container-k8s-escape

Use when breaking out of a container or escalating inside Kubernetes — runc/BuildKit CVEs, privileged/capability/cgroup misconfig escapes, NVIDIA GPU toolkit escape, K8s RBAC abuse, kubelet RCE, ingress/admission-controller RCE, node-to-cluster pivot

Jump to install

Repository: hypnguyen1209/offensive-claude
Last source activity: June 29, 2026 at 07:22
Detected SKILL.md language: English
Stars: 343
Forks: 59

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

Back to search Back to installation

Container Breakout & Kubernetes Escape

When to Activate

You have code execution inside a container/pod and want to break out to the host node
Auditing a Kubernetes cluster for RBAC privilege-escalation and lateral-movement paths
Assessing runc/containerd/BuildKit/Docker runtime versions against known escape CVEs
A pod is privileged, has dangerous capabilities, hostPath/hostPID/hostNetwork, or a mounted docker.sock
Attacking GPU/AI workloads using the NVIDIA Container Toolkit
Testing ingress-nginx / admission-controller exposure for unauthenticated RCE
Post-escape: pivoting from one node to full cluster takeover (kubelet, SA tokens, etcd, cloud IMDS)
Building Falco/Sigma detections for container-escape behavior (defensive validation)

Technique Map

Technique	ATT&CK	CWE	Reference	Script
runc working-dir fd leak escape (Leaky Vessels, CVE-2024-21626)	T1611	CWE-403	references/runtime-cve-escapes.md	scripts/runc_cwd_escape.py
runc masked-path / `/dev/null` symlink escape (CVE-2025-31133)	T1611	CWE-367	references/runtime-cve-escapes.md	scripts/runc_cwd_escape.py
runc `/dev/console` bind-mount + LSM bypass (CVE-2025-52565/52881)	T1611	CWE-363	references/runtime-cve-escapes.md	scripts/escape_enum.sh
BuildKit cache/teardown symlink escape (CVE-2024-23651/52/53)	T1611	CWE-59	references/runtime-cve-escapes.md	scripts/escape_enum.sh
Privileged / `CAP_SYS_ADMIN` cgroup `release_agent` escape	T1611	CWE-269	references/privileged-misconfig-escape.md	scripts/release_agent_escape.sh
`core_pattern` host-side code exec on crash	T1611	CWE-269	references/privileged-misconfig-escape.md	scripts/release_agent_escape.sh
`hostPID` + `nsenter` into PID 1 namespace	T1611	CWE-668	references/privileged-misconfig-escape.md	scripts/escape_enum.sh
Mounted `docker.sock` / `containerd.sock` host takeover	T1610	CWE-668	references/privileged-misconfig-escape.md	scripts/escape_enum.sh
`hostPath` `/` mount → write host filesystem	T1611	CWE-22	references/privileged-misconfig-escape.md	scripts/escape_enum.sh
NVIDIAScape `LD_PRELOAD` OCI-hook escape (CVE-2025-23266)	T1611	CWE-426	references/nvidia-gpu-escape.md	scripts/nvidiascape_build.sh
NVIDIA CT TOCTOU mount escape (CVE-2024-0132 / CVE-2025-23359)	T1611	CWE-367	references/nvidia-gpu-escape.md	scripts/nvidiascape_build.sh
K8s RBAC privesc (verb/wildcard/escalate, SA token theft)	T1078.001	CWE-269	references/k8s-rbac-escalation.md	scripts/k8s_rbac_audit.py
`nodes/proxy` GET → kubelet WebSocket exec RCE	T1609	CWE-863	references/k8s-rbac-escalation.md	scripts/kubelet_exec.py
Anonymous/authed kubelet API exec on :10250	T1609	CWE-306	references/k8s-rbac-escalation.md	scripts/kubelet_exec.py
IngressNightmare unauth RCE (CVE-2025-1974 + annotation chain)	T1190	CWE-94	references/ingress-admission-attacks.md	scripts/escape_enum.sh
Node → cluster pivot (etcd, IMDS, SA-token harvest)	T1613	CWE-552	references/node-host-pivot.md	scripts/escape_enum.sh

Quick Start

# 0. Enumerate the container/pod context: caps, mounts, sockets, runtime versions, K8s creds
bash scripts/escape_enum.sh                 # run INSIDE the target container

# 1. Runtime-CVE path: detect vulnerable runc/BuildKit and run the cwd-fd escape (CVE-2024-21626)
python3 scripts/runc_cwd_escape.py --probe                       # try fd 7,8,9 -> host /
python3 scripts/runc_cwd_escape.py --cmd 'id; cat /etc/shadow'   # via docker -w or k8s revshell

# 2. Misconfig path: privileged / CAP_SYS_ADMIN -> cgroup release_agent host code exec
bash scripts/release_agent_escape.sh -c 'id > /tmp/escape_out'   # reads host PID list / runs cmd

# 3. GPU path: build a malicious image for NVIDIAScape (CVE-2025-23266)
bash scripts/nvidiascape_build.sh --cmd 'id; cat /etc/shadow' --tag evil-gpu:latest

# 4. K8s RBAC: audit who can escalate / reach the kubelet (needs a kubeconfig or in-pod SA token)
python3 scripts/k8s_rbac_audit.py --kubeconfig ~/.kube/config --dangerous

# 5. nodes/proxy or open kubelet -> exec into any pod on the node
python3 scripts/kubelet_exec.py --node 10.0.0.5 --pod kube-system/etcd-master \
        --container etcd --cmd 'cat /var/lib/etcd/...' --token "$SA_TOKEN"

Recommended tooling: deepce / cdk / amicontained (in-container recon), peirates (K8s pivot), kube-hunter (cluster scan), kubeletctl (kubelet API), crictl (post-escape node control), falco (defensive validation of every technique below).

OPSEC & Detection (summary)

Technique	Telemetry / IOC	Detection (Sigma/EDR/Falco)	OPSEC note
runc cwd-fd escape (CVE-2024-21626)	container process cwd under `/proc/self/fd/N`; `getcwd` ENOENT errors; host-path access from pid1	Falco `Container Drift`/unexpected host-fs read; alert on runtime < runc 1.1.12	No new files needed; works via `-w`/cwd only — very quiet, but lands on real host fs
runc 2025 trio (masked-path/console)	symlink swap of `/dev/null` or `/dev/pts/N`; RW open of `/proc/sysrq-trigger`/`core_pattern`	Falco "Write below /proc/sys"/sysrq; mount race anomalies	Symlink swap is a timing race; on failure may crash host (sysrq) — loud
release_agent / core_pattern	mount of cgroup/cgroup2; write to `*/release_agent` or `/proc/sys/kernel/core_pattern`	Falco `Detect release_agent File Container Escapes`; Sigma on write to core_pattern	Requires CAP_SYS_ADMIN+mount; release_agent is cgroup-v1 only
nsenter / hostPID	`nsenter --target 1`; process entering host mount/pid ns	Falco "nsenter" / `proc.name=nsenter` in container; ATT&CK T1611	hostPID is visible in pod spec; nsenter is a strong IOC
docker.sock abuse	`/var/run/docker.sock` mounted; `curl --unix-socket` create privileged container	Falco "Docker socket access by unexpected proc"; new privileged container event	Spawns a new privileged container — visible to docker/containerd events
NVIDIAScape (CVE-2025-23266)	image `ENV LD_PRELOAD=/proc/self/cwd/*.so`; nvidia hook loads .so from container fs	Falco shared-lib load by `nvidia-ctk`/hook from container path	Needs only image push + run; no kernel bug — image scan catches the ENV
nodes/proxy → kubelet exec	WebSocket GET to kubelet `/exec`/`/run` on :10250; no API-server audit entry	Runtime/L7 only — invisible to API audit & GuardDuty; monitor kubelet access log	Bypasses API-server audit & admission entirely — extremely stealthy

Deep Dives

references/runtime-cve-escapes.md — runc CVE-2024-21626 (working-dir fd leak), the Nov-2025 runc trio (CVE-2025-31133/52565/52881 masked-path & /dev/console), and the BuildKit Leaky Vessels CVEs, with full PoCs and version matrices.
references/privileged-misconfig-escape.md — --privileged/capability escapes: cgroup-v1 release_agent, core_pattern, hostPID+nsenter, mounted docker/containerd sockets, and hostPath// mounts, with complete scripts.
references/nvidia-gpu-escape.md — NVIDIAScape (CVE-2025-23266 LD_PRELOAD OCI-hook) and the CVE-2024-0132 / CVE-2025-23359 TOCTOU mount escapes in the NVIDIA Container Toolkit; build-and-run PoCs.
references/k8s-rbac-escalation.md — RBAC privilege escalation (wildcards, escalate/bind, pods/exec, impersonation), SA-token harvest, the nodes/proxy GET → kubelet WebSocket exec RCE, and open kubelet :10250.
references/ingress-admission-attacks.md — IngressNightmare (CVE-2025-1974 + the annotation-injection chain), admission-webhook abuse, and how a controller SA leads to cluster-wide secret theft.
references/node-host-pivot.md — post-escape playbook: from one node to the whole cluster — etcd looting, kubelet/crictl, SA-token mining across pods, cloud IMDS role theft, and the defensive counterweight.