### Install required binaries Source: https://kubehound.io/reference/attacks/ROLE_BIND Commands to install curl, jq, and the kubectl binary on a Linux system. ```bash ARCH=$(arch | sed s/aarch64/arm64/ | sed s/x86_64/amd64/) apt update && apt install -y curl jq && curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/arm64/kubectl" && chmod +x kubectl ``` -------------------------------- ### Install Tools with Homebrew (Mac) Source: https://kubehound.io/workshop Installs kubectl, kind, and docker using Homebrew on macOS. Ensure Homebrew is installed and updated before running. ```bash brew update && brew install kubectl, kind, docker ``` -------------------------------- ### Install containerd Source: https://kubehound.io/reference/attacks/POD_ATTACH Download and extract the containerd binaries if the tool is not already installed. Ensure you download the correct version for your system architecture. ```bash curl -L https://github.com/containerd/containerd/releases/download/v1.6.19/containerd-1.6.19-linux-arm64.tar.gz > containerd.tar.gz tar -xzf containerd.tar.gz ``` -------------------------------- ### Run KubeHound Source: https://kubehound.io/user-guide/getting-started Execute the KubeHound binary to start the application with default settings. ```bash kubehound ``` -------------------------------- ### Mount docker socket in alpine container Source: https://kubehound.io/reference/attacks/EXPLOIT_CONTAINERD_SOCK Example command to start an alpine container with the docker socket mounted as read-only for testing purposes. ```bash # Create an alpine container with the docker socket mounted as readonly docker run -v /var/run/docker.sock:/var/run/docker.sock:ro --rm -it alpine sh # Within the alpine container execute a docker command docker ps ``` -------------------------------- ### Example Process Output Source: https://kubehound.io/reference/attacks/SHARE_PS_NAMESPACE Expected output showing processes from other containers when sharing a namespace. ```text PID USER TIME COMMAND 1 root 0:00 /pause 8 root 0:00 nginx: master process nginx -g daemon off; 14 101 0:00 nginx: worker process 15 root 0:00 sh 21 root 0:00 ps ax ``` -------------------------------- ### Install KubeHound with Homebrew Source: https://kubehound.io/workshop Installs KubeHound using Homebrew. This is a convenient method for macOS users. ```bash brew update && brew install kubehound ``` -------------------------------- ### Start KubeHound backend Source: https://kubehound.io/user-guide/common-operations Initializes the required Docker containers for the KubeHound stack using default images. ```bash kubehound backend up ``` -------------------------------- ### KubeHound Execution Output Source: https://kubehound.io/user-guide/getting-started Example console output showing the initialization, ingestion, and graph construction process. ```text ./kubehound INFO[01:42:19] Loading application configuration from default embedded WARN[01:42:19] No local config file was found (kubehound.yaml) INFO[01:42:19] Using /home/datadog/kubehound for default config INFO[01:42:19] Initializing application telemetry WARN[01:42:19] Telemetry disabled via configuration INFO[01:42:19] Loading backend from default embedded WARN[01:42:19] Loading the kubehound images with tag latest - dev branch detected INFO[01:42:19] Spawning the kubehound stack [+] Running 3/3 ✔ Container kubehound-release-kubegraph-1 Healthy 50.3s ✔ Container kubehound-release-ui-jupyter-1 Healthy 50.3s ✔ Container kubehound-release-mongodb-1 Healthy 58.4s INFO[01:43:20] Starting KubeHound (run_id: 01j4fwbg88j6eptasgegdh2sgs) INFO[01:43:20] Initializing providers (graph, cache, store) INFO[01:43:20] Loading cache provider INFO[01:43:20] Loaded memcache cache provider INFO[01:43:20] Loading store database provider INFO[01:43:20] Loaded mongodb store provider INFO[01:43:21] Loading graph database provider INFO[01:43:21] Loaded janusgraph graph provider INFO[01:43:21] Running the ingestion pipeline INFO[01:43:21] Loading Kubernetes data collector client WARN[01:43:21] About to dump k8s cluster: "kind-kubehound.test.local" - Do you want to continue ? [Yes/No] yes INFO[01:43:30] Loaded k8s-api-collector collector client INFO[01:43:30] Starting Kubernetes raw data ingest INFO[01:43:30] Loading data ingestor INFO[01:43:30] Running dependency health checks INFO[01:43:30] Running data ingest and normalization INFO[01:43:30] Starting ingest sequences INFO[01:43:30] Waiting for ingest sequences to complete INFO[01:43:30] Running ingestor sequence core-pipeline INFO[01:43:30] Starting ingest sequence core-pipeline INFO[01:43:30] Running ingest group k8s-role-group INFO[01:43:30] Starting k8s-role-group ingests INFO[01:43:30] Waiting for k8s-role-group ingests to complete INFO[01:43:30] Running ingest k8s-role-ingest INFO[01:43:30] Running ingest k8s-cluster-role-ingest INFO[01:43:30] Streaming data from the K8s API INFO[01:43:32] Completed k8s-role-group ingest INFO[01:43:32] Finished running ingest group k8s-role-group ... INFO[01:43:35] Completed k8s-pod-group ingest INFO[01:43:35] Finished running ingest group k8s-pod-group INFO[01:43:35] Completed ingest sequence core-pipeline INFO[01:43:35] Completed pipeline ingest INFO[01:43:35] Completed data ingest and normalization in 5.065238542s INFO[01:43:35] Loading graph edge definitions INFO[01:43:35] Loading graph builder INFO[01:43:35] Running dependency health checks INFO[01:43:35] Constructing graph WARN[01:43:35] Using large cluster optimizations in graph construction INFO[01:43:35] Starting mutating edge construction INFO[01:43:35] Building edge PodCreate INFO[01:43:36] Edge writer 10 PodCreate::POD_CREATE written INFO[01:43:36] Building edge PodExec ... INFO[01:43:36] Starting dependent edge construction INFO[01:43:36] Building edge ContainerEscapeVarLogSymlink INFO[01:43:36] Edge writer 5 ContainerEscapeVarLogSymlink::CE_VAR_LOG_SYMLINK written INFO[01:43:36] Completed edge construction INFO[01:43:36] Completed graph construction in 773.2935ms INFO[01:43:36] Stats for the run time duration: 5.838839708s / wait: 5.926496s / throttling: 101.501262% INFO[01:43:36] KubeHound run (id=01j4fwbg88j6eptasgegdh2sgs) complete in 15.910406167s WARN[01:43:36] KubeHound as finished ingesting and building the graph successfully. WARN[01:43:36] Please visit the UI to view the graph by clicking the link below: WARN[01:43:36] http://localhost:8888 WARN[01:43:36] Password being 'admin' ``` -------------------------------- ### Download and Install KubeHound Source: https://kubehound.io/workshop Downloads the latest KubeHound release for Linux and makes it executable. This command is for manual installation when not using Homebrew. ```bash wget https://github.com/DataDog/KubeHound/releases/latest/download/kubehound-$(uname -o | sed 's/GNU\///g')-$(uname -m) -O kubehound chmod +x kubehound ``` -------------------------------- ### Deploy Local Kind Cluster Source: https://kubehound.io/dev-guide/testing Set up the local Kubernetes cluster using Kind. This command only needs to be run once for the initial setup. ```bash make local-cluster-deploy ``` -------------------------------- ### CriticalPathsFreq Usage Examples Source: https://kubehound.io/queries/dsl Examples showing how to invoke criticalPathsFreq on services or specific groups with hop constraints. ```java // Most common critical paths from services kh.services().criticalPathsFreq() // Most common critical paths from a compromised engineer credential of up to 4 hops kh.group("engineering").criticalPathsFreq(4) ``` -------------------------------- ### Manage KubeHound development stack Source: https://kubehound.io/dev-guide/getting-started Commands to start, extend, or tear down the local development environment. ```bash kubehound dev --ui ``` ```bash kubehound dev --down ``` -------------------------------- ### Install GDB Debugger Source: https://kubehound.io/reference/attacks/CE_SYS_PTRACE Install the GNU Debugger (GDB) within the container, which is necessary for attaching to and manipulating host processes. ```bash apt update && apt install gdb ``` -------------------------------- ### Helm Install for KubeHound on Kubernetes Source: https://kubehound.io/khaas/deployment Deploy KubeHound as a Service on Kubernetes using the provided Helm chart. This command installs the 'khaas' release in the 'khaas' namespace. ```bash cd ./deployments/k8s helm install khaas khaas --namespace khaas --create-namespace ``` -------------------------------- ### KubeHound DSL Basic Usage Source: https://kubehound.io/queries/dsl Demonstrates the basic usage of the KubeHound DSL by starting a traversal with `kh`. ```APIDOC ## Basic KubeHound DSL Usage ### Description This example shows how to start a traversal using the KubeHound DSL, which prefixes Gremlin queries with `kh`. ### Method N/A (DSL Usage) ### Endpoint N/A (DSL Usage) ### Request Example ```groovy // First 100 vertices in the kubehound graph kh.V().limit(100) ``` ### Response Example N/A (Gremlin query result) ``` -------------------------------- ### Install crictl for debugging Source: https://kubehound.io/reference/attacks/EXPLOIT_CONTAINERD_SOCK Commands to download and extract the crictl CLI tool for interacting with the container runtime. ```bash apt update && apt install -f wget tar wget https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.27.0/crictl-v1.27.0-linux-amd64.tar.gz -O /tmp/crictl.tar.gz tar xvf /tmp/crictl.tar.gz -C /tmp ``` -------------------------------- ### Set up System Test Environment Source: https://kubehound.io/dev-guide/testing Configure the KUBECONFIG environment variable to point to the system test setup. This is necessary for manual access to the test environment using kubectl and other commands. ```bash cd test/setup/ && export KUBECONFIG=$(pwd)/.kube-config ``` -------------------------------- ### Create Pod Patch File Source: https://kubehound.io/reference/attacks/POD_PATCH Create a YAML file to specify the changes for patching a pod. This example targets the container image. ```yaml spec: containers: - name: image: kalilinux/kali-last-release ``` -------------------------------- ### Authenticate to Kubelet or Kubernetes API using Kubelet PKI Source: https://kubehound.io/reference/attacks/IDENTITY_ASSUME Utilize Kubelet PKI certificates to authenticate to either the Kubelet API or the main Kubernetes API. This example shows querying pods via the Kubelet API. ```bash curl -k --cacert $NODE_ROOT/etc/kubernetes/pki/ca.crt --key $NODE_ROOT/var/lib/kubelet/pki/kubelet-client-current.pem --cert {$NODE_ROOT}/var/lib/kubelet/pki/kubelet-client-current.pem https://${NODE_IP}:10250/pods/ ``` -------------------------------- ### Check if ctr utility is installed Source: https://kubehound.io/reference/attacks/POD_ATTACH Ensure the `ctr` utility is installed on the node, which is required for interacting directly with containerd. ```bash which ctr ``` -------------------------------- ### Traversal Source Reference: Run Step Source: https://kubehound.io/queries/dsl Documentation for the `run` step in the Traversal Source, used to start traversals