Direct syscalls let malware bypass userland EDR hooks by calling the Windows kernel directly. Instead of going through the heavily hooked ntdll.dll stubs, the implant builds its own clean syscall stub (mov r10, rcx; mov eax, SSN; syscall; ret).
Direct syscalls let malware bypass userland EDR hooks by calling the Windows kernel directly. Instead of going through the heavily hooked ntdll.dll stubs, the implant builds its own clean syscall stub (mov r10, rcx; mov eax, SSN; syscall; ret).
Exploit a misconfigured Kubernetes Dashboard to own the entire cluster. We abused cluster-admin privileges, deployed a live Sliver C2 beacon, and created a secret token for the SA.
Exploit etcd to exfiltrate cluster secrets. In Part Five we escalate from master access to dumping etcd and extracting tokens and credentials.
Abuse RBAC to compromise the master node. In Part Four, we escalate from container to cluster-admin and gain root access to the control plane.
Escape the container and dominate the Node. In Part Three, we chain an SSTI vulnerability with the –privileged flag to break out of the container and execute code directly on the host system.
Escape the container and compromise the Node. In Part Two, we exploit Docker socket misconfigurations to gain root access and demonstrate real-world container breakout techniques.
Discover how real adversaries target Kubernetes clusters. Learn key components, attack surfaces, and how manual testing reveals hidden risks..
Exploit a misconfigured Kubernetes Dashboard to own the entire cluster. We abused cluster-admin privileges, deployed a live Sliver C2 beacon, and created a secret token for the SA.
Exploit etcd to exfiltrate cluster secrets. In Part Five we escalate from master access to dumping etcd and extracting tokens and credentials.
Abuse RBAC to compromise the master node. In Part Four, we escalate from container to cluster-admin and gain root access to the control plane.
Escape the container and dominate the Node. In Part Three, we chain an SSTI vulnerability with the –privileged flag to break out of the container and execute code directly on the host system.
Escape the container and compromise the Node. In Part Two, we exploit Docker socket misconfigurations to gain root access and demonstrate real-world container breakout techniques.
Discover how real adversaries target Kubernetes clusters. Learn key components, attack surfaces, and how manual testing reveals hidden risks..
