container-k8s-escape

Use when breaking out of a container or escalating inside Kubernetes — runc/BuildKit CVEs, privileged/capability/cgroup misconfig escapes, NVIDIA GPU toolkit escape, K8s RBAC abuse, kubelet RCE, ingress/admission-controller RCE, node-to-cluster pivot

仓库: hypnguyen1209/offensive-claude
最近来源活动: 2026年6月29日 07:22
检测到的 SKILL.md 语言: 英语
星标: 343
分支: 59

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

返回搜索返回安装

name	container-k8s-escape
description	Use when breaking out of a container or escalating inside Kubernetes — runc/BuildKit CVEs, privileged/capability/cgroup misconfig escapes, NVIDIA GPU toolkit escape, K8s RBAC abuse, kubelet RCE, ingress/admission-controller RCE, node-to-cluster pivot
metadata	{"type":"offensive","phase":"exploit-install-actions","tools":"kubectl, crictl, runc, deepce, cdk, kube-hunter, peirates, amicontained, trufflehog, falco, kubeletctl, nsenter","mitre":["T1611","T1610","T1613","T1552.001","T1552.007","T1078.001","T1068","T1496"]}
kill_chain	{"phase":["exploit","install","actions"],"step":[4,5,7],"attck_tactics":["TA0002","TA0004","TA0005","TA0006","TA0008"],"attck_techniques":["T1611","T1610","T1613","T1609","T1552.001","T1552.007","T1078.001","T1068","T1496","T1610"]}
depends_on	["recon-osint","cloud-security","vulnerability-analysis"]
feeds_into	["cloud-security","red-team-ops","privesc-linux","active-directory-attack"]
inputs	["container_context","k8s_service_account","kubeconfig","node_access","registry_push_access"]
outputs	["host_root_shell","node_compromise","stolen_sa_tokens","cluster_admin","attack_path","escape_finding"]
references	["references/runtime-cve-escapes.md","references/privileged-misconfig-escape.md","references/nvidia-gpu-escape.md","references/k8s-rbac-escalation.md","references/ingress-admission-attacks.md","references/node-host-pivot.md"]
scripts	["scripts/escape_enum.sh","scripts/runc_cwd_escape.py","scripts/release_agent_escape.sh","scripts/nvidiascape_build.sh","scripts/k8s_rbac_audit.py","scripts/kubelet_exec.py"]

Container Breakout & Kubernetes Escape

When to Activate

You have code execution inside a container/pod and want to break out to the host node
Auditing a Kubernetes cluster for RBAC privilege-escalation and lateral-movement paths
Assessing runc/containerd/BuildKit/Docker runtime versions against known escape CVEs
A pod is privileged, has dangerous capabilities, hostPath/hostPID/hostNetwork, or a mounted docker.sock
Attacking GPU/AI workloads using the NVIDIA Container Toolkit
Testing ingress-nginx / admission-controller exposure for unauthenticated RCE
Post-escape: pivoting from one node to full cluster takeover (kubelet, SA tokens, etcd, cloud IMDS)
Building Falco/Sigma detections for container-escape behavior (defensive validation)

Technique Map

Technique	ATT&CK	CWE	Reference	Script
runc working-dir fd leak escape (Leaky Vessels, CVE-2024-21626)	T1611	CWE-403	references/runtime-cve-escapes.md	scripts/runc_cwd_escape.py
runc masked-path / `/dev/null` symlink escape (CVE-2025-31133)	T1611	CWE-367	references/runtime-cve-escapes.md	scripts/runc_cwd_escape.py
runc `/dev/console` bind-mount + LSM bypass (CVE-2025-52565/52881)	T1611	CWE-363	references/runtime-cve-escapes.md	scripts/escape_enum.sh
BuildKit cache/teardown symlink escape (CVE-2024-23651/52/53)	T1611	CWE-59	references/runtime-cve-escapes.md	scripts/escape_enum.sh
Privileged / `CAP_SYS_ADMIN` cgroup `release_agent` escape	T1611	CWE-269	references/privileged-misconfig-escape.md	scripts/release_agent_escape.sh
`core_pattern` host-side code exec on crash	T1611	CWE-269	references/privileged-misconfig-escape.md	scripts/release_agent_escape.sh
`hostPID` + `nsenter` into PID 1 namespace	T1611	CWE-668	references/privileged-misconfig-escape.md

