CVE-2019-5736 PoC — Docker 操作系统命令注入漏洞

Source

Associated Vulnerability

Description

Exploit for the CVE-2019-5736 runc vulnerability

Readme

# cve-2019-5736-exp

This is a proof-of-concept (PoC) exploit for the CVE-2019-5736 vulnerability in
runc, the runtime used in Docker.

## Disclaimer

I undertook this project as an exercise, for educational reasons and for fun.
It should go without saying that I do not support unethical and/or illegal
misuse of this code.

## Description

The vulnerability was discovered by [Adam Iwaniuk] and [Borys Popławski] and
described in this [blog post][ds]. Thanks for the great research!

[Adam Iwaniuk]: https://twitter.com/adam_iwaniuk
[Borys Popławski]: https://twitter.com/boryspop
[ds]: https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html

## Usage

To build a malicious container:

```
docker build .
```

Running this container will cause the runc binary to be overwritten with the
contents of the `payload` file, i.e.

```
docker run <image_id>
```

Next time runc is executed (e.g when a different container is run), the host
will execute your payload.

File Snapshot

 [4.0K]  /data/pocs/2703734f5c27c6637d396e5a50bff4dde1f00673
├── [ 842]  Dockerfile
├── [1.5K]  evil.c
├── [  38]  payload
└── [ 988]  README.md

0 directories, 4 files

Remarks