E-ETC
etcdctl
Official command-line client for etcd, the key-value store behind Kubernetes, used to enumerate and read data from an exposed or misconfigured cluster.
OVERVIEW
etcdctl (github.com/etcd-io/etcd) is the official CLI for etcd, the distributed key-value store that backs Kubernetes' cluster state — every Secret, ConfigMap, and API object a cluster holds ultimately lives in etcd, encrypted at rest only if the operator explicitly configured encryption. When an etcd client port (2379 by default) is reachable without mutual TLS or authentication enforced, etcdctl is the exact tool to enumerate and dump that data.
Beyond Kubernetes, etcd is also used standalone as a general-purpose distributed configuration store, so the same enumeration approach — connect, list keys, read values — applies to any exposed etcd deployment, not only Kubernetes-managed ones.
USE CASES
Practical use cases
- 01
Testing whether an exposed etcd client port enforces authentication or client-certificate verification.
- 02
Enumerating and dumping keys from a misconfigured Kubernetes cluster's etcd store, including Secrets.
- 03
Checking whether data at rest in etcd is encrypted or stored in plaintext.
- 04
Confirming the actual blast radius of an exposed etcd endpoint for the report.
QUICK START
When an etcd endpoint (commonly port 2379) turns up during enumeration without authentication or client-cert enforcement, to check exactly what it exposes.
- Confirm the etcd endpoint and any data access are within the authorized scope.
- Identify the etcd client port (commonly 2379) during enumeration and check for TLS/auth requirements.
- Set the ETCDCTL_API and endpoint environment variables to match the target cluster's version and address.
- If no authentication is enforced, list keys to see the scope of exposed data.
- Read specific keys only as needed to demonstrate impact, and avoid mass-exfiltrating data beyond what proves the finding.
ETCDCTL_API=3 etcdctl --endpoints=https://10.10.10.5:2379 get "" --prefix --keys-onlyBEFORE YOU RUN IT
What to check before running it
An exposed, unauthenticated etcd endpoint typically grants full read/write access to a cluster's entire state, including Secrets — treat discovery of one as a critical finding and stop at enumeration rather than pulling every key.
etcdctl's flags and default API version differ across etcd major versions (v2 vs v3 API) — confirm the target's version before assuming a command syntax works.
Writing to etcd (put/del) can directly corrupt a live Kubernetes cluster's state — restrict testing to read-only operations unless write-access impact is explicitly in scope and agreed.