
that
I
probably
should
have
done
and
you'll
find
out
later.
I
really
wish.
I
would
have
so
now
that
we've
got
now
that
we've
got
this
token
and
we've
got
the
API
server
exposed
on
the
internet.
I
want
to
copy
this
token
copy
it
over
put
it
in
my
Linux
VM
and
verify
that
I
actually
have
the
internet-based
connectivity
that
I
think
I
do.
B
C
C
C
C
C
The
resource
consumption
of
all
the
pots,
let's
take
a
look
breakdown
by
pods
Falco's,
a
little
high,
but
I,
don't
think
that
would
be
causing
a
problem.
That's
odd!
So
what's
what's
going
on,
we
installed
Falco
last
time
and
it
looks
like
we're
getting
some
alerts
from
Falco.
So
let's
go
ahead
and
copy
this
query
and
OpenStack
driver
and
take
a
look:
what
kind
of
logs,
what
kind
of
loot
siz
Falco
giving
us
convert
to
click
on
the
arrow
and
the
right
of
the
field?
C
A
search
field
here
convert
to
advanced
because
we're
all
advanced
ops
people
and
run
Oh
interesting
we're
getting
privileged
container
alerts.
Shell
alerts,
let's
take
a
look
here.
What's
going
on
in
JSON,
payload
I
see
a
notice
privileged
container
started
under
output
fields,
looks
like
I,
see
a
container
ID
and
an
image
repository
interesting.
It's
a
privileged
pod
I.
Don't
think
that
should
be
happening,
but
something
happened
earlier
to
or
later
let's
see
here,
yep
same
thing,
output,
Alpine,
that's
interesting,
yeah
and
all
right.
C
So
we're
we're
seeing
some
alerts
here
from
Falco,
but
no
more
information
namespaces
blank
pod
is
blank.
So
I'm
curious.
If
our
kubernetes
logs
can
give
us
some
additional
information
based
on
what
we
know
so
far,
which
is
just
a
random
alpine
container,
that
is
running
so,
let's
copy
that
query.
Openstack
driver
switch
to
advanced
and.
C
In
our
kubernetes
cluster
logs
searching
for
container
image
alpine
looks
like
yeah.
That's
interesting,
something
got
created,
something
got,
looks
like
yep
a.
There
is
a
request
to
create
the
request
was
authorized
by
a
service
account
in
the
dev
default.
Namespace
a
pod
got
created.
That's
that's
interesting!
Oh
that's!
That's
not
looking
good!
Actually,.
C
Yeah,
so
I
I
saw
that
this
pod
got
created,
but
I
really
want
to
see
what
is
going
on
inside
this
pod.
So
I'm
gonna
copy
that
query
and
I'll
go
back
to
one
of
my
existing
cloud.
Shell
windows
pasted
this
query
and
run
it
see
what's
happening.
What's
in
oh,
oh
wow,
so
we're
actually
capturing
that
looks
like
someone
is
on.
Someone
is
in
this
pod
running
commands.
C
C
C
C
C
C
F
F
F
C
All
right,
sorry
about
that,
so
I
took
a
look
in
the
dev
namespace
found
pods.
That
I
was
expecting
to
see
but
dashboard
looked
interesting.
Cuz.
I'm
I've
read
some
headlines
of
some
companies
getting
popped
for
exposed
dashboards.
So
I
just
want
to
make
sure
that
I
want
to
find
out
if
that's
happening
here.
So
this
dashboard
container
does
not
have
anything,
but
we
have
an
off
proxy
container
in
here
looks
like
oh
yeah.
That
is
how
they
got
in
I'm.
Seeing
get
web
show
activity
in
this
container
with
this
IP
address,
so.
C
The
attacker
was
able
to
elevate
their
privileges
by
running
a
privileged
container
and
I
heard
a
talk
at
coop
con
this
week.
Opa
gatekeeper
can
be
deployed
as
a
admission
controller,
which
should
work
because
an
admission
controller
is
just
a
piece
of
code
that
intercepts
requests
as
they
flow
through
the
API
server
after
the
request
has
been
authenticated
and
authorized.
C
So
Appa
and
a
policy
could
possibly
evaluate
the
request,
make
a
decision
and
allow
or
deny
that
request
before
it
gets
persisted
in
@cd.
So
in
spirit
of
installing
security
I'm
going
to
go
ahead
and
install
security
in
this
cluster
and
the
reason
why
I
want
to
wait
a
little
bit
after
applying
gatekeepers,
because
customer
resource
definitions
take
a
little
bit
extra
time
for
the
reconciliation
loop.
To
take
its
course,
and
now
that
we
applied
the
CR
D
and
the
policies,
let's
actually
test
see
if
I
can
run.
C
D
D
Okay,
the
the
field
saying
apply
it
twice
if
you're,
following
along
we're,
going
to
do
that
in
a
second
I
want
to
kick
start
the
bonus
in
there.
Okay,
if
you
refresh
you'll
see,
we
have
some
bonus
challenges,
okay,
and
we
also
also
publish
the
hints
we're
running
a
little
bit
short
on
time,
so
I
want
to
get.
You
started
on
that.
If
you
want
to
take
advantage
of
this,
and
if
you
come
up,
I
should
say
here
we
go
if
you
get
both
challenges
come
up
and
whisper
to
us.
D
The
answers
of
both
challenges
and
you'll
get
a
fancy
sticker.
Okay,
so
there's
incentive
here
to
be
able
to
do
this
by
yourself.
However,
we
will
walk
through
at
the
very
very
end
here,
but
we're
going
to
do
is
we're
gonna
flip
back?
So
if
you
want
to
get
started
on
that,
while
we
see
if
we
can
troubleshoot
this
oppan
gatekeeper
installation,
that's
what
we're
gonna
do.
A
C
A
The
environments
themselves,
the
clusters
will
be
be
done.
Ten
minutes.
After
all,
of
the
secured
Cooper
days,
comm
will
stay
up.
The
git
repos
will
be
there
we'll
be
publishing
a
little
more
as
as
we
clean
up
that
some
of
the
scripts,
the
manifests,
but
the
actual
environments.
If
you
want
to
sign
up
for
a
gke
cluster
yourselves,
there's
a
$300
credit
that
goes
a
long
way.
What's
a
single
node
cluster
like
this
and
you'll,
be
able
to
do
all
these
labs
in
the
same
way
he's
going
to
she's
got
it
all
right.
D
C
All
right
and
for
those
who
want
to
see
how
gate
keeper
works
in
action,
so
you
have
a
second
apply
of
the
CR
DS
took
and
when
you
run
cut,
CTL
run
Alpine.
So
this
is
testing
the
white
listing
of
the
repos
container
repos.
You
get
the
error
that
it's
been
denied
by
white
listed
repos
rule
also,
if
we
want
to
test
the
creating
of
a
privileged
pod
again.
So
here
is
a
here
dock
and
let's
go
ahead
and
apply.
C
D
We
already
have
our
winners
picked,
we
do
have
fifty
or
so
so,
if
you
did
miss
one
or
if
you
have
a
co-worker
or
friend
whomever
we
do
have
them
up
on
stage,
but
I
ask
that
you
come
up
after
we
do
the
quick
walkthrough
of
the
bonus
challenge,
because
I
think
the
bonus
challenges
have
some
interesting
forensics
items.
So
we
were
going
to
give
a
little
bit
more
time
for
you
to
run
on
your
own,
but
I.
Think
running
through
the
the
walk
through
step
by
step
is
best.
Can
you
do
me
a
favor?
D
Can
you
push
the?
Can
you
do
the
make
docks
and
copy
them
over?
So
that'll
start
in
one
minute.
So
if
you
are
doing
the
bonus
challenges
on
your
own
right
now,
just
give
me
one
more
minute
and
then
we'll
follow
through.
So
you
can
do
every
single
command
find
every
single
part
or
artifact
that
we're
looking
for.
D
So,
while
tabbies
helping
me
out
here
by
publishing
these
so
they're
in
a
private
repo,
we're
copying
over
making
a
public
I'll
talk
through
briefly
what
these
two
challenges
are.
If
you're
leaving
that's
fine
I'm
going
to
talk
over
you,
unfortunately,
though,
so
what
we're
gonna
do
is
we're
gonna
replay
the
ability
to
get
on
the
root
the
root
of
the
node,
but
we're
gonna
look
for
some
evidence
of
something.
D
D
Perfect,
thank
you.
Tabby
looks
like
we're
rocking,
so
the
question
was
I
should
go
back
to
the
question.
This
is
the
this
is
the
bonus
show
so
get
a
root
shell
in
the
cluster
node
and
find
the
image
name
that
was
last
run
directly
with
docker
commands
by
the
kubernetes
user.
This
kubernetes
user
is
specific
to
gke
in
this
specific
instance,
but
it
could
just
be
anybody.
So
one
of
the
ways
that
we
can
do
this
that
will
bypass
OPA
gatekeeper
is
we're.
Gonna
run
this
in
a
different
namespace,
open
gate.
D
Keeper
was
only
running
against
Devon
prod
game
spaces,
so
we're
gonna
run
this
against
the
default
namespace.
So
we're
gonna,
clear
here
doc,
so
you'll
apply
I
need
to
be
shorter.
This
helps
it
go
okay,
so
we
created
the
pod.
We
have
applied
it,
we're
gonna
exec
into
it,
and
this
is
yet
another
mechanism.
D
I
know
tabby
did
it
with
NS
enter.
This
is
the
chroot
or
Schrute
method,
okay,
we're
still
in
the
container,
but
we
have
a
route
FS,
that's
what
we
called,
what
we're
mounting
to
slash
on
the
node
underneath
okay,
so
we're
gonna
route
in
and
run
bash.
That's
been
bash
on
the
node,
we're
not
in
the
host
name
space,
but
we're
able
to
run
docker
commands
and
we're
able
to
look
around
the
file
system.
D
So
home
kubernetes,
oh
yeah,
PS,
cf,
all
sorts
of
good
stuff,
we're
definitely
on
the
node
right
and
if
we
cat
bash
history,
I
was
gonna,
stop
here
and
not
actually
run
this
command
because
I
wanted
to
let
people
actually
achieve
it
and
then
come
up
and
get
stickers.
We
still
have
a
few
left.
If
you
want
to
take
some,
but
I'll
show
you
anyway,
the
lovely
dead
beef
latest
image
was
the
one
that
was
run
so
that
was
flag
one
okay,
so
we're
gonna
exit
exit
exit.
Okay.
D
So
if
you're,
following
along
exit
once
now,
we're
back
into
the
container
exit
twice
we're
back
in
cloud.
Shell
part:
two:
okay,
it's
very
clear:
we're
probably
already
popped
right,
multiple
times
over
history.
We
were
only
finding
the
last
hour
or
so
in
terms
of
activity,
but
what
we've
done
is
we
removed
tiller
as
a
deployment
with
helm
reset
force,
and
what
that
does?
Is
that
just
takes
the
tiller
deployment
out,
but
it
leaves
all
of
its
artifacts
and
permissions
and
everything
else
that's
associated
with
it
still
in
the
cluster.
D
So
where
does
tiller
if
it's
installed
in
the
coop
system
namespace?
Where
does
tiller
leave
its
config
maps?
I
just
gave
it
away.
Sorry
it's
in
the
coop
system,
namespace.
It
leaves
config
Maps
for
all
the
versions
of
deployments,
so
these
next
commands
are
going
to
be
extracting
the
helm
chart
out
of
the
remnant
like
the
version
history.
Basically,
the
tarvold
sorry
gzipped
version
history.
D
So
if
you
want
to
run
this
by
yourself,
that's
fine,
I'm
going
to
talk
through
it
and
just
do
the
final
commands
again,
because
the
time
constraints
so
we're
gonna
get
the
config
map
I'll,
show
that
and
then
we'll
jump
to
exactly
how
we
parse
this
okay.
So
we
can
see
I
should
do
just
the
config
Maps.
D
We
see
toned
elk
version,
one
right,
so
that
was
an
arbitrary
and
automatically
generated
name
for
a
deployment
inside
of
helm.
That's
still
left
over
tillers
not
running
right
now,
so
if
we
want
to
get
access
to
what
that
looks,
like
you
see
all
of
this
base64
encoded
stuff
right,
this
is
actually
a
gzip
of
a
total
I
think
it
gzip
tar.
What
are
my
commands?
D
What
we're
gonna
do
is
we're
gonna
we're
gonna
find
out
so
we're
using
a
little
JQ.
Let
me
scroll
down,
get
the
config
map
name,
tono
output
to
Jason,
put
it
through
JQ,
look
for
the
dot
data,
dot,
release,
field,
base64,
decode
it
and
then
say
what
kind
of
file
is
that
it's
gzip
compressed
okay,
so
that
gives
us
a
clue
of
what
we
should
do.
Okay,.
D
Gn,
zip
ooh
that
looks
interesting.
It's
literally
everything
Gazeta
up,
so
you
can
see
the
the
templating
the
there's
values,
yeah
M'lynn
here
I,
don't
think
we
use
very
many
values.
There's
the
values
animal
if
you're
familiar
with
helm,
charts
right,
so
there
might
be
secrets
or
static
values
in
there
things
to
ignore
and
helm
ignore,
but
really
what
we're
looking
for.
Is
this
very
suspicious-looking
image
right
here?
Okay,
should
we
go
ahead
and
dock
or
run
that.
D
Anybody
why
would
we
not
want
to
do
that
because
I'm
rude
on
my
cloud,
shell?
That
would
be
pretty
bad.
So,
let's
inspect
it
gently
just
give
it
a
just
a
massage
it
from
the
side.
It's
fine,
okay!
So
how
many
of
you
ever
heard
of
a
tool
called
dive
by
W
a
Goodman
dive,
excellent
wow?
That's
that's
fantastic!
It's
a
great
tool!
What
it's
gonna
do:
I'm
gonna,
I'm
gonna,
run
it
and
then
I'm
gonna
tell
what
its
gonna
do:
okay
and
we're
actually
running
dive
as
a
container.
D
So
you
have
to
install
anything
but
dive.
What
it
does
is
it
breaks
down
loads
layers,
breaks
them
apart
and
lets.
You
view
it
in
a
and
curses
based
viewer.
So
you
can
look
docker
file
line
by
docker
file
line.
What's
going
on
in
each
each
line,
what's
at
to
the
container,
to
the
right,
you'll
see
so
for
now
we're
now
we're
actually
just
looking
at
it
inspecting
we're
not
actually
executing
or
running
it.
Okay.
So
we
can
see.
This
is
the
from
the
root.
It
just
shows
the
hasha.
That's
the
base
image.
D
If
we
hit
our
down
arrow,
we
could
see
where
app
get
installing
curl
and
things
look
at
the
right
side.
Nothing's
really
changed
in
the
meaningful
way
until
we
copied
in
our
back
door
binary
it's
in
green.
It's
B
D
that
second
line
right
there
and
B
D
I
think
I
can
tab
over
that's
easier
to
see
right,
that's
our
probably
our
backdoor
binary
right
and
then
we
to
mod
it
to
be
executable,
and
that's
that
really
looks
interesting.
D
Let's
try
and
see
what
we
can
find
that
we're
gonna
hit
ctrl,
C,
okay,
so
we're
looking.
How
do
we
find
that?
How
we
get
that
out
of
the
the
container
image
itself?
What
we're
gonna
do
is
we're
gonna
make
a
temp
scratch
space,
so
we
can
extract
this
so
we're
just
making
a
BD
temp
backdoor
temp
we're
going
to
run
the
docker
save
command
and
we're
going
to
output
it
to
a
tarball.
D
And
it'll
take
everybody.
Do
it
all
at
once
right
now,
do
it
go
I'm
just
kidding
this
is
cloud
shell,
so
it's
gonna
be
quick.
Alright,
so
we've
got
our
tar
ball
still,
don't
want
to
extract
it
just
yet
cuz
it
could
be.
You
know
you
never
know.
What's
in
a
tar
ball
until
you
poke
at
it,
so
tar
look
at
it.
Verbose,
ly
file
we're
not
actually
extracting
anything
right.
D
D
We
have
a
manifest.json
which
says,
what's
in
all
of
these
long
sha-256
hash
file,
folders
and
I'm,
going
to
jump
ahead
because
we're
right
at
the
very
end
and
I
just
want
to
get
to
the
last
part
here
we're
gonna
look
inside
the
manifest
we're
gonna
pull
out
the
config
Jason,
we're
gonna,
look
at
the
history
and
we're
going
to
select
all
of
the
non-empty
layers.
So
again,
this
looks
like
our
docker
file
again
right.
So
now
we
know
what
we're
looking
for
we're
looking
for,
probably
the
third
or
the
fourth
layer
in
this
list.
D
We'll
probably
have
that
BD
binary
or
script
so
I'm
just
going
to
just
wing
it
and
say:
let's
go
for
the
last
one:
look
for
the
layers
out
of
manifest.json
tail,
one
okay.
So
we
have
that.
That's
that's
ready
to
go
for
piping
into
this,
and
here
is
the
final
flag
extract,
verbose,
the
last
layer,
look
at
it
and
then
that
capital
o
says
put
it
to
standard
out.
This
could
be
binary
data
and
mess
up
our
terminal,
but
we
know
it
was
95
bytes.
So
it's
probably
a
script
and
there's
our
shell.