hunt-k8s
覆盖 kubelet/etcd/docker.sock 等高价值漏洞场景
包含提升权限与逃逸技术，具高危滥用风险
定位并利用 Kubernetes/Docker 配置与运行时缺陷实现集群或宿主逃逸
帮你找出并利用 Kubernetes/Docker 的配置或运行时漏洞，把容器逃逸扩展到宿主机或整个集群。常在目标运行容器化基础设施、暴露 K8s 端口（如 6443/10250/2379）或云元数据泄露 ServiceAccount 时使用。覆盖 kubelet exec、docker.sock、etcd 未鉴权、Dashboard skip-login、RBAC/SA-token 滥用等利用链，能把一次 POD 权限提升变成完全控制。
▸ 展开 SKILL.md 英文原文
Hunt Kubernetes & Docker — API anonymous access, kubelet 10250 exec (SPDY/WebSocket, NOT plain POST) and the simpler /run primitive, etcd 2379 unauth, dashboard skip-login, RBAC misconfig, secret/SA-token abuse, docker.sock host escape, runc/container-escape (Leaky Vessels CVE-2024-21626), API-server-mediated nodes/proxy RCE, EphemeralContainers node-shell, bound/projected SA-token audience+expiry abuse, admission-controller bypass, Helm/Tiller remnants. Use when target runs containerized infra, exposes K8s ports (6443/10250/10255/2379/8443), or cloud metadata reveals K8s service accounts.
帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-k8s/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-k8s/SKILL.md"# HUNT-K8S — Kubernetes & Docker Security ## Crown Jewel Targets K8s API anonymous cluster-admin = full cluster control. docker.sock + RCE = host root. A single privileged-pod create or a kubelet `/run` shell pivots one finding to total compromise. **Highest-value findings:** - **K8s API anonymous cluster-admin** — `system:anonymous`/`system:unauthenticated` bound to a powerful role (classic misconfig: `system:anonymous` in a `ClusterRoleBinding` to `cluster-admin`) → full `kubectl`. Mere anonymous `200` is NOT this (see false-positive section). - **Kubelet `10250` exec/run** — `/run` returns command output directly; `/exec` is a SPDY/WebSocket stream (see Phase 3). Either → RCE in any po