can-i gtfo?

Kubernetes RBAC Abuse Collection

View on GitHub

Filter by Abuse Type:

bind clusterroles

Bind cluster roles to users, groups, or service accounts

Privilege Escalation

bind roles

Bind roles to users, groups, or service accounts

Privilege Escalation

create cronjobs

Create CronJobs

Container Escape Lateral Movement

create daemonsets

Create DaemonSets

Container Escape Lateral Movement

create deployments

Create Deployments

Container Escape Lateral Movement

create jobs

Create Jobs

Container Escape Lateral Movement

create mutatingwebhookconfigurations

Create admission webhook configurations that mutate resource requests before they are persisted.

Privilege Escalation

create nodes/proxy

Allows to make CREATE requests to the kubelet API as system:masters

Lateral Movement

create pods/eviction

Evict a pod from a node

Lateral Movement

create pods/exec

Create exec sessions in running pods

Lateral Movement Denial of Service

create pods

Create new pods

Container Escape Lateral Movement

create replicasets

Create ReplicaSets

Container Escape Lateral Movement

create serviceaccounts/token

Create an authentication token for a service account

Privilege Escalation

create statefulsets

Create StatefulSets

Container Escape Lateral Movement

create validatingwebhookconfigurations

Create admission webhook configurations that validate resource requests before they are persisted.

Denial of Service Information Disclosure Persistence

delete mutatingwebhookconfigurations

Delete admission webhook configurations that mutate resource requests before they are persisted.

Privilege Escalation Container Escape Lateral Movement

delete nodes

Delete a node

Lateral Movement

delete pods

Delete a pod

Lateral Movement

get secrets

Delete specific secrets in Kubernetes

Denial of Service

delete validatingwebhookconfigurations

Delete admission webhook configurations that validate resource requests before they are persisted.

escalate clusterroles

Escalate permissions on Kubernetes cluster roles

Privilege Escalation

escalate roles

Escalate permissions on Kubernetes roles

Privilege Escalation

get nodes/proxy

Allows to make GET requests to the kubelet API as system:masters

Information Disclosure

get secrets

View specific secrets in Kubernetes

Information Disclosure

impersonate groups

Impersonate privileged groups like system:masters

Privilege Escalation

impersonate serviceaccounts

Impersonate service accounts in Kubernetes

Privilege Escalation

impersonate users

Impersonate other users in the Kubernetes cluster

Privilege Escalation

list secrets

List all secrets in Kubernetes namespaces

Information Disclosure

patch configmaps

Patch configmaps

Privilege Escalation

patch cronjobs

Patch existing CronJobs

Container Escape Lateral Movement

patch daemonsets

Patch existing DaemonSets

Container Escape Lateral Movement

patch deployments

Patch existing Deployments

Container Escape Lateral Movement

patch jobs

Patch existing Jobs

Container Escape Lateral Movement

patch mutatingwebhookconfigurations

Patch admission webhook configurations that mutate resource requests before they are persisted.

Privilege Escalation

patch nodes/status

Patch the status of nodes

Lateral Movement

patch nodes

Patch nodes

Lateral Movement

patch pods/ephemeralcontainers

Patch ephemeral containers in running pods for debugging and code execution

Container Escape Lateral Movement

patch pods/status

Modify the status of pods

Information Disclosure Lateral Movement

patch pods

Modify existing Kubernetes pods

Container Escape Lateral Movement

patch replicasets

Patch existing ReplicaSets

Container Escape Lateral Movement

patch secrets

Edit specific secrets in Kubernetes

Denial of Service

patch statefulsets

Patch existing StatefulSets

Container Escape Lateral Movement

patch validatingwebhookconfigurations

Patch admission webhook configurations that validate resource requests before they are persisted.

Persistence Information Disclosure Denial of Service

update configmaps

Update configmaps

Privilege Escalation

update cronjobs

Update existing Cronjobs

Container Escape Lateral Movement

update daemonsets

Update existing DaemonSets

Container Escape Lateral Movement

update deployments

Update existing Deployments

Container Escape Lateral Movement

update jobs

Update existing Jobs

Container Escape Lateral Movement

update mutatingwebhookconfigurations

Update admission webhook configurations that mutate resource requests before they are persisted.

Privilege Escalation

update nodes/status

Update the status of nodes

Lateral Movement

update nodes

Update nodes

Lateral Movement

update pods/ephemeralcontainers

Update ephemeral containers in running pods for debugging and code execution

Container Escape Lateral Movement

update pods/status

Update the status of pods

Information Disclosure Lateral Movement

update pods

Update existing Kubernetes pods

Container Escape Lateral Movement

update replicasets

Update existing ReplicaSets

Container Escape Lateral Movement

update secrets

Edit specific secrets in Kubernetes

Denial of Service

update statefulsets

Update existing StatefulSets

Container Escape Lateral Movement

update validatingwebhookconfigurations

Update admission webhook configurations that validate resource requests before they are persisted.

Persistence Information Disclosure Denial of Service

watch secrets

Monitor changes to secrets

Information Disclosure

61 entries total