Is my Docker container vulnerable to hostPID privilege escalation?
Tactic: Privilege-escalation
Containers that are running in privileged mode and have the hostPID flag enabled are vulnerable to a privilege escalation and container escape to the host system. This TTP attempts to use nsenter to enter the namespace of the init system process (PID 1) on the host to spawn a root shell. It is important that containers are not running in privileged mode, as adversaries may establish persistence by modifying mounted files, elevate privileges, and escape the container.
View Command
To view this TTPs command, you must be logged in with a professional or enterprise license.
LoginTest this TTP
Download Operator (1.7.1)
Test this TTP using one of our Operator chainsEscape Docker container via cgroup controller.
Is my Docker container vulnerable to cgroup controller escapes?
2022-11-08
Follow @preludeorg on Twitter for new chains and more.
Join the Prelude Discord to discuss chains and more.
Keep up to date with code changes and community activity on Github