etcdutl

OVERVIEW

etcdutl (github.com/etcd-io/etcd) is etcdctl's companion offline maintenance tool: rather than talking to a live etcd cluster over the network, it operates directly on a database file or snapshot — verifying its integrity, listing what it contains, or restoring it into a fresh data directory that a local etcd instance can then serve.

That makes it the right tool for a specific finding pattern: an etcd snapshot or backup file (often named snapshot.db or member/snap/db) discovered somewhere it shouldn't be — an unsecured backup bucket, a misconfigured file share, a compromised host's disk — since it contains the same raw cluster state (including Secrets) as a live cluster would expose.

USE CASES

Practical use cases

• 01

  Restoring a discovered etcd snapshot file into a local data directory to inspect its contents offline.

• 02

  Verifying the integrity and hash of an etcd backup file found during a filesystem review.

• 03

  Demonstrating that a leaked snapshot exposes the same Secrets/ConfigMaps a live cluster compromise would.

• 04

  Recovering cluster state from a snapshot obtained during post-exploitation on a compromised etcd host.

QUICK START

When a snapshot or backup file (db, snapshot.db) of an etcd cluster's data turns up during an engagement — on a backup share, in a repo, on a compromised host — and you need to read what's inside it without standing up a live server.

1. Confirm handling of the discovered snapshot/backup file is within the authorized scope and data-handling rules.
2. Install etcdutl (bundled with the etcd release binaries).
3. Verify the snapshot's status/integrity before restoring it.
4. Restore the snapshot into an isolated local data directory — never onto shared or production infrastructure.
5. Point a local, isolated etcdctl/etcd instance at the restored directory to read out the contents.

etcdutl snapshot restore snapshot.db --data-dir ./restored-etcd

BEFORE YOU RUN IT

What to check before running it