Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2019-5736-Custom-Runtime — CVE-2019-5736 implemented in a self-written container runtime to understand the exploit. | Kitploit
Tools/GitHubGitHub/giverofgifts/cve-2019-5736-custom-runtime
Vulnerability AnalysisExploitationPenetration TestingLearning & EducationContainer EscapeBinary Exploitation
GitHubgiverofgifts/cve-2019-5736-custom-runtime

CVE-2019-5736-Custom-Runtime

CVE-2019-5736 implemented in a self-written container runtime to understand the exploit.

View Repository
146 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2019-5736-Custom-Sandbox

General

CVE-2019-5736 implemented using a shallow, self-written container runtime to understand the exploit.

Exploit is based on (and almost all copied from) the runc-poc by twistlock: https://github.com/twistlock/RunC-CVE-2019-5736/tree/master/malicious_image_POC

Container Runtime (quarantine)

See code docs for further details.

root@kitploit:~
Usage: quarantine [OPTIONS] [BINARY and its ARGS]

--rootfs: (mandatory) Specify a rootfs for the container.
--urange: Specify a urange start_host:end_host,start_guest.
--grange: Specify a grange start_host:end_host,start_guest.
--uid:    Specify the desired UID in the container.
--ugd:    Specify the desired GID in the container.
--supp:   Append supplementary groups from the specified grange to the process running in the container.

Unshares all namespaces except for the user ns. User ns is unshared under special circumstances, i.e. when urange, grange, and / or are specified.

uid
gid

Setup for the exploit

This was tested and done on Ubuntu 18.04.

  1. Get a rootfs (bionic for example)
    • mkdir rootfs
    • sudo debootstrap bionic ./rootfs
  2. Get libcap source
    • git clone https://github.com/mhiramat/libcap
  3. Modifiy libcap
    • cat exploit_code_for_shared_lib.c >> <any cap*.c, I used cap_alloc.c>
    • make
  4. chroot into the rootfs and install libcap-dev so you can simply link to the modified libcap.so
    • sudo chroot rootfs
    • apt install libcap-dev
  5. Copy the created libcap.so.2.25 file into the appropriate rootfs dir -sudo cp libcap.so.2.25 rootfs/lib/x86_64-linux-gnu
    • Note: For me, there already was a link pointing at that exact libcap file version, so I haven't had to link it
    • Note: This path might change, always look at where the compiled quarantine expects the libcap to be: ldd quarantine
  6. Compile and copy the other files into the rootfs
    • sudo cp shebang_exploit rootfs/
    • sudo gcc -o rootfs/root/payload payload.c
    • sudo gcc -o rootfs/overwrite_sndbx_runtime overwrite_sndbx_runtime.c

Run exploit

For example: sudo ./quarantine --rootfs rootfs /shebang_exploit or ./quarantine --rootfs rootfs --uid 1 /shebang_exploit.

It works as long as you either keep CAP_DAC_OVERRIDE or CAP_SYS_ADMIN on the host, i.e. don't unshare user ns when using sudo (since this drops caps in parent ns), or you own the file on the host.

Download Tool