CVE-2019-5736 PoC

This repository contains a C-based proof-of-concept exploit for CVE-2019-5736.

This vulnerability allows a malicious Docker container to overwrite the host's runc binary and execute arbitrary commands on the host with root privileges – fully compromising the host system.

Inspired by the original Go-based PoC by Frichetten

Disclaimer

This code is for educational purposes only. Do not run it on any system you do not own or have permission to test. Misuse may result in legal consequences.

Contents

1. Project Structure
2. Environment Setup & Installation
3. Usage

1. Project Structure

.
├── docker/                       
│   └── Dockerfile
├── lib/                           
│   └── exploit.h
├── scripts/                       
│   ├── build_docker.sh
│   ├── purge_docker_installation.sh
│   ├── setup_env.sh
│   ├── start_docker.sh
│   └── trigger_exploit.sh
├── src/                         
│   ├── exploit.c
│   └── main.c
├── LICENSE
├── Makefile
└── README.md

2. Environment Setup & Installation

This exploit has been tested on:

• Ubuntu 18.04.1 → Download ISO
• Docker 18.09.1 → Download binaries

Step-by-step Installation

0. Install dependencies

sudo ./scripts/install_dependencies.sh

Note: You can safely skip this if you already have installed wget and build-essential.

1. Install Docker via script

sudo ./scripts/setup_env.sh

This script installs Docker without systemd or socket activation. It’s ideal for VM labs.

2. Start Docker manually

sudo dockerd

Note: You’ll need a second terminal to run this in the background.

3. Build the exploit container

sudo ./scripts/build_docker.sh

This script compiles the exploit and builds a Docker image with the binary inside.

Note: You can also manually build the exploit binary by running make.

Optional: Clean up the environment

You can completely remove Docker and restore the system to a pre-installation state:

sudo ./scripts/purge_docker_installation.sh

3. Usage

First we start our exploit container. You can either use this command:

sudo docker run -it --name exp --rm runc_exploit

or the included shell script:

sudo ./scripts/start_docker.sh

Inside the container we can now start our exploit binary:

./exploit -c "$COMAND"

The binary takes three arguments: -h prints the usage message and -c defines the command string payload we want to execute on the host. The last -d argument toggles debug prints during execution. (eg. parsing information of /proc)

Note: If the -c argument is not provided the exploit will execute cp /etc/shadow > /tmp/pwned && chmod 644 /tmp/pwned.

The exploit now waits for an incomming runc process on the host execute

sudo ./scripts/trigger_exploit.sh

This script will open a new process inside the container executing bin/sh and therefore triggering the exploit.

Note: You could also trigger the exploit by manually executing docker exec on the host but the timing is critical for the current PoC version to work. So it could take a few tries...

If runc was exploited successfully you should see a similiar output:

We are now able to open our pwned shadow file: