Skip to content
attack.paths
Iniciar sesión
← RegistryDossier · 7 steps · 6 edges

Privileged pod escape → cluster admin

GenericWrite on a Deployment in the kube-system namespace lets you launch a privileged pod; the pod mounts the host filesystem and steals the kubeconfig of cluster-admin.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: attacker has create/update Deployment rights in kube-system (or any namespace whose pods get scheduled onto a control-plane node).

§ Steps

  1. 01
    kubectl with cluster-adminInitial Access
    T1078— Valid Accounts
  2. 02
    Compromised K8s principalInitial Access
    T1078— Valid Accounts
  3. 03
    Read /etc/kubernetes/admin.conf from hostCredential Access
    T1552— Unsecured Credentials
  4. 04
    RBAC audit (kubectl auth can-i)Discovery
    K-RBAC-AUDIT— K8s RBAC Audit (rakkess / kubectl-who-can)
  5. 05
    Create privileged pod (host filesystem mount)Privilege Escalation
    K-PRIV-CONTAINER— Privileged Container Escape
  6. 06
    Pod schedules on control-plane nodePrivilege Escalation
    K-HOSTPATH-MOUNT— hostPath Volume Mount
  7. 07
    Backdoor DaemonSet / admission webhookPersistence
    K-ADMISSION-WEBHOOK— Malicious Admission Webhook

§ References

§ Frequently asked

What is the "Privileged pod escape → cluster admin" attack path?
GenericWrite on a Deployment in the kube-system namespace lets you launch a privileged pod; the pod mounts the host filesystem and steals the kubeconfig of cluster-admin. It chains 7 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is kubectl with cluster-admin (T1078) — a initial access primitive. Assumed environment: attacker has create/update Deployment rights in kube-system (or any namespace whose pods get scheduled onto a control-plane node).
What is the final impact of this kill-chain?
The final step lands on Backdoor DaemonSet / admission webhook (K-ADMISSION-WEBHOOK), which falls under Persistence. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers