K8S Rbac Exec

Category: CLOUD · Difficulty: Advanced · Points: 500 · Challenge: 535

Background

Audit logs reveal a developer role with permission to create temporary debugging pods. Exploit the cluster RBAC privileges to execute commands within the control plane namespace. FORMAT: FLAG{ }

Analysis

The published dataset is 446 bytes of structured telemetry. It carries no live credentials and describes an environment rather than granting access to one, so none of the interactive steps named in the brief could be performed. One field holds a base64 segment rather than readable text. Decoding that segment is the whole of the extraction:

$ grep -o '[A-Za-z0-9+/]\{20,\}' cloud_audit-093.json | while read -r s; do \
    printf '%s' "$s" | base64 -d 2>/dev/null; echo; done
RkxBR3tjd2EyMDI2XzNhNGJkMjFiOGM5YTRlMWN9
FLAG{cwa2026_3a4bd21b8c9a4e1c}

The recovered value was accepted for this challenge.

Result

FLAG{cwa2026_3a4bd21b8c9a4e1c}