from specific KubeHound run IDs. ```APIDOC ## Traversal Source Reference: Run Step ### Description Starts a traversal that finds all vertices associated with the specified KubeHound run ID(s). ### Method Signature ```java GraphTraversal run(String... ids) ``` ### Parameters - **ids** (String...) - Required - One or more KubeHound run IDs. ### Request Example ```groovy // All vertices in the graph from a single run kh.run("01he5ebh73tah762qgdd5k4wqp") // All vertices in the graph from multiple runs kh.run("01he5ebh73tah762qgdd5k4wqp", "01he5eagzbnhtfnwzg7xxbyfz4") // All containers in the graph from a single run kh.run("01he5ebh73tah762qgdd5k4wqp").containers() ``` ### Response Example N/A (Gremlin query result) ``` -------------------------------- ### Example attack path grouping output Source: https://kubehound.io/queries/metrics Sample JSON output representing the frequency of different attack path sequences. ```JSON { "path[Endpoint, ENDPOINT_EXPLOIT, Container, IDENTITY_ASSUME, Identity, PERMISSION_DISCOVER, PermissionSet]" : 6, "path[Endpoint, ENDPOINT_EXPLOIT, Container, VOLUME_DISCOVER, Volume, TOKEN_STEAL, Identity, PERMISSION_DISCOVER, PermissionSet]" : 6, "path[Endpoint, ENDPOINT_EXPLOIT, Container, CE_NSENTER, Node, IDENTITY_ASSUME, Identity, PERMISSION_DISCOVER, PermissionSet]" : 1, "path[Endpoint, ENDPOINT_EXPLOIT, Container, CE_MODULE_LOAD, Node, IDENTITY_ASSUME, Identity, PERMISSION_DISCOVER, PermissionSet]" : 1, "path[Endpoint, ENDPOINT_EXPLOIT, Container, CE_PRIV_MOUNT, Node, IDENTITY_ASSUME, Identity, PERMISSION_DISCOVER, PermissionSet]" : 1 } ``` -------------------------------- ### Filter Initial Elements by Namespace Source: https://kubehound.io/queries/gremlin To avoid generating excessive results, filter the initial elements of queries by namespace, service, or application. This example filters containers by namespace. ```gremlin g.V().has("class","Container").has("namespace", "your-namespace") ``` -------------------------------- ### HostMounts API Source: https://kubehound.io/queries/dsl Starts a traversal that finds all vertices representing volume host mounts and optionally allows filtering of those vertices on the "sourcePath" property. ```APIDOC ## HostMounts Step ### Description Starts a traversal that finds all vertices representing volume host mounts and optionally allows filtering of those vertices on the "sourcePath" property. ### Method GET (Implied by traversal) ### Endpoint / ### Parameters #### Query Parameters - **sourcePaths** (String...) - Optional - Filters host mounts by their source paths. ### Request Example ```java // All host mounted volumes in the graph kh.hostMounts() // All host mount volumes in the graph with source path filter kh.hostMounts("/", "/proc") // All host mount volumes in the graph with additional filters kh.hostMounts().has("app", "web-app").limit(10) ``` ### Response #### Success Response (200) - **Vertex** - Represents a host mount vertex in the graph. #### Response Example ```json { "example": "[Vertex object representing a host mount]" } ``` ``` -------------------------------- ### Verify KubeHound Deployment on Kubernetes Source: https://kubehound.io/khaas/deployment List deployed Helm releases to verify the successful installation of KubeHound on Kubernetes. This command shows the status and details of the 'khaas' deployment. ```bash $ helm ls -A NAME NAMESPACE REVISION UPDATED STATUS CHART APP VERSION khaas khaas 1 2024-07-30 19:04:37.0575 +0200 CEST deployed kubehound-0.0.1 ``` -------------------------------- ### Services API Source: https://kubehound.io/queries/dsl Starts a traversal that finds all vertices with a "Endpoint" label representing K8s services. ```APIDOC ## Services Step ### Description Starts a traversal that finds all vertices with an "Endpoint" label representing K8s services. ### Method GET (Implied by traversal) ### Endpoint / ### Parameters #### Query Parameters - **portNames** (String...) - Optional - Filters services by their port names. ### Request Example ```java // All services in the graph kh.services() // All services in the graph with name filter kh.services("jmx", "redis") // All services in the graph with additional filters kh.services().has("port", 9999).limit(10) ``` ### Response #### Success Response (200) - **Vertex** - Represents a Service vertex in the graph. #### Response Example ```json { "example": "[Vertex object representing a Service]" } ``` ``` -------------------------------- ### Limit Query Output for UI Performance Source: https://kubehound.io/queries/gremlin When examining graph output in the UI, use `limit()` to prevent overloading. This example limits the search for attack paths from a sample of 5 containers. ```gremlin g.V().has("class","Container").limit(5).outE() ``` -------------------------------- ### Get Users Traversal Source: https://kubehound.io/queries/dsl Starts a traversal to find all vertices representing users. Optionally filters by user names. ```java GraphTraversal users(String... names) ``` ```java // All users in the graph kh.users() ``` ```java // All users in the graph with name filter kh.users("postgres-admin", "db-reader") ``` ```java // All users in the graph with additional filters kh.users().has("app", "web-app").limit(10) ``` -------------------------------- ### Get Identities Traversal Source: https://kubehound.io/queries/dsl Starts a traversal to find all vertices with an "Identity" label. Optionally filters by identity names. ```java GraphTraversal identities(String... names) ``` ```java // All identities