boogled/docker-escape repository overview

This is a simple Apache server that is vulnerable to command injection.

You can set this up using docker as:

docker run -p 8000:8080 -d boogled/docker-escape:1.0

Exploit the RCE

#Docker-compose file for Docker Capabilities Escape:

version: '2.2'

services:

node:

image: boogled/docker-escape:1.0

container_name: Docker_Cap_Escape

security_opt:

  - apparmor:unconfined

cap_add:

  - SYS_ADMIN

ports:

  - 8080:8080

Exploit the RCE to get the shell

Inside the Container check for the capabilities

Exploit the capabilities to get the host privilege.