# 0. Enumerate the container/pod context: caps, mounts, sockets, runtime versions, K8s creds
bash scripts/escape_enum.sh                 # run INSIDE the target container

# 1. Runtime-CVE path: detect vulnerable runc/BuildKit and run the cwd-fd escape (CVE-2024-21626)
python3 scripts/runc_cwd_escape.py --probe                       # try fd 7,8,9 -> host /
python3 scripts/runc_cwd_escape.py --cmd 'id; cat /etc/shadow'   # via docker -w or k8s revshell

# 2. Misconfig path: privileged / CAP_SYS_ADMIN -> cgroup release_agent host code exec
bash scripts/release_agent_escape.sh -c 'id > /tmp/escape_out'   # reads host PID list / runs cmd

# 3. GPU path: build a malicious image for NVIDIAScape (CVE-2025-23266)
bash scripts/nvidiascape_build.sh --cmd 'id; cat /etc/shadow' --tag evil-gpu:latest

# 4. K8s RBAC: audit who can escalate / reach the kubelet (needs a kubeconfig or in-pod SA token)
python3 scripts/k8s_rbac_audit.py --kubeconfig ~/.kube/config --dangerous

# 5. nodes/proxy or open kubelet -> exec into any pod on the node
python3 scripts/kubelet_exec.py --node 10.0.0.5 --pod kube-system/etcd-master \
        --container etcd --cmd 'cat /var/lib/etcd/...' --token "$SA_TOKEN"

Technique	Telemetry / IOC	Detection (Sigma/EDR/Falco)	OPSEC note
runc cwd-fd escape (CVE-2024-21626)	container process cwd under `/proc/self/fd/N`; `getcwd` ENOENT errors; host-path access from pid1	Falco `Container Drift`/unexpected host-fs read; alert on runtime < runc 1.1.12	No new files needed; works via `-w`/cwd only — very quiet, but lands on real host fs
runc 2025 trio (masked-path/console)	symlink swap of `/dev/null` or `/dev/pts/N`; RW open of `/proc/sysrq-trigger`/`core_pattern`	Falco "Write below /proc/sys"/sysrq; mount race anomalies	Symlink swap is a timing race; on failure may crash host (sysrq) — loud
release_agent / core_pattern	mount of cgroup/cgroup2; write to `*/release_agent` or `/proc/sys/kernel/core_pattern`	Falco `Detect release_agent File Container Escapes`; Sigma on write to core_pattern	Requires CAP_SYS_ADMIN+mount; release_agent is cgroup-v1 only
nsenter / hostPID	`nsenter --target 1`; process entering host mount/pid ns	Falco "nsenter" / `proc.name=nsenter` in container; ATT&CK T1611	hostPID is visible in pod spec; nsenter is a strong IOC
docker.sock abuse	`/var/run/docker.sock` mounted; `curl --unix-socket` create privileged container	Falco "Docker socket access by unexpected proc"; new privileged container event	Spawns a new privileged container — visible to docker/containerd events
NVIDIAScape (CVE-2025-23266)	image `ENV LD_PRELOAD=/proc/self/cwd/*.so`; nvidia hook loads .so from container fs	Falco shared-lib load by `nvidia-ctk`/hook from container path	Needs only image push + run; no kernel bug — image scan catches the ENV
nodes/proxy → kubelet exec	WebSocket GET to kubelet `/exec`/`/run` on :10250; no API-server audit entry	Runtime/L7 only — invisible to API audit & GuardDuty; monitor kubelet access log	Bypasses API-server audit & admission entirely — extremely stealthy
K8s RBAC privesc / SA-token theft	read of `/var/run/secrets/.../token`; `can-i` probes; bind to cluster-admin	API audit `create rolebindings`/`escalate`; Falco `Read SA token`	`kubectl auth can-i` probing is logged at API server
IngressNightmare (CVE-2025-1974)	AdmissionReview with injected NGINX directive; `.so` loaded from `/proc/<pid>/fd`	Sysdig/Falco "IngressNightmare"; shared-lib load from /proc in nginx	Code runs during `nginx -t` validation; controller SA grabs all-namespace secrets