4 ms·

I'm not exactly sure what a root process in a docker container can do (probably depends a lot on the container configuration, plus is probably evolving as we sp

I'm not exactly sure what a root process in a docker container can do (probably depends a lot on the container configuration, plus is probably evolving as we speak, and is subject to bugs), but in my opinion, even if you have redundant security layers, you should be at least a little concerned when somebody is able to jump up a layer (from your 'runner' non-privileged user to root in this case). edit: I did find a kernel arbitrary code execution exploit PoC for the kernel version you're running but I decided against trying it out because I didn't want to crash your docker host.

amasad 12y ago
I am. Thanks for letting me know. Can you provide some more details about how you escalated privileges and the PoC?
- hamburglar 12y ago
  Your root user has no password, so executing 'su' just gives you a root shell. That's pretty much it. :) You can do it by hitting my link above, running the saved code, which defines a 'sh' function, then running the 'sh' function from the repl. That will give you a shell, which you can then 'su' in. It doesn't give you a prompt back because that first shell is non-interactive, but if you run 'sh -i' from there you'll get your # prompt. I told you it wasn't all that clever. :) edit: great site, by the way. i love the concept and my hat is off to you for letting people run wild. The front-end execution is nice, too. BTW, I ran into a limit on the size of a script I could save, and I recommend keeping that, as it prevented me from easily uploading a gcc executable by statically declaring GCC="\x7FELF\x02\x01\x01\x00\x00\x00\x00..." and then writing it to a file. It can still be done, but it's a pain in the ass.