Hack GKE Clusters with Mondoo's Kubernetes Container Escape Labs

GKE Container Escape Hack: How Does It Work?

The container escape hack in GKE involves three main steps:

1. Exploit a command injection vulnerability in the vulnerable web application, DVWA. This allows the attacker to execute commands in the context of the web application, which runs on a Kubernetes Pod in the GKE cluster.
2. Utilize information gathering techniques to discover that the service account has permissions to deploy privileged pods on the cluster.
3. Deploy a privileged pod on the node, enabling you to perform a container escape and escalate your privileges to obtain a root shell on the node.

By following code examples and step-by-step instructions, you'll learn to exploit an insecurely configured and thus vulnerable Google Kubernetes cluster, scan your GCP project, and assess the security of your GKE cluster. This hands-on experience will enhance your understanding of insecure Kubernetes configurations and provide you with the knowledge and tools needed to protect your own infrastructure.

Let's dive into GKE hacking and discover how to defend your clusters against potential attacks.

gcp.project.gke.clusters.map(nodePools{*})

gcp.project.gke.clusters.map(nodePools{config{*}})

gcp.project.gke.clusters { name nodePools{name config{serviceAccount{name}}}}

Note: Make sure to use this format for the service account name in the query below:

serviceAccount:name@project.iam.gserviceaccount.com

The name should resemble the string lunalectric-xxxx-node. For project-name, substitute the name of your Google project.

gcp.project.iamPolicy.where(_.members.any(_ == "serviceAccount:lunalectric-xxxx-node@project-name.iam.gserviceaccount.com")) {*}

This output shows the permissions associated with the service account that runs the node pool in your test cluster. As you can see, in addition to the three necessary roles for running a cluster, the service account also has access to the role roles/iam.serviceAccountUser. This is one of the reasons why it's possible to deploy a new Pod that escalates privileges to the root account of the node.

The presence of the roles/iam.serviceAccountUser role is a key factor in enabling the privilege escalation required to obtain a root shell on the node.

While custom checks and policies may appeal to security enthusiasts, Mondoo aims to simplify your job by providing a range of advantages:

• CIS-certified policies for all major cloud providers
• CIS-certified policies for all major Linux distributions and Windows builds
• Mondoo's custom-made best practice policies
• A user-friendly, browser-based interface for tracking hardening efforts across your infrastructure
• Numerous features designed to strengthen your company's security posture

Sign up here to access our extensive catalog of policies and secure your infrastructure more effectively.

Scan your GKE cluster

After setting up your Mondoo account, enter this command in your shell to scan your GCP project:

cnspec scan gcp project <your-project-name>

At first, this does not trigger scanning based on a policy. You need to enable a policy on which to base the scan:

See more scan results and asset relationships on the Mondoo Console: https://console.mondoo.com/space/fleet/1KnZA3cAE1GHRTzU3s64Dw4QWERAu?spaceId=spicy-fisher-123456

2. Select the Policies tab.

3. Select ADD A POLICY and type Google Kubernetes into the search field. Enable the CIS Google Kubernetes Engine (GKE) Benchmark - Level 1 by selecting the Enable icon (a bar graph).

After enabling the policy, return to your shell and scan your project:

cnspec scan gcp project <your-project-name>

Tip: If you use the -o full option, you can see the details of all failed checks directly in the shell.

cnspec scan gcp project <your-project-name> -o full

The output below shows one of the failed checks and points to the service account that the GKE hack relies on to succeed.

 ✕ Fail:  F  5  Ensure GKE clusters are not running using the Compute Engine default service account
  Query:
    gcp.project.gke.clusters.map(
      nodePools {
        config.serviceAccount {
          serviceAccountsNodepools = 'serviceAccount:' + email
          gcp.project.iamPolicy.where(
            _.role != "roles/logging.logWriter" &&
            _.role != "roles/monitoring.metricWriter" &&
            _.role != "roles/monitoring.viewer"
          ).map(members).none(
            _ == serviceAccountsNodepools
          ) serviceAccountsNodepools
        } name
      }
    )

  Result:
    gcp.project.gke.clusters.map: [
      0: [
        0: {
          config.serviceAccount: {
            serviceAccountsNodepools: "serviceAccount:lunalectric-xxxx-node@project-name.iam.gserviceaccount.com"
            [].none(): false
          }
          name: "lunalectric-pool"
        }
      ]
    ]

Now, with the policy enabled, return to the Mondoo Console to see the results of all checks in that policy. You can explore further from there.

Further useful commands to check your GKE infrastructure

Scan Kubernetes manifests

You can scan Kubernetes manifests to find potential vulnerabilities before deploying them in your clusters:

cnspec scan k8s --path ../assets/escape-to-node.yaml

Here are the results of a scan of the Pod manifest that led to the takeover of the node:

Scan the GKE Cluster

cnspec scan k8s scan

More Exploits and Platforms to Explore

Expand your Kubernetes hacking adventure with Mondoo by trying out our provider labs:

• Google Kubernetes Engine (GKE)
• Microsoft Azure Kubernetes Services (AKS)
• Amazon Elastic Kubernetes Service (EKS)
• Minikube

Follow the tutorial in each lab's README file for a unique hacking experience with different cloud providers.

Strengthen Your Security Posture with Mondoo's Kubernetes Container Escape Labs

With Mondoo's Kubernetes Container Escape Labs, you can learn how to secure your GKE clusters from potential breaches. By understanding the attacker's perspective and using Mondoo's powerful tools, you can effectively protect your infrastructure from similar attacks. Don't forget to explore other exploits and platforms with Mondoo to expand your knowledge and experience. Happy hacking!