Skip to content
HackIndex.io

etcd Enumeration

2 min read Created Sep 14, 2026 Last updated Sep 14, 2026

etcd is a distributed key-value store used primarily by Kubernetes for cluster state and configuration. It runs on port 2379 (client API) and 2380 (peer communication). Many etcd deployments lack authentication, exposing all stored keys, including Kubernetes secrets, service account tokens, and TLS certificates. Finding an open etcd instance in a Kubernetes environment often means full cluster compromise.

Version Detection

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:2379/version | python3 -m json.tool 
{
  "etcdserver": "3.5.9",
  "etcdcluster": "3.5.0"
}

The /version endpoint requires no authentication even when auth is enabled on other endpoints.

Health and Membership

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:2379/health | python3 -m json.tool 
{"health": "true", "reason": ""}
┌──(kali㉿kali)-[~]
└─$ etcdctl --endpoints=http://$TARGET_IP:2379 member list -w table 
+------------------+---------+-------+-------------------------+-------------------------+
|        ID        | STATUS  | NAME  |       PEER ADDRS        |      CLIENT ADDRS       |
+------------------+---------+-------+-------------------------+-------------------------+
| 8e9e05c52164694d | started | etcd0 | http://10.10.10.50:2380 | http://10.10.10.50:2379 |
+------------------+---------+-------+-------------------------+-------------------------+

Reveals internal IPs of all cluster nodes. Peer addresses (port 2380) may also be reachable.

Authentication Check

Attempt to list keys. If authentication is not enabled, all keys are accessible.

┌──(kali㉿kali)-[~]
└─$ etcdctl --endpoints=http://$TARGET_IP:2379 get / --prefix --keys-only --limit=20 
/registry/secrets/default/db-credentials
/registry/secrets/kube-system/admin-token
/registry/configmaps/default/app-config
/registry/pods/default/web-app-7d4b5c
/registry/serviceaccounts/default/default
Explain command
--prefix Return all keys starting with the given prefix.
--keys-only List key names without values.
--limit=20 Return at most 20 keys to avoid dumping the entire store.

Keys starting with /registry/ indicate this is a Kubernetes backing store. Secrets, configmaps, and service accounts are high-value targets.

If this returns an authentication error, the instance requires credentials. Check for certificate-based auth (--cert, --key, --cacert flags) or username/password auth.

HTTP API Enumeration

Without etcdctl installed, use the v2 HTTP API (if enabled) or the v3 gRPC-gateway.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:2379/v2/keys/?recursive=true | python3 -m json.tool

The v2 API is deprecated but still enabled on many instances. Returns keys and values in JSON format.

If unauthenticated access is confirmed, continue to etcd exploitation for secret extraction and cluster compromise.

References