Thread by @abhaybhargav

Webhooks are a big part of @kubernetesio. I've recently been going down the webhook rabbithole, especially for offensive use-cases. And here's what I think. A 🧵 1/

@kubernetesio #kubernetes uses an access control object called an Admission Controller. This is beyond AuthN and AuthZ. This allows you to create objects that will allow you the operator to define workloads and configs that are admitted in your cluster. appsecengineer.com/courses-collec…
2/

@kubernetesio This is largely done using Admission Control webhooks. There are two types of webhooks you can use in #k8s, they are:
- validating
- mutating
Watch my 1m video here if you want to learn the differences

3/

@kubernetesio Webhooks, as you. can imagine, are a critical part of kubernetes. They can be configured to act on every single request that is hitting the kube-apiserver. They have the ability to validate/mutate workload parameters deeply. This naturally, can be abused for 👿 things. 4/

@kubernetesio Webhooks are great for post-exploit scenarios in kubernetes. How? All I would need to do is deploy a mutating admission controller that could:
- change my pod to be deployed with root privileges
- expose my service publicly
- tamper with my pod to do $x (DNS spoofing)
5/

@kubernetesio - run my code as part of your pod 🤯
- load my container as a sidecar to your pod. Now I have persistence
- pretty much do anything I want by tampering with your podspec on the fly because my webhook does that for me
6/

@kubernetesio Not only can I do nasty things with mutating webhooks. You can do naughty things with validating webhooks (that only validate config).
- ship off the request (may be a kube secret) to a third party URL
- DoS attacks by denying possibly genuine workloads from being launched
7/

@kubernetesio Why?
- Lots of Admin/Operators dont bother examining RBAC privs on CRDS and webhooks. Just a little different from the curl | sh effect
- Admin/operators dont bother inspecting helm charts for RBAC issues and malicious code
but most of all... 8/

@kubernetesio Webhooks ARE used for Policy management and enforcement. So its like a bad actor in law-enforcement. "Who watches the watchers" and all that...
In conclusion: If you're an offensive security/redteam person. You should leverage the webhooks in your kubernetes exploit toolkit
9/

@kubernetesio I am running a outright offensive training on "Attacking the Application Supply Chain" at @BlackHatEvents #BHUSA. If you're interested in pwning all types of supply-chains incl kubernetes with webhooks. You should secure your seat!
blackhat.com/us-22/training…

@kubernetesio @BlackHatEvents That's a wrap!

If you enjoyed this thread:

1. Follow me @abhaybhargav for more of these
2. RT the tweet below to share this thread with your audience

https://twitter.com/abhaybhargav/status/1519717244233785346