AWS - EKS Post Exploitation
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
For mor information check
AWS - EKS EnumIf you have the permission eks:AccessKubernetesApi you can view Kubernetes objects via AWS EKS console (Learn more).
Easy way:
Not that easy way:
If you can get a token with aws eks get-token --name <cluster_name> but you don't have permissions to get cluster info (describeCluster), you could prepare your own ~/.kube/config. However, having the token, you still need the url endpoint to connect to (if you managed to get a JWT token from a pod read here) and the name of the cluster.
In my case, I didn't find the info in CloudWatch logs, but I found it in LaunchTemaplates userData and in EC2 machines in userData also. You can see this info in userData easily, for example in the next example (the cluster name was cluster-name):
The creator of the EKS cluster is ALWAYS going to be able to get into the kubernetes cluster part of the group system:masters (k8s admin). At the time of this writing there is no direct way to find who created the cluster (you can check CloudTrail). And the is no way to remove that privilege.
The way to grant access to over K8s to more AWS IAM users or roles is using the configmap aws-auth.
Therefore, anyone with write access over the config map aws-auth will be able to compromise the whole cluster.
For more information about how to grant extra privileges to IAM roles & users in the same or different account and how to abuse this to privesc check this page.
Check also this awesome post to learn how the authentication IAM -> Kubernetes work.
It's possible to allow an OpenID authentication for kubernetes service account to allow them to assume roles in AWS. Learn how this work in this page.
Decoding the JWT token we get the cluster id & also the region. Knowing that the standard format for EKS url is
Didn't find any documentation that explain the criteria for the 'two chars' and the 'number'. But making some test on my behalf I see recurring these one:
gr7
yl4
Anyway are just 3 chars we can bruteforce them. Use the below script for generating the list
Then with wfuzz
Remember to replace & .
If an attacker obtains credentials of an AWS with permission over an EKS. If the attacker configures it's own kubeconfig (without calling update-kubeconfig) as explained previously, the get-token doesn't generate logs in Cloudtrail because it doesn't interact with the AWS API (it just creates the token locally).
So when the attacker talks with the EKS cluster, cloudtrail won't log anything related to the user being stolen and accessing it.
Note that the EKS cluster might have logs enabled that will log this access (although, by default, they are disabled).
By default the user or role that created a cluster is ALWAYS going to have admin privileges over the cluster. And that the only "secure" access AWS will have over the Kubernetes cluster.
So, if an attacker compromises a cluster using fargate and removes all the other admins and deletes the AWS user/role that created the Cluster, the attacker could have ransomed the cluster.
Note that if the cluster was using EC2 VMs, it could be possible to get Admin privileges from the Node and recover the cluster.
Actually, If the cluster is using Fargate you could EC2 nodes or move everything to EC2 to the cluster and recover it accessing the tokens in the node.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
