Container K8s Escape

hypnguyen1209/container-k8s-escape

Use when breaking out of a container or escalating inside Kubernetes — runc/BuildKit CVEs, privileged/capability/cgroup misconfig escapes, NVIDIA GPU toolkit escape, K8s RBAC abuse, kubelet RCE, ingress/admission-controller RCE, node-to-cluster pivot

23k tokens

context cost

the whole folder, loaded on every use

files

ships runnable scripts

copies elsewhere

how many repositories repackaged it

334

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill container-k8s-escape

What comes with it

80 507 bytes besides the instruction

references/ingress-admission-attacks.md

references/k8s-rbac-escalation.md

references/node-host-pivot.md

references/nvidia-gpu-escape.md

references/privileged-misconfig-escape.md

references/runtime-cve-escapes.md

scripts/escape_enum.sh

scripts/k8s_rbac_audit.py

scripts/kubelet_exec.py

scripts/nvidiascape_build.sh

scripts/release_agent_escape.sh

scripts/runc_cwd_escape.py

The instruction itself

6 sections, as written by the author

Container Breakout & Kubernetes Escape

When to Activate

You have code execution inside a container/pod and want to break out to the host node
Auditing a Kubernetes cluster for RBAC privilege-escalation and lateral-movement paths
Assessing runc/containerd/BuildKit/Docker runtime versions against known escape CVEs
A pod is privileged, has dangerous capabilities, hostPath/hostPID/hostNetwork, or a mounted docker.sock
Attacking GPU/AI workloads using the NVIDIA Container Toolkit
Testing ingress-nginx / admission-controller exposure for unauthenticated RCE
Post-escape: pivoting from one node to full cluster takeover (kubelet, SA tokens, etcd, cloud IMDS)
Building Falco/Sigma detections for container-escape behavior (defensive validation)

Technique Map

|-----------|--------|-----|-----------|--------|

Quick Start

# 0. Enumerate the container/pod context: caps, mounts, sockets, runtime versions, K8s creds
bash scripts/escape_enum.sh                 # run INSIDE the target container

# 1. Runtime-CVE path: detect vulnerable runc/BuildKit and run the cwd-fd escape (CVE-2024-21626)
python3 scripts/runc_cwd_escape.py --probe                       # try fd 7,8,9 -> host /
python3 scripts/runc_cwd_escape.py --cmd 'id; cat /etc/shadow'   # via docker -w or k8s revshell

# 2. Misconfig path: privileged / CAP_SYS_ADMIN -> cgroup release_agent host code exec
bash scripts/release_agent_escape.sh -c 'id > /tmp/escape_out'   # reads host PID list / runs cmd

# 3. GPU path: build a malicious image for NVIDIAScape (CVE-2025-23266)
bash scripts/nvidiascape_build.sh --cmd 'id; cat /etc/shadow' --tag evil-gpu:latest

# 4. K8s RBAC: audit who can escalate / reach the kubelet (needs a kubeconfig or in-pod SA token)
python3 scripts/k8s_rbac_audit.py --kubeconfig ~/.kube/config --dangerous

# 5. nodes/proxy or open kubelet -> exec into any pod on the node
python3 scripts/kubelet_exec.py --node 10.0.0.5 --pod kube-system/etcd-master \
        --container etcd --cmd 'cat /var/lib/etcd/...' --token "$SA_TOKEN"

Recommended tooling: deepce / cdk / amicontained (in-container recon), peirates (K8s pivot),

kube-hunter (cluster scan), kubeletctl (kubelet API), crictl (post-escape node control),

falco (defensive validation of every technique below).

OPSEC & Detection (summary)

|-----------|-----------------|------------------------------|------------|

| runc cwd-fd escape (CVE-2024-21626) | container process cwd under /proc/self/fd/N; getcwd ENOENT errors; host-path access from pid1 | Falco Container Drift/unexpected host-fs read; alert on runtime < runc 1.1.12 | No new files needed; works via -w/cwd only — very quiet, but lands on real host fs |

| runc 2025 trio (masked-path/console) | symlink swap of /dev/null or /dev/pts/N; RW open of /proc/sysrq-trigger/core_pattern | Falco "Write below /proc/sys"/sysrq; mount race anomalies | Symlink swap is a timing race; on failure may crash host (sysrq) — loud |

| release_agent / core_pattern | mount of cgroup/cgroup2; write to */release_agent or /proc/sys/kernel/core_pattern | Falco Detect release_agent File Container Escapes; Sigma on write to core_pattern | Requires CAP_SYS_ADMIN+mount; release_agent is cgroup-v1 only |

| nsenter / hostPID | nsenter --target 1; process entering host mount/pid ns | Falco "nsenter" / proc.name=nsenter in container; ATT&CK T1611 | hostPID is visible in pod spec; nsenter is a strong IOC |

| docker.sock abuse | /var/run/docker.sock mounted; curl --unix-socket create privileged container | Falco "Docker socket access by unexpected proc"; new privileged container event | