POST-EXPLOITING A COMPROMISED ETCD CLUSTER

Summary from the TLDR InfoSec newsletter

This post from NCCGroup presents a technique for compromising Kubernetes clusters given a root-compromised etcd host. The post provides an overview of how Kubernetes interacts with etcd and then delves into how to use a compromised etcd host to gain access to a cluster, followed by bypassing AdmissionControllers. The post concludes with some potential mitigation techniques.