Skip to content

Commit 5ae7080

Browse files
committed
Wording, reviewer remarks
1 parent b78cb12 commit 5ae7080

File tree

1 file changed

+5
-6
lines changed

1 file changed

+5
-6
lines changed

documentation/modules/exploit/linux/http/rancher_server.md

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Utilizing Rancher Server, an attacker can create a docker container
33
with the '/' path mounted with read/write permissions on the host
44
server that is running the docker container. As the docker container
55
executes command as uid 0 it is honored by the host operating system
6-
allowing the attacker to edit/create files owed by root. This exploit
6+
allowing the attacker to edit/create files owned by root. This exploit
77
abuses this to creates a cron job in the '/etc/cron.d/' path of the
88
host server.
99

@@ -78,13 +78,12 @@ Host Registration URL.
7878
The new host should pop up on the Hosts screen within a minute.
7979

8080
# Exploitation
81-
This module is designed for the attacker to leverage, creation of a
82-
docker container to gain root access on the rancher host.
81+
This module is designed to gain root access on a Rancher Host.
8382

8483
## Options
85-
- CONTAINER_ID if you want to have a human readable name for your container, else it will be randomly generated
86-
- DOCKERIMAGE is the locally or from hub.docker.com available image you are wanting to have Rancher to deploy for this exploit.
87-
- TARGETURI this is the Rancher Server API path. The default environment is /v1/projects/1a5
84+
- CONTAINER_ID if you want to have a human readable name for your container, otherwise it will be randomly generated.
85+
- DOCKERIMAGE is the local image or hub.docker.com available image you want to have Rancher to deploy for this exploit.
86+
- TARGETURI this is the Rancher Server API path. The default environment is `/v1/projects/1a5`.
8887
- WAIT_TIMEOUT is how long you will wait for a docker container to deploy before bailing out if it does not start.
8988

9089
By default access control is disabled, but if enabled, you need API

0 commit comments

Comments
 (0)