sastraadiwiguna-purpleeliteteaming/holistic-deconstruction-of-cve-2019-5736-
This repository provides a high-fidelity technical deconstruction and production-ready exploitation suite for CVE-2019-5736. It demonstrates how a root user inside a container can achieve a Host Root Shell by overwriting the host runc binary using an OverlayFS mount and ld.so.preload manipulation.
Advanced Purple Teaming & Forensic Analysis of Host Root Escape
This repository contains a high-fidelity deconstruction and Proof-of-Concept (PoC) for CVE-2019-5736, a critical vulnerability in runc (versions 1.0-rc1 through 1.0-rc6). This exploit allows a malicious container with root privileges to overwrite the host runc binary and gain complete host root access .
Vulnerability Type: CWE-59 (Improper Link Resolution Before File Access).
CVSSv3 Score: 8.6 HIGH.
Impact: Escape from isolated container namespaces to the host operating system.
The exploit follows a deterministic multi-stage execution path:
Namespace Liberation: Uses unshare -rm to create a new mount namespace, bypassing initial container restrictions.
Filesystem Bridging: Leverages OverlayFS to mount the host root directory (/) into a writable container-controlled directory .
Dynamic Linker Hijacking: Overwrites /etc/ld.so.preload on the host to inject a malicious payload (/bin/sh -p) into every new process .
Execution Trigger: Executes a standard host binary (e.g., /usr/bin/ping) to trigger the loader and spawn a Host Root Shell .
To test this in a controlled environment (Ubuntu 18.04 + Docker 18.09.2):
# [cite_start]Setup vulnerable host [cite: 384-388]
docker run -d --name vuln_host --privileged ubuntu:18.04 sleep infinity
docker exec vuln_host apt update && apt install -y curl git
docker exec vuln_host curl -sSL https://get.docker.com | sh
Run the following within the vulnerable environment to achieve host root :
chmod +x runc_root_escape.sh
./runc_root_escape.sh
| Target Environment | Status | Impact Potential
| | --- | --- | --- | | Standalone Docker | ✅ Vulnerable | Host takeover, data destruction ($10M+) | | Kubernetes Cluster | ✅ Pivot Ready | Cluster-admin secret theft ($50M+) | | Public Cloud (AWS/GCP) | ✅ Vulnerable | IAM role theft, Cloud pivot ($100M+) |
For Blue Team monitoring, focus on these indicators of compromise (IoC):
Filesystem: Unexpected writes to /etc/ld.so.preload.
Process: Monitoring unshare and mount calls within containers .
History: Check for automated persistence in /var/spool/cron/crontabs/root.
This material is provided by SASTRA_ADI_WIGUNA [Purple_Elite_Teaming] for educational and authorized security testing purposes only. Use of this information for illegal activities is strictly prohibited.
Integrate Falco/Sysdig detection rules.
Automate cleanup scripts for Red Team ops .
Map against MITRE ATT&CK T1611 (Escape to Host).