oscp/Necronomicon/Cloud/Kubernetes/Privilege Escalation.md

• Get Pods With Privileged Containers

  • kubectl get pods --all-namespaces -o json | jq -r '.items[]|select(.spec.containers[].securityContext | select(.privileged == true)).metadata.name'

• Get Pods with Containers allowed to perform Privilege Escalation

  • kubectl get pods --all-namespaces -o json | jq -r '.items[]|select(.spec.containers[].securityContext | select(.allowPrivilegeEscalation == true)).metadata.name'

• Get Pods with Containers running as Root

  • kubectl get pods --all-namespaces -o json | jq -r '.items[]|select(.spec.containers[].securityContext | select(.runAsUser == 0)).metadata.name'

• Get Pods with Containers including System Admin Capability

  • kubectl get pods --all-namespaces -o json | jq -r '.items[] | select(.spec.containers[].securityContext.capabilities.add | index("SYS_ADMIN") | select(. != null)).metadata.name'