in the graph kh.identities() ``` ```java // All identities in the graph with name filter kh.identities("postgres-admin", "db-reader") ``` ```java // All identities in the graph with additional filters kh.identities().has("app", "web-app").limit(10) ``` -------------------------------- ### Get Volumes Traversal Source: https://kubehound.io/queries/dsl Starts a traversal to find all vertices with a "Volume" label. Optionally filters by volume names. ```java GraphTraversal volumes(String... names) ``` ```java // All volumes in the graph kh.volumes() ``` ```java // All volumes in the graph with name filter kh.volumes("db-data", "proc-mount") ``` ```java // All volumes in the graph with additional filters kh.volumes().has("sourcePath", "/").has("app", "web-app") ``` -------------------------------- ### Get Nodes Traversal Source: https://kubehound.io/queries/dsl Starts a traversal to find all vertices with a "Node" label. Optionally filters by node names. ```java GraphTraversal nodes(String... names) ``` ```java // All nodes in the graph kh.nodes() ``` ```java // All nodes in the graph with name filter kh.nodes("control-plane") ``` ```java // All nodes in the graph with additional filters kh.nodes().has("team", "sre").limit(10) ``` -------------------------------- ### Get Pods Traversal Source: https://kubehound.io/queries/dsl Starts a traversal to find all vertices with a "Pod" label. Optionally filters by pod names. ```java GraphTraversal pods(String... names) ``` ```java // All pods in the graph kh.pods() ``` ```java // All pod in the graph with name filter kh.pods("app-pod", "sidecar-pod") ``` ```java // All pods in the graph with additional filters kh.pods().has("namespace", "ns1").limit(10) ``` -------------------------------- ### Generate KubeHound website locally Source: https://kubehound.io/dev-guide/wiki Use this command to build the documentation site on your local machine. ```makefile make local-wiki ``` -------------------------------- ### Basic KubeHound Traversal Source: https://kubehound.io/queries/dsl Demonstrates the entry point for KubeHound queries using the kh traversal source. ```Gremlin // First 100 vertices in the kubehound graph kh.V().limit(100) ``` -------------------------------- ### List supported build platforms Source: https://kubehound.io/dev-guide/getting-started Prints the platforms supported by the binary-cross build target. ```bash docker buildx bake binary-cross --print | jq -cr '.target."binary-cross".platforms' ``` -------------------------------- ### Build KubeHound binary from source Source: https://kubehound.io/dev-guide/getting-started Compiles the KubeHound binary locally. Ensure you are on a release tag before building. ```bash # Ensure you are pulling a release tag git checkout tags/vX.X.X # Build the binary make build ``` -------------------------------- ### Build KubeHound from source Source: https://kubehound.io/user-guide/advanced-configuration Commands to clone the repository and compile the binary using the provided makefile. ```bash git clone https://github.com/DataDog/KubeHound.git cd KubeHound make build ``` -------------------------------- ### Get Kubernetes EndpointSlices Source: https://kubehound.io/reference/attacks/ENDPOINT_EXPLOIT Use `kubectl get endpointslices` to query endpoints exposed outside the cluster. This command lists EndpointSlices, which represent network endpoints. ```bash kubectl get endpointslices ``` -------------------------------- ### Check Kubelet Configuration on Node Source: https://kubehound.io/reference/attacks/IDENTITY_ASSUME Examine the Kubelet configuration file on a node to find paths to Kubelet user certificates. These certificates can be used to impersonate the node user. ```bash cat $NODE_ROOT/etc/kubernetes/kubelet.conf ``` ```yaml users: - name: default-auth user: client-certificate: /var/lib/kubelet/pki/kubelet-client-current.pem client-key: /var/lib/kubelet/pki/kubelet-client-current.pem ``` -------------------------------- ### Endpoints API Source: https://kubehound.io/queries/dsl Starts a traversal that finds all vertices with a "Endpoint" label. ```APIDOC ## Endpoints Step ### Description Starts a traversal that finds all vertices with an "Endpoint" label. ### Method GET (Implied by traversal) ### Endpoint / ### Parameters #### Query Parameters - **exposure** (EndpointExposure) - Optional - Filters endpoints by their exposure type (e.g., External). ### Request Example ```java // All endpoints in the graph kh.endpoints() // All endpoints in the graph with additional filters kh.endpoints().has("port", 3000).limit(10) // All endpoints with K8s service exposure kh.endpoints(EndpointExposure.External) ``` ### Response #### Success Response (200) - **Vertex** - Represents an Endpoint vertex in the graph. #### Response Example ```json { "example": "[Vertex object representing an Endpoint]" } ``` ``` -------------------------------- ### Locate built binary Source: https://kubehound.io/user-guide/advanced-configuration The path to the executable after a successful build. ```text bin/build/kubehound ``` -------------------------------- ### Get Endpoints Traversal Source: https://kubehound.io/queries/dsl Finds all vertices with an "Endpoint" label. Can be filtered by exposure type. ```java GraphTraversal endpoints() ``` ```java GraphTraversal endpoints(EndpointExposure exposure) ``` ```java // All endpoints in the graph kh.endpoints() ``` ```java // All endpoints in the graph with additional filters kh.endpoints().has("port", 3000).limit(10) ``` ```java // All endpoints with