offensive-container-escape

# Container Escape and Breakout You have a shell inside a container. Your objective is to break out to the underlying host operating system. Container isolation relies on Linux namespaces, cgroups, seccomp profiles, AppArmor/SELinux, and dropped capabilities. Every misconfiguration in these layers is an escape vector. This skill walks you through systematic enumeration, exploitation of common misconfigurations, abuse of exposed runtime sockets, capability-based escapes, cgroup breakouts, and known CVEs against container runtimes. ## Quick Workflow 1. Confirm you are inside a container (check for `.dockerenv`, cgroup entries, PID 1 process). 2. Enumerate capabilities, mounts, namespaces, and sockets with automated tools. 3. Identify the escape vector: privileged mode, socket exposure, dangerous capabilities, cgroup misconfiguration, or vulnerable runtime. 4. Execute the breakout technique matching the vector. 5. Validate host access by reading `/etc/hostname`, checking PID namespace, or writing to host filesystem. 6. Pivot from host access to lateral movement across the cluster or infrastructure. --- ## Phase 1: Container Detection and Enumeration Before attempting escape, confirm you are containerized and map the attack surface. ### Detecting Container Environment ```bash # Check for Docker marker file ls -la /.dockerenv # Check cgroup entries for container identifiers cat /proc/1/cgroup | grep -E 'docker|containerd|kubepods|podman' # Check PID 1 process (containers...