关联漏洞
标题：
Docker 代码注入漏洞
(CVE-2019-14271)
描述：Docker是美国Docker公司的一款开源的应用容器引擎。该产品支持在Linux系统上创建一个容器（轻量级虚拟机）并部署和运行应用程序，以及通过配置文件实现应用程序的自动化安装、部署和升级。 Docker中存在安全漏洞。攻击者可利用该漏洞绕过限制，提升权限。
描述
A convenient and time-saving auto script of building environment and exploit it.
介绍
# CVE-2019-14271_Exploit
A convenient and time-saving auto script of building environment and exploit it.
# References
https://github.com/Metarget/metarget
https://github.com/Metarget/metarget/tree/master/writeups_cnv/docker-cve-2019-14271
https://github.com/thomasyang1207/Exploits/tree/master/CVE_2019_14271
# Usage
```bash
chmod 777 Exploit.sh
chmod 777 Install_env.sh
sudo ./Install_env.sh
sudo ./Exploit.sh
```
> If the image has been built, run `Exploit.sh` only for reuse.
Now you have entered the container `cve-14271` and see:
```bash
root@d9b5a334a0e9:/# ls
bin breakout home lib32 logs opt run sys var
boot dev host_fs lib64 media proc sbin tmp
break_logs etc lib libx32 mnt root srv usr
```
Enter `host_fs` and you will find the host's root directory has been mounted here and you escape successfully. You can act as a root user in the host machine.
文件快照
[4.0K] /data/pocs/f987a27b5ecabdd623c112f3fd3ba857f5ee42b8
├── [4.0K] exp
│ ├── [ 334] breakout
│ ├── [ 298] Dockerfile
│ ├── [391K] libnss_files.so.2
│ └── [ 46K] original_libnss_files.so.2
├── [ 414] Exploit.sh
├── [ 364] Install_env.sh
├── [ 11K] LICENSE
└── [ 928] README.md
1 directory, 8 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。