container_escape_audit.sh v4.8.2: check 30 expanded from 8 → 26 RBAC probes, closing every gap we…
Liam R. — Freelance Penetration Tester
container_escape_audit.sh v4.8.2:
check 30 expanded from 8 → 26 RBAC probes, closing every gap we identified:
* Escalation self-grant: escalate on roles/clusterroles, plus create clusterrolebindings and create rolebindings alongside the existing bind.
* Full impersonation set: impersonate groups (so system:masters = instant cluster-admin is now caught) and impersonate serviceaccounts, not just users.
* Node API: nodes/proxy (kubelet on every node).
* Workload-controller family: create/patch deployments, create statefulsets/replicasets/jobs/cronjobs/replicationcontrollers.
* Own-namespace pod creation (not just kube-system), plus the secondary set (get configmaps, pods/log, pods/portforward).
3 reactions · 0 comments