How to Hack ArgoCD to Cluster Administrator

00:00 - Kubernetes
01:07 - Background on Kubernetes and GitHub
04:05 - Demo Explanation
07:29 - Hijack
12:04 - Escape
17:55 - Foreshadowing

🔥 YOUTUBE ALGORITHM ➡ Like, Comment, & Subscribe!

[randomone]

Real world issues, what a content from this guys 🔥

[vladoportos]

This whole depends on already having access to github first (inside job), and if you have that then argocd must be setup to automatically sync changes (hopefully no sane devops person does that for production ), then bad pod depends on ability to run privileged container what again should not be possible on configured cluster. Its basic escape from container via mounting the host os filesystem, something that works great on docker containers usually but kubernetes setup properly would not allow. Just set pod sec admission policy :)

[wearefiresidesessions]

You guys are so knowledgeable, if only I had that kind of knowledge. Just hearing about docker makes scared stiff. I'm really afraid of messing things up. Great video as usual!

[imoshtokill]

Great video! I'd love to have more context on how to remediate things like this in the future, maybe geared towards blue-teamers? Breaking stuff is definitely fun, but sometimes we gotta fix it too. :-p I'm also super glad you left a little troubleshooting in there! It helps set a realistic expectation of what working in tech (not just security) is like.

[crashtfa]

The problem with this is, if your k8s admins do not set the psp to deny privileged pods and deny mounting outside of a specific csi then you need to find a new admin as these are k8s security 101 as those two settings alone would stop this

[OleksaBaida]

@John Hammond is there a playlist for the series?

[karanb]

Nice Vid...If I could suggest a similar topic....so now what is happening is telecom providers are moving towards a containerized Core, probably using platforms like RHOCP. What could actually go wrong and how the security of these applications being spun up for telco are comprised, potentially revealing a lot of user related

[Mlynus]

Hey, as always awesome video. Do you know, by any chance, what's that autoprompt thing that Ignacio has in his Console? The one that is hinting the whole command just when he is starting writing?

[niffdjfm]

0:16 Carlos Polop isn't the guy on the right, he's the guy in the middle xD

[katendemusa]

Please do APIs. I would love to see how to hack APIs on a real webapp

[demotedcder]

Yo John, will u keep working with scammer payback? or that was it

[ultimate]

How does Ignacio has the biggest, proffessional looking mic, yet the quality is worse than my friends webcam-integrated mic over discord? 0.o