# etcd

> Distributed key-value store used in Kubernetes clusters. Attackers probe for unauthenticated APIs, extract secrets and credentials, tamper with cluster configs, and pivot to other nodes

- **URL:** https://hackindex.io/services/etcd
- **Type:** Service
- **Default ports:** 2379, 2380
- **Tags:** etcd, key-value, api, linux, distributed, credentials
- **Published:** 2026-04-06
- **Updated:** 2026-09-14

etcd is a distributed key-value store that serves as the backbone of Kubernetes clusters and other distributed systems for configuration management and service discovery. The client API listens on **TCP port 2379** and peer communication runs on **TCP port 2380**. Nmap typically identifies port 2379 as `http`.

In Kubernetes environments, etcd stores the entire cluster state, including secrets, service account tokens, ConfigMaps, and pod specifications. Unauthenticated access to etcd means full control over the cluster. Even outside Kubernetes, etcd often holds sensitive application configuration and credentials. By default, etcd does not require authentication, and many deployments skip client certificate verification.

Enumeration starts with querying the version endpoint at `/version` and health at `/health`. The v2 API (`/v2/keys/?recursive=true`) and v3 API (via `etcdctl`) allow listing and reading all stored keys. In Kubernetes clusters, dumping etcd reveals Secrets (base64-encoded by default, not encrypted), service account tokens for privilege escalation, and the full cluster topology. Checking for write access allows modifying cluster state directly.

## Phases

- [Enumeration](https://hackindex.io/services/etcd/enumeration.md): Dump K8s secrets and tokens from unauthenticated etcd instances (1 guides)
- [Exploitation](https://hackindex.io/services/etcd/exploitation.md): Dump keys and extract K8s secrets from open etcd instances (1 guides)