CVE-2025-9074-Docker Escape (HTB MonitorsFour)

This code is for educational purposes only and controlled environments such as laboratories (Hack The Box). Do not use on systems without authorization.

This repository contains an exploit script for the Docker Remote API exposed (without authentication) vulnerability that allows container escape to the host by creating privileged containers. The vulnerability was identified while solving the MonitorsFour machine on Hack The Box.

An attacker can:

• Create arbitrary containers
• Execute commands on the host
• Mount the host filesystem (/)
• Fully escalate privileges

The exploitation is based on:

• Access to the Docker API on tcp/2375 without authentication
• Creation of a container with:
  • Privileged: true
  • Bind mount of the host / → /mnt/host
  • Command execution via docker exec

Usage

chmod +x escape.sh

./escape.sh

Access to the host Once inside the container:

cd /mnt/host

ls

In this case (HTB environment):

cat /mnt/host/mnt/host/c/Users/Administrator/Desktop/root.txt