K8s Capture: cluster-zero — hard misc CTF

You've gained a foothold inside a Kubernetes pod running in the production namespace. The security team left some artifacts behind during a recent audit. Your job is to escalate from your constrained pod to extract the cluster admin secret.

Initial Pod Context: You are running as the webapp-runner ServiceAccount. The mounted token is at /var/run/secrets/kubernetes.io/serviceaccount/token (JWT):

eyJhbGciOiJSUzI1NiIsImtpZCI6IkR4VjJxLXBHRzBVY0JYMHhSR0o5WjBsMzdBQUdOX2tFTWJWQUttV19TZW8ifQ.eyJhdWQiOlsiaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLmNsdXN0ZXIubG9jYWwiXSwiZXhwIjoxNzY3MjI1NjAwLCJpYXQiOjE3MDQ2NDk2MDAsImlzcyI6Imh0dHBzOi8va3ViZXJuZXRlcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwia3ViZXJuZXRlcy5pbyI6eyJuYW1lc3BhY2UiOiJwcm9kdWN0aW9uIiwicG9kIjp7Im5hbWUiOiJ3ZWJhcHAtcnVubmVyLTc4OWRmNDU2YmMtaDRrcXIiLCJ1aWQiOiI5ZTNhMTJiYy0zMzQ1LTQ1NjctODkwMS0xMjM0NTY3ODlhYmMifSwic2VydmljZWFjY291bnQiOnsibmFtZSI6IndlYmFwcC1ydW5uZXIiLCJ1aWQiOiJhYmNkZWYxMi0zNDU2LTc4OTAtYWJjZC0xMjM0NTY3ODlhYmMifX0sIm5iZiI6MTcwNDY0OTYwMCwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50OnByb2R1Y3Rpb246d2ViYXBwLXJ1bm5lciJ9.X9vK2pQ3mR7nL8cW4jF6tY5bN1aP8sD9fG3hJ2kL4mN6oP7qR8sT9uV0wX1yZ2aB3cD4eF5gH6iJ7kL8mN9oP0qR1sT2uV3wX4yZ5aB6cD7eF8gH9iJ0kL1mN2oP3qR4sT5uV6wX7yZ8aB9cD0eF1gH2iJ3kL4mN5oP6qR7sT8uV9wX0yZ1aB2cD3eF4gH5iJ6kL7mN8oP9qR0sT1uV2wX3yZ4aB5cD6eF7gH8iJ9kL0mN1oP2qR3sT4uV5wX6yZ7aB8cD9eF0gH1iJ2kL3mN4oP5qR6sT7uV8wX9yZ0aB1cD2eF3gH4iJ5kL6mN7oP8qR9sT0uV1wX2yZ3aB4cD5eF6gH7iJ8kL9mN0oP1qR2sT3uV4wX5yZ6aB7cD8eF9gH0iJ1kL2mN3oP4qR5sT6uV7wX8yZ9

The Kubernetes API server is reachable at https://10.96.0.1:443. You discover a ConfigMap in your namespace named security-audit-notes:

code
apiVersion: v1
kind: ConfigMap
metadata:
  name: security-audit-notes
  namespace: production
data:
  findings.txt: |
    Role 'secret-reader' in kube-system has list/get on secrets.
    Bound to SA 'log-collector' via RoleBinding 'logs-access'.
    log-collector token: use pod 'syslog-aggregator-0' in kube-system.
  pivot.sh: |
    # Deprecated - kept for reference
    kubectl --token=<TOKEN> --server=https://10.96.0.1:443 --insecure-skip-tls-verify \
      -n kube-system get secret admin-kubeconfig -o jsonpath='{.data.config}' | base64 -d

Your mission: Chain the ServiceAccount permissions, pivot to kube-system, retrieve the admin-kubeconfig secret, and extract the cluster admin password embedded in the kubeconfig. The password is the flag.

Constraints: The webapp-runner SA can only get configmaps in production and get pods in kube-system. You must identify the correct pod token to escalate.