oscp/Necronomicon/Cloud/Kubernetes/Enumeration.md

• Get API version

  • curl -Lk https://<API_IP>/version --header "Authorization: Bearer $TOKEN"

• Useful API endpoints

  • Spec
    • https://<API_IP>/openapi/v2
  • Secrets
    • api/v1/namespaces/default/secrets/
  • Account information
    • api/v1/namespaces/default/serviceaccounts

• Get Load Balancers

  • kubectl get services --all-namespaces -o jsonpath='{range .items[?(@.spec.type=="LoadBalancer")]}{.status.loadBalancer.ingress[*].hostname}:{.spec.ports[*].port}{"\n"}{end}'

• List pods in kube-system namespace

  • kubectl get pods -n kube-system

• Get all secrets (requires cluster admin permissions, usually kube-system token)

  • kubectl get secrets --all-namespaces

• List all pods running on current node to determine which secrets are accessible

  • kubectl get pods --all-namespaces --field-selector spec.nodeName=<node_name>

• Retrieve specific secret

  • kubectl get secret <secret_name> -o json -n <namespace> | jq .data

• Get External IP's of all nodes

  • kubectl get nodes --all-namespaces -o jsonpath='{range .items[*].status.addresses[?(@.type=="ExternalIP")]}{.address}{"\n"}{end}'

• Get Kubernetes API Server Config

  • POD_NAME=$(kubectl get pods --namespace kube-system | grep kube-apiserver | head -1 | awk '{print $1}') && kubectl describe pod $POD_NAME --namespace kube-system

• Get list of nodes sorted by creation time (useful for finding stable machines for persistence)

  • kubectl get nodes –sort-by=.metadata.creationTimestamp

• Get Kubernetes API Server Container Args

  • POD_NAME=$(kubectl get pods --namespace kube-system | grep kube-apiserver | head -1 | awk '{print $1}') && kubectl get pod $POD_NAME --namespace kube-system -o json | jq -r '.spec.containers | .[] |select(.name == "kube-apiserver")| .args'

• Get Network Policies

  • kubectl get networkpolicy --all-namespaces

• Get Cluster Admin Role Bindings

  • kubectl get clusterrolebindings | grep "ClusterRole/cluster-admin"

• Get Cluster Roles With Secrets Access

  • kubectl get clusterroles -o json | jq -r '.items[] | select(.rules[].resources | index( "secrets" )|select(. != null)).metadata.name'

• Get Roles With Secrets Access

  • kubectl get roles --all-namespaces -o json | jq -r '.items[] | select(.rules[].resources | index( "secrets" )|select(. != null)).metadata.name'

• Get Cluster Roles with Configmaps Access

  • kubectl get clusterroles -o json | jq -r '.items[] | select(.rules[].resources | index( "configmaps" )|select(. != null)).metadata.name'

• Get Roles with Configmaps Access

  • kubectl get roles --all-namespaces -o json | jq -r '.items[] | select(.rules[].resources | index( "configmaps" )|select(. != null)).metadata.name'

• Get Pods With Containers Without Resources Limits

  • kubectl get pods --all-namespaces -o json | jq -r '.items[].spec.containers[] | select(.resources.limits == null).name'

• Get All Containers Images

  • kubectl get pods --all-namespaces -o json | jq -r '.items[].spec.containers[].image' | sort | uniq

• Get cluster roles with wildcard resources

  • kubectl get clusterroles -o json | jq -r '.items[] | select(.rules[].resources | index( "*" )|select(. != null)).metadata.name'

• Get roles with wildcard resources

  • kubectl get roles --all-namespaces -o json | jq -r '.items[] | select(.rules[].resources | index( "*" )|select(. != null)).metadata.name'