diff --git a/Scenario Walkthroughs/ssh-to-cluster-admin.md b/Scenario Walkthroughs/ssh-to-cluster-admin.md index 9aa13b1..e4203a0 100644 --- a/Scenario Walkthroughs/ssh-to-cluster-admin.md +++ b/Scenario Walkthroughs/ssh-to-cluster-admin.md @@ -2,8 +2,8 @@ ### Compromising the cluster -1. Scan all ports on node `nmap [CLUSTERIP] -p-` -2. Login via ssh `ssh -p 32001 sshuser@[CLUSTER IP]`. When prompted for a password, type `sshuser` -4. Get list of pods in kube-system namespace `kubectl get po -n kube-system` -5. Grab the certificate `kubectl -n kube-system exec [API_SERVER_POD] -- cat /etc/kubernetes/pki/ca.key` -6. Profit! +This scenario begins with ssh access to a pod. The ssh credentials can be found in the scenario setup. + +1. Get list of pods in kube-system namespace `kubectl get po -n kube-system` +2. Grab the certificate `kubectl -n kube-system exec [API_SERVER_POD] -- cat /etc/kubernetes/pki/ca.key` +3. Profit!