SteamCloud 443
RETIRED MACHINE
Linux
Easy
SteamCloud
Linux
Easy
4.7
MACHINE RATING2970
USER OWNS2522
SYSTEM OWNS14/02/2022
RELEASEDMachine Synopsis
SteamCloud is an easy difficulty machine. The port scan reveals that it has a bunch of Kubernetes specific ports open. We cannot not enumerate the Kubernetes API because it requires authentication. Now, as Kubelet allows anonymous access, we can extract a list of all the pods from the K8s cluster by enumerating the Kubelet service. Furthermore, we can get into one of the pods and obtain the keys necessary to authenticate into the Kubernetes API. We can now create and spawn a malicious pod and then use Kubectl to run commands within the pod to read the root flag.
Machine Matrix