Skip to content
Cloud & Containers
Cloud and identity tips.
-
Reach the node role from inside EKS or GKE
A pod without IMDS restrictions can grab the node instance role, which is usually far more privileged than the pod identity.
Cloud & Containers
-
Enumerate what a stolen AWS key can actually do
Before escalating, map the identity's real permissions with low-noise calls to avoid dead ends and access-denied storms.
Cloud & Containers
-
Read secrets from Terraform state
State files store resource attributes in clear, including passwords, keys, and tokens created during apply.
Cloud & Containers
-
Pivot with AWS SSM instead of SSH
With ssm:StartSession or SendCommand you get shells on instances without keys, ports, or touching the network.
Cloud & Containers
-
Find and take over dangling S3 references
Deleted buckets still referenced by a CNAME or app config can be re-created by anyone, yielding content control.
Cloud & Containers
-
Container breakout through a mounted docker socket
A container with /var/run/docker.sock can start a new privileged container that mounts the host root.
Cloud & Containers
-
Escape a privileged pod to the node
A privileged or hostPath-mounting pod is a foothold on the node; mount the host filesystem or use host namespaces.
Cloud & Containers
-
Abuse a mounted Kubernetes service account token
A shell in a pod usually has a service account token; check what it can do against the API before anything else.
Cloud & Containers
-
GCP privilege escalation with serviceAccounts.getAccessToken
iam.serviceAccounts.getAccessToken over a more privileged service account lets you mint its token and inherit its access.
Cloud & Containers
-
Harvest an Azure managed identity token from IMDS
On a compromised Azure VM or App Service, the metadata endpoint issues tokens for the attached identity.
Cloud & Containers