module

DC/OS Marathon UI Docker Exploit

Try Surface Command
Back to search
Disclosed
2017-03-03
Created
2018-05-30

Description

Utilizing the DCOS Cluster's Marathon UI, an attacker can create
a docker container with the '/' path mounted with read/write
permissions on the host server that is running the docker container.
As the docker container executes command as uid 0 it is honored
by the host operating system allowing the attacker to edit/create
files owed by root. This exploit abuses this to creates a cron job
in the '/etc/cron.d/' path of the host server.

*Notes: The docker image must be a valid docker image from
hub.docker.com. Furthermore the docker container will only
deploy if there are resources available in the DC/OS cluster.

Author

Erik Daguerre

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/linux/http/dcos_marathon
    msf exploit(dcos_marathon) > show targets
        ...targets...
    msf exploit(dcos_marathon) > set TARGET < target-id >
    msf exploit(dcos_marathon) > show options
        ...show and set options...
    msf exploit(dcos_marathon) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today