@@ -3,7 +3,7 @@ Utilizing Rancher Server, an attacker can create a docker container
3
3
with the '/' path mounted with read/write permissions on the host
4
4
server that is running the docker container. As the docker container
5
5
executes command as uid 0 it is honored by the host operating system
6
- allowing the attacker to edit/create files owed by root. This exploit
6
+ allowing the attacker to edit/create files owned by root. This exploit
7
7
abuses this to creates a cron job in the '/etc/cron.d/' path of the
8
8
host server.
9
9
@@ -78,13 +78,12 @@ Host Registration URL.
78
78
The new host should pop up on the Hosts screen within a minute.
79
79
80
80
# Exploitation
81
- This module is designed for the attacker to leverage, creation of a
82
- docker container to gain root access on the rancher host.
81
+ This module is designed to gain root access on a Rancher Host.
83
82
84
83
## Options
85
- - CONTAINER_ID if you want to have a human readable name for your container, else it will be randomly generated
86
- - DOCKERIMAGE is the locally or from hub.docker.com available image you are wanting to have Rancher to deploy for this exploit.
87
- - TARGETURI this is the Rancher Server API path. The default environment is /v1/projects/1a5
84
+ - CONTAINER_ID if you want to have a human readable name for your container, otherwise it will be randomly generated.
85
+ - DOCKERIMAGE is the local image or hub.docker.com available image you want to have Rancher to deploy for this exploit.
86
+ - TARGETURI this is the Rancher Server API path. The default environment is ` /v1/projects/1a5 ` .
88
87
- WAIT_TIMEOUT is how long you will wait for a docker container to deploy before bailing out if it does not start.
89
88
90
89
By default access control is disabled, but if enabled, you need API
0 commit comments