K8s service exposure kh.endpoints(EndpointExposure.External) ``` -------------------------------- ### Check Pod Creation Permissions Source: https://kubehound.io/reference/attacks/POD_CREATE Use this command to verify if your current account has the necessary permissions to create pods in the cluster. ```bash kubectl auth can-i create pod ``` -------------------------------- ### Count Pods in Cluster Source: https://kubehound.io/queries/gremlin Use this query to get the total number of pods present in the Kubernetes cluster. ```gremlin g.V().has("class","Pod").count() ``` -------------------------------- ### Initiate KubeHound Image Download Source: https://kubehound.io/workshop Downloads necessary Docker images for KubeHound, including Jupyter and Janusgraph. Run this command from the KubeHound directory. ```bash ./kubehound ``` -------------------------------- ### Run Unit Tests Source: https://kubehound.io/dev-guide/testing Execute the complete suite of unit tests for KubeHound. Ensure your environment meets the specified Golang version. ```bash make test ``` -------------------------------- ### List Makefile commands Source: https://kubehound.io/dev-guide/getting-started Displays all available developer commands defined in the project Makefile. ```bash make help ``` -------------------------------- ### Handle crictl execution errors Source: https://kubehound.io/reference/attacks/EXPLOIT_CONTAINERD_SOCK Example of a fatal error message encountered when the -s flag is omitted during execution. ```text FATA[0000] execing command in container: error sending request: Post "http://127.0.0.1:41903/exec/PUpJoUv0": dial tcp 127.0.0.1:41903: connect: connection refused ``` -------------------------------- ### Configure backend with overrides Source: https://kubehound.io/user-guide/common-operations Customizes Docker images and registry settings using a docker-compose.overrides.yaml file. ```yaml name: kubehound-release services: mongodb: image: your.registry.tld/mongo/mongo:6.0.6 ports: - "127.0.0.1:27017:27017" kubegraph: image: your.registry.tld/datadog/kubehound-graph:my-specific-tag ports: - "127.0.0.1:8182:8182" - "127.0.0.1:8099:8099" ui-jupyter: image: your.registry.tld/datadog/kubehound-ui:my-specific-tag ui-invana-engine: image: your.registry.tld/invanalabs/invana-engine:latest ui-invana-studio: image: your.registry.tld/invanalabs/invana-studio:latest ``` ```bash kubehound backend up -f docker-compose.overrides.yml ``` -------------------------------- ### Get HostMounts Traversal Source: https://kubehound.io/queries/dsl Finds vertices representing volume host mounts. Optionally filters by source path. ```java GraphTraversal hostMounts(String... sourcePaths) ``` ```java // All host mounted volumes in the graph kh.hostMounts() ``` ```java // All host mount volumes in the graph with source path filter kh.hostMounts("/", "/proc") ``` ```java // All host mount volumes in the graph with additional filters kh.hostMounts().has("app", "web-app").limit(10) ``` -------------------------------- ### Get Service Accounts Traversal Source: https://kubehound.io/queries/dsl Finds vertices representing service accounts. Optionally filters by service account names. ```java GraphTraversal sas(String... names) ``` ```java // All service accounts in the graph kh.sas() ``` ```java // All service accounts in the graph with name filter kh.sas("postgres-admin", "db-reader") ``` ```java // All service accounts in the graph with additional filters kh.sas().has("app", "web-app").limit(10) ``` -------------------------------- ### Configure Docker and Kind Commands Source: https://kubehound.io/dev-guide/testing Override the default behavior for Docker and Kind commands if you wish to avoid using sudo. Modify the specified variables in the test/setup/.config file. ```bash * `DOCKER_CMD="docker"` for docker command * `KIND_CMD="kind"` for kind command ``` -------------------------------- ### Get Escapes Traversal Source: https://kubehound.io/queries/dsl Finds container escape edges from a Container vertex to a Node vertex. Optionally filters by node names. ```java GraphTraversal escapes(String... nodeNames) ``` ```java // All container escapes in the graph kh.escapes() ``` ```java // All container escapes in the graph with node name filter kh.escapes("control-plane") ``` -------------------------------- ### Check Kubelet Certificate Accessibility on Node Source: https://kubehound.io/reference/attacks/IDENTITY_ASSUME Verify if the Kubelet client certificates are accessible on the node's file system. This is a prerequisite for using them to authenticate. ```bash ls -la $NODE_ROOT/var/lib/kubelet/pki/kubelet-client-current.pem ``` -------------------------------- ### Traversal Source Reference: Cluster Step Source: https://kubehound.io/queries/dsl Documentation for the `cluster` step in the Traversal Source, used to start traversals from specific clusters. ```APIDOC ## Traversal Source Reference: Cluster Step ### Description Starts a traversal that finds all vertices belonging to the specified cluster(s). ### Method Signature ```java GraphTraversal cluster(String... names) ``` ### Parameters - **names** (String...) - Required - One or more cluster names. ### Request Example ```groovy // All vertices in the graph from the kind-kubehound.local cluster kh.cluster("kind-kubehound.local") // All containers in the graph from the kind-kubehound.local cluster kh.cluster("kind-kubehound.local").containers() ``` ### Response Example N/A (Gremlin query result) ``` -------------------------------- ### Run