This project leverages Docker to create a safe, isolated, and intentionally vulnerable environment. This allows anyone to study the exploit without risking their host machine.

The key components are:

• Dockerfile: Defines the blueprint for our vulnerable container. It uses an older base image (debian:bullseye-20210927-slim) known to have a kernel susceptible to Dirty Pipe, and it automates the setup process.
• exploit.c: The C code that implements the exploit logic, based on the original proof-of-concept by Max Kellermann.
• Makefile: A simple makefile to compile the C code into an executable binary within the container.

3. Hands-On Demonstration: From User to Root

This walkthrough will guide you through building the environment and executing the exploit.

Prerequisites: You must have Docker installed and running on your system.

Step 1: Clone the Repository

Open your terminal and clone this project.

Step 2: Build the Vulnerable Docker Image

Use the docker build command to create the container image. The Dockerfile will handle all dependencies and compile the exploit code.

Step 3: Run the Container & Execute the Exploit

Now, run the container interactively. The --rm flag ensures the container is deleted upon exit, and -it gives you an interactive shell.

You will be dropped into a shell inside the container as an unprivileged user (hacker@...:/$).

Now, execute the pre-compiled exploit:

Success! The exploit overwrites a SUID binary to grant you a root shell. Your terminal prompt will change from $ to #, indicating you now have root privileges.

4. Key Security Takeaways & Learnings

This project is more than just running a script; it is a practical demonstration of critical security principles relevant to my work as a Cloud Security Engineer:

• Kernel Exploits Bypass Application-Layer Security: This shows that even with perfect file permissions, a kernel vulnerability can undermine the entire security model of an operating system, proving that defense-in-depth is essential.
• Container Security is Host Security: It provides tangible proof that containers share the host's kernel. A kernel exploit executed within a container can lead to a full breakout and compromise of the host machine. This highlights the importance of using seccomp profiles, gVisor, or container-optimized OSes in production.
• The Criticality of Patch Management: This is a live example of why timely kernel updates are a non-negotiable security practice in any production environment, especially on container hosts.
• Understanding the Attack Surface: By building the exploit environment, I gained a deeper appreciation for how attackers analyze systems and leverage seemingly small flaws in memory management (like pipes and page caches) to achieve total system compromise.

Disclaimer

This project and its code are intended for educational and research purposes only. Do not attempt to use this exploit on any system for which you do not have explicit, authorized permission.