container-k8s-escape

Featured

Use when breaking out of a container or escalating inside Kubernetes — runc/BuildKit CVEs, privileged/capability/cgroup misconfig escapes, NVIDIA GPU toolkit escape, K8s RBAC abuse, kubelet RCE, ingress/admission-controller RCE, node-to-cluster pivot

DevOps & Infrastructure 382 stars 66 forks Updated 5 days ago MIT

Install

View on GitHub

Quality Score: 95/100

Stars 20%
86
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
80
License 10%
100
Description 5%
100

Skill Content

# Container Breakout & Kubernetes Escape ## When to Activate - You have code execution inside a container/pod and want to break out to the host node - Auditing a Kubernetes cluster for RBAC privilege-escalation and lateral-movement paths - Assessing runc/containerd/BuildKit/Docker runtime versions against known escape CVEs - A pod is privileged, has dangerous capabilities, hostPath/hostPID/hostNetwork, or a mounted docker.sock - Attacking GPU/AI workloads using the NVIDIA Container Toolkit - Testing ingress-nginx / admission-controller exposure for unauthenticated RCE - Post-escape: pivoting from one node to full cluster takeover (kubelet, SA tokens, etcd, cloud IMDS) - Building Falco/Sigma detections for container-escape behavior (defensive validation) ## Technique Map | Technique | ATT&CK | CWE | Reference | Script | |-----------|--------|-----|-----------|--------| | runc working-dir fd leak escape (Leaky Vessels, CVE-2024-21626) | T1611 | CWE-403 | references/runtime-cve-escapes.md | scripts/runc_cwd_escape.py | | runc masked-path / `/dev/null` symlink escape (CVE-2025-31133) | T1611 | CWE-367 | references/runtime-cve-escapes.md | scripts/runc_cwd_escape.py | | runc `/dev/console` bind-mount + LSM bypass (CVE-2025-52565/52881) | T1611 | CWE-363 | references/runtime-cve-escapes.md | scripts/escape_enum.sh | | BuildKit cache/teardown symlink escape (CVE-2024-23651/52/53) | T1611 | CWE-59 | references/runtime-cve-escapes.md | scripts/escape_enum.sh | | Privileged / `CAP_...

Details

Author
hypnguyen1209
Repository
hypnguyen1209/offensive-claude
Created
4 months ago
Last Updated
5 days ago
Language
Python
License
MIT

Integrates with

Kubernetes · Infrastructure

Bundled in these plugins

offensive-claude

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Listed

container-escape

Container escape methodology for Docker and Kubernetes. Covers privileged container breakout, mounted socket exploitation, capabilities abuse, cgroup v1 escape, and K8s node compromise.

5 Updated yesterday
sunilgentyala
DevOps & Infrastructure Featured

offensive-container-escape

Container escape and breakout techniques targeting Docker, containerd, and Podman runtimes. Covers privileged container breakout via host filesystem mount and nsenter, Docker socket abuse through /var/run/docker.sock, Linux capability exploitation including CAP_SYS_ADMIN, CAP_SYS_PTRACE, and CAP_NET_ADMIN, cgroup v1 notify_on_release escape, runc CVEs such as CVE-2019-5736 and CVE-2024-21626 Leaky Vessels, kernel exploits from within containers, and Dockerfile misconfigurations like --privileged and host namespace sharing. Includes enumeration with capsh, amicontained, deepce, CDK, and nsenter. Maps to MITRE ATT&CK T1611 Escape to Host. Use this skill when the engagement scope includes container breakout, Docker escape, container privilege escalation, host access from container, or when you land inside a containerized environment and need to reach the underlying host.

6,950 Updated 6 days ago
SnailSploit
DevOps & Infrastructure Listed

cloud-container-escape

Break out of a container to the host. Load when you have a shell in a container/pod and want the node: privileged container, mounted docker.sock, dangerous capabilities, hostPath, or "escape the container". Signals: /.dockerenv, cgroup shows docker/k8s, CAP_SYS_ADMIN, mounted socket.

19 Updated 5 days ago
NoorQureshi