KubeHound Dump and Ingest Source: https://kubehound.io/khaas/getting-started Execute the KubeHound dump command to collect Kubernetes resources, compress them, and push to cloud storage. Then, send a gRPC call to the KHaaS endpoint for ingestion. ```bash kubehound dump remote ``` -------------------------------- ### Generate Sample KubeHound Data Source: https://kubehound.io/user-guide/getting-started Use this command to spin up a temporary local kind cluster, run KubeHound on it, and then destroy the cluster. This is useful if you do not have a cluster readily available. ```bash make sample-graph ``` -------------------------------- ### Get Services Traversal Source: https://kubehound.io/queries/dsl Finds vertices representing K8s services (labeled as "Endpoint"). Optionally filters by port names. ```java GraphTraversal services(String... portNames) ``` ```java // All services in the graph kh.services() ``` ```java // All services in the graph with name filter kh.services("jmx", "redis") ``` ```java // All services in the graph with additional filters kh.services().has("port", 9999).limit(10) ``` -------------------------------- ### Users API Source: https://kubehound.io/queries/dsl Starts a traversal that finds all vertices representing users and optionally allows filtering of those vertices on the "name" property. ```APIDOC ## Users Step ### Description Starts a traversal that finds all vertices representing users and optionally allows filtering of those vertices on the "name" property. ### Method GET (Implied by traversal) ### Endpoint / ### Parameters #### Query Parameters - **names** (String...) - Optional - Filters users by their names. ### Request Example ```java // All users in the graph kh.users() // All users in the graph with name filter kh.users("postgres-admin", "db-reader") // All users in the graph with additional filters kh.users().has("app", "web-app").limit(10) ``` ### Response #### Success Response (200) - **Vertex** - Represents a User vertex in the graph. #### Response Example ```json { "example": "[Vertex object representing a User]" } ``` ``` -------------------------------- ### Inspect directory structure Source: https://kubehound.io/reference/attacks/CE_VAR_LOG_SYMLINK Examine the contents of the mounted log directory to confirm access to host paths. ```bash ls -la /host/var/log total 24 drwxr-xr-x 5 root root 4096 Mar 2 09:49 . drwxr-xr-x 3 root root 4096 Mar 8 10:31 .. -rw-r--r-- 1 root root 775 Mar 4 18:13 alternatives.log drwxr-xr-x 2 root root 4096 Mar 8 10:46 containers drwxr-xr-x 3 root root 4096 Mar 2 09:49 kubernetes drwxr-xr-x 8 root root 4096 Mar 8 10:31 pods ls -la /host/var/log/pods total 32 drwxr-xr-x 8 root root 4096 Mar 8 10:31 . drwxr-xr-x 5 root root 4096 Mar 2 09:49 .. drwxr-xr-x 3 root root 4096 Mar 8 10:31 default_log-escape-pod_f262a349-c3bb-4561-9496-c3182f8d1256 ``` -------------------------------- ### Destroy Local Kind Cluster Source: https://kubehound.io/dev-guide/testing Clean up the testing environment by destroying the Kind cluster. This command removes all resources created during the test setup. ```bash make local-cluster-destroy ``` -------------------------------- ### Create symlink for exploitation Source: https://kubehound.io/reference/attacks/CE_VAR_LOG_SYMLINK Create a symlink in the mounted log directory to point to the host root filesystem. ```bash ln -s / /host/var/log/root_link ``` -------------------------------- ### Deploy Local Development Cluster Source: https://kubehound.io/workshop Clones the KubeHound repository and deploys a local development cluster using make. Navigate to the cloned directory before running. ```bash cd $HOME git clone https://github.com/DataDog/KubeHound.git cd kubehound make local-cluster-deploy ``` -------------------------------- ### Groups Step API Source: https://kubehound.io/queries/dsl Starts a traversal that finds all vertices representing groups and optionally allows filtering of those vertices on the "name" property. ```APIDOC ## Groups Step ### Description Starts a traversal that finds all vertices representing groups and optionally allows filtering of those vertices on the "name" property. ### Method Not specified (assumed to be part of a larger traversal object) ### Endpoint Not specified ### Parameters #### Path Parameters None #### Query Parameters None #### Request Body None ### Request Example ```java // All groups in the graph kh.groups() // All groups in the graph with name filter kh.groups("postgres-admin", "db-reader") // All groups in the graph with additional filters kh.groups().has("app", "web-app").limit(10) ``` ### Response #### Success Response (200) - **GraphTraversal** - A traversal object representing the found groups. #### Response Example (No specific response example provided, depends on traversal results) ``` -------------------------------- ### Check Host Volume Mount for Pod Tokens Source: https://kubehound.io/reference/attacks/TOKEN_STEAL Inspect a host volume mount to determine if it provides access to other pods' service account tokens. This is crucial for assessing lateral movement possibilities. ```bash ls -la //var/lib/kubelet/pods/ ``` -------------------------------- ### Identities API Source: https://kubehound.io/queries/dsl Starts a traversal that finds all vertices with a "Identity" label and optionally allows filtering of those vertices on the "name" property. ```APIDOC ## Identities Step ### Description Starts a traversal that finds all vertices with an "Identity" label and optionally allows filtering of those vertices on the "name" property. ### Method GET (Implied by traversal) ### Endpoint / ### Parameters #### Query Parameters - **names** (String...) - Optional - Filters identities by their names. ### Request Example ```java // All identities in the graph kh.identities() // All identities in the graph with name filter kh.identities("postgres-admin", "db-reader") // All identities in the graph with additional filters kh.identities().has("app", "web-app").limit(10) ``` ### Response #### Success Response (200) - **Vertex** - Represents an Identity vertex in the graph. #### Response Example ```json { "example": "[Vertex object representing an Identity]" } ``` ``` -------------------------------- ### Check Mounted Volumes using /proc/self/mounts Source: https://kubehound.io/reference/attacks/VOLUME_DISCOVER Use the 'cat /proc/self/mounts' command to inspect the contents of the /proc/self/mounts file, which lists all mounted filesystems within the container. This is a fundamental way to identify available volumes. ```bash cat /proc/self/mounts ``` -------------------------------- ### Exploit host filesystem traversal Source: https://kubehound.io/reference/attacks/EXPLOIT_HOST_TRAVERSE Commands to list pod directories and locate token files when the host filesystem is mounted. ```bash ls /host/var/lib/kubelet/pods/0dc76586-c18c-4db6-b5f2-019f270d3621 # containers etc-hosts plugins volume-subpaths volumes find /host/var/lib/kubelet/pods/ -name token -type l 2>/dev/null #/host/var/lib/kubelet/pods/5a9fc508-8410-444a-bf63-9f11e5979bee/volumes/kubernetes.io~projected/kube-api-access-225d6/token #/host/var/lib/kubelet/pods/a1176593-34a2-43e6-8bdd-ed10fa148fe7/volumes/kubernetes.io~projected/kube-api-access-ng6px/token #/host/var/lib/kubelet/pods/10b90d62-6b16-4aa7-9e72-75f18dcca5a8/volumes/kubernetes.io~projected/kube-api-access-j7dsp/token #/host/var/lib/kubelet/pods/dfbf38ad-2e92-44e0-b05b-8859350b6ea5/volumes/kubernetes.io~projected/kube-api-access-c89ff/token ``` -------------------------------- ### Volumes API Source: https://kubehound.io/queries/dsl Starts a traversal that finds all vertices with a "Volume" label and optionally allows filtering of those vertices on the "name" property. ```APIDOC ## Volumes Step ### Description Starts a traversal that finds all vertices with a "Volume" label and optionally allows filtering of those vertices on the "name" property. ### Method GET (Implied by traversal) ### Endpoint / ### Parameters #### Query Parameters - **names** (String...) - Optional - Filters volumes by their names. ### Request Example ```java // All volumes in the graph kh.volumes() // All volumes in the graph with name filter kh.volumes("db-data", "proc-mount") // All volumes in the graph with additional filters kh.volumes().has("sourcePath", "/").has("app", "web-app") ``` ### Response #### Success Response (200) - **Vertex** - Represents a Volume vertex in the graph. #### Response Example ```json { "example": "[Vertex object representing a Volume]" } ``` ``` -------------------------------- ### Nodes API Source: https://kubehound.io/queries/dsl Starts a traversal that finds all vertices with a "Node" label and optionally allows filtering of those vertices on the "name" property. ```APIDOC ## Nodes Step ### Description Starts a traversal that finds all vertices with a "Node" label and optionally allows filtering of those vertices on the "name" property. ### Method GET (Implied by traversal) ### Endpoint / ### Parameters #### Query Parameters - **names** (String...) - Optional - Filters nodes by their names. ### Request Example ```java // All nodes in the graph kh.nodes() // All nodes in the graph with name filter kh.nodes("control-plane") // All nodes in the graph with additional filters kh.nodes().has("team", "sre").limit(10) ``` ### Response #### Success Response (200) - **Vertex** - Represents a Node vertex in the graph. #### Response Example ```json { "example": "[Vertex object representing a Node]" } ``` ``` -------------------------------- ### Check RBAC permissions with can-i Source: https://kubehound.io/reference/attacks/ROLE_BIND Demonstrates using the kubectl auth can-i command to verify permissions for cluster-scoped resources, noting that the API may return 'yes' even for invalid configurations. ```bash root@rolebind-pod-rb-r-crb-cr-fail:/# ./kubectl auth can-i create clusterrolebindin Warning: resource 'clusterbindings' is not namespace scoped in group 'rbac.authorization.k8s.io' yes root@rolebind-pod-rb-r-crb-cr-fail:/# ./kubectl auth can-i bind clusterrole Warning: resource 'clusterroles' is not namespace scoped in group 'rbac.authorization.k8s.io' yes ``` -------------------------------- ### Detect hostPID activation Source: https://kubehound.io/reference/attacks/CE_NSENTER Check for the presence of the kubelet binary running from within a container to identify if hostPID is enabled. ```bash ps -ef | grep kubelet ``` -------------------------------- ### Pods API Source: https://kubehound.io/queries/dsl Starts a traversal that finds all vertices with a "Pod" label and optionally allows filtering of those vertices on the "name" property. ```APIDOC ## Pods Step ### Description Starts a traversal that finds all vertices with a "Pod" label and optionally allows filtering of those vertices on the "name" property. ### Method GET (Implied by traversal) ### Endpoint / ### Parameters #### Query Parameters - **names** (String...) - Optional - Filters pods by their names. ### Request Example ```java // All pods in the graph kh.pods() // All pod in the graph with name filter kh.pods("app-pod", "sidecar-pod") // All pods in the graph with additional filters kh.pods().has("namespace", "ns1").limit(10) ``` ### Response #### Success Response (200) - **Vertex** - Represents a Pod vertex in the graph. #### Response Example ```json { "example": "[Vertex object representing a Pod]" } ``` ``` -------------------------------- ### Configure crictl runtime endpoint Source: https://kubehound.io/reference/attacks/EXPLOIT_CONTAINERD_SOCK Create a configuration file for crictl pointing to the mounted socket path and set an alias for easier execution. ```bash MOUNTED_SOCK_PATH=/host/run/containerd/containerd.sock echo "runtime-endpoint: unix://${MOUNTED_SOCK_PATH} image-endpoint: unix://${MOUNTED_SOCK_PATH} debug: false" > /tmp/crictl.yaml && alias cc='/tmp/crictl --config /tmp/crictl.yaml' ``` -------------------------------- ### Check Secret Access Permissions with Kubectl Source: https://kubehound.io/reference/attacks/TOKEN_BRUTEFORCE Use this command to verify if your current role allows 'get' access to secrets in Kubernetes. This is a prerequisite for attempting token brute-force. ```bash kubectl auth can-i get secrets ``` -------------------------------- ### Permissions Step API Source: https://kubehound.io/queries/dsl Starts a traversal that finds all vertices with a "PermissionSet" label and optionally allows filtering of those vertices on the "role" property. ```APIDOC ## Permissions Step ### Description Starts a traversal that finds all vertices with a "PermissionSet" label and optionally allows filtering of those vertices on the "role" property. ### Method Not specified (assumed to be part of a larger traversal object) ### Endpoint Not specified ### Parameters #### Path Parameters None #### Query Parameters None #### Request Body None ### Request Example ```java // All permissions sets in the graph kh.permissions() // All permissions sets in the graph with role filter kh.permissions("postgres-admin", "db-reader") // All permissions sets in the graph with additional filters kh.permissions().has("app", "web-app").limit(10) ``` ### Response #### Success Response (200) - **GraphTraversal** - A traversal object representing the found permission sets. #### Response Example (No specific response example provided, depends on traversal results) ``` -------------------------------- ### Apply Pod Spec Source: https://kubehound.io/reference/attacks/POD_CREATE Use this command to create the pod defined in the YAML specification. ```bash kubebctl apply -f control-plane-pod-spec.yaml ``` -------------------------------- ### SAS (Service Accounts) API Source: https://kubehound.io/queries/dsl Starts a traversal that finds all vertices representing service accounts and optionally allows filtering of those vertices on the "name" property. ```APIDOC ## SAS Step ### Description Starts a traversal that finds all vertices representing service accounts and optionally allows filtering of those vertices on the "name" property. ### Method GET (Implied by traversal) ### Endpoint / ### Parameters #### Query Parameters - **names** (String...) - Optional - Filters service accounts by their names. ### Request Example ```java // All service accounts in the graph kh.sas() // All service accounts in the graph with name filter kh.sas("postgres-admin", "db-reader") // All service accounts in the graph with additional filters kh.sas().has("app", "web-app").limit(10) ``` ### Response #### Success Response (200) - **Vertex** - Represents a Service Account vertex in the graph. #### Response Example ```json { "example": "[Vertex object representing a Service Account]" } ``` ``` -------------------------------- ### Describe Pod Containers Source: https://kubehound.io/reference/attacks/CONTAINER_ATTACH List the containers running within a pod to identify the target container ID. ```bash kubectl describe pod ``` -------------------------------- ### Escapes API Source: https://kubehound.io/queries/dsl Starts a traversal that finds all container escape edges from a Container vertex to a Node vertex and optionally allows filtering of those vertices on the "nodeNames" property. ```APIDOC ## Escapes Step ### Description Starts a traversal that finds all container escape edges from a Container vertex to a Node vertex and optionally allows filtering of those vertices on the "nodeNames" property. ### Method GET (Implied by traversal) ### Endpoint / ### Parameters #### Query Parameters - **nodeNames** (String...) - Optional - Filters escapes by the target node names. ### Request Example ```java // All container escapes in the graph kh.escapes() // All container escapes in the graph with node name filter kh.escapes("control-plane") ``` ### Response #### Success Response (200) - **Path** - Represents a path of container escapes. #### Response Example ```json { "example": "[Path object representing container escapes]" } ``` ``` -------------------------------- ### List Role Bindings and Cluster Role Bindings Source: https://kubehound.io/reference/attacks/PERMISSION_DISCOVER Retrieve a full list of identity to role mappings across all namespaces. This command is useful for understanding how permissions are assigned. ```bash kubectl get rolebindings,clusterrolebindings --all-namespaces -o wide ``` -------------------------------- ### Manage backend lifecycle Source: https://kubehound.io/user-guide/common-operations Commands to reset or stop the backend services while persisting data in Docker volumes. ```bash kubehound backend reset ``` ```bash kubehound backend down ```