peirates (K8s privesc)

peirates

Interactive Kubernetes attack toolkit: steals service account tokens, impersonates identities, enumerates the cluster, creates malicious pods, and escalates to cluster-admin or escapes to the node, all from a menu.

When you have an execution foothold inside a cluster (a compromised pod, a container with access to the API server, or a stolen kubeconfig). Peirates automates the classic chain: read the service account token mounted at /var/run/secrets/kubernetes.io/serviceaccount/, check its permissions against the API server, and escalate by creating pods or exploiting RBAC.

If the pod has no access to the API server (strict network policies) or the service account has no permissions, Peirates will find nothing: first manually check if you can reach the API server. Also avoid it in clusters with strict admission controllers that block privileged pods: you'll waste time on options that will never execute.