Lion Cipher Lab
Escalate privileges through Kubernetes RBAC — and lock the paths down
- Cloud Security
- Advanced
- ~75 min
- Free · no account required
Why it matters
Kubernetes RBAC failures are the quiet way a single compromised pod becomes a compromised cluster. When an attacker lands in a pod — through an app vuln, a poisoned image, an SSRF — they inherit that pod's ServiceAccount token, mounted right there at /var/run/secrets/kubernetes.io/serviceaccount/token. From there the game is pure RBAC: what can this identity do, and can any of it be chained upward? The dangerous part is that the verbs that lead to cluster-admin rarely LOOK dangerous on a permissions review. 'create pods' reads as ordinary workload management — but a subject who can create a…
What you'll learn
- reading RBAC as an attacker: Roles/ClusterRoles grant verbs on resources, RoleBindings/ClusterRoleBindings attach them to subjects
- enumerating a ServiceAccount's real rights without a shell using kubectl auth can-i --list and impersonation (--as)
- the create-pods primitive: mounting any ServiceAccount into a new pod (run-as-any-SA) and mounting the node filesystem via hostPath
- the bind / escalate verbs as the explicit opt-outs to RBAC privilege-escalation prevention
- minting or harvesting another ServiceAccount's token (serviceaccounts/token, reading Secrets) to inherit its power
- proving escalation: a stolen token makes `kubectl auth can-i '*' '*'` return yes
- closing each path: drop wildcard verbs, never grant pod-create/bind to untrusted SAs, enforce Pod Security Admission (restricted)
- the judgment that a namespace is not a security boundary against a node-level escape
Steps in this lab
- How an attacker reads RBAC (and inherits a pod's ServiceAccount)
- Build the local range: a kind cluster, a low-priv SA, a harmless-looking Role
- Primitive 1 — 'create pods' is run-as-any-SA (steal the controller's token)
- Primitive 1b — the same verb mounts the NODE (hostPath = escape the cluster)
- Primitive 2 — the `bind` and `escalate` verbs (grant yourself cluster-admin)
- Primitive 3 — harvest another identity's token (Secrets & serviceaccounts/token)
- The lockdown — remove every path and prove the attack now fails
- The judgment: named failure modes, and how a pro does it better