From 0534a28a61cac8b6146b15ea6a0b722e1e5961ca Mon Sep 17 00:00:00 2001 From: MrIntern Date: Fri, 19 Aug 2022 14:15:55 +0100 Subject: [PATCH] explain ssh part of scenario --- Scenario Walkthroughs/ssh-to-cluster-admin.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Scenario Walkthroughs/ssh-to-cluster-admin.md b/Scenario Walkthroughs/ssh-to-cluster-admin.md index 9aa13b1..e4203a0 100644 --- a/Scenario Walkthroughs/ssh-to-cluster-admin.md +++ b/Scenario Walkthroughs/ssh-to-cluster-admin.md @@ -2,8 +2,8 @@ ### Compromising the cluster -1. Scan all ports on node `nmap [CLUSTERIP] -p-` -2. Login via ssh `ssh -p 32001 sshuser@[CLUSTER IP]`. When prompted for a password, type `sshuser` -4. Get list of pods in kube-system namespace `kubectl get po -n kube-system` -5. Grab the certificate `kubectl -n kube-system exec [API_SERVER_POD] -- cat /etc/kubernetes/pki/ca.key` -6. Profit! +This scenario begins with ssh access to a pod. The ssh credentials can be found in the scenario setup. + +1. Get list of pods in kube-system namespace `kubectl get po -n kube-system` +2. Grab the certificate `kubectl -n kube-system exec [API_SERVER_POD] -- cat /etc/kubernetes/pki/ca.key` +3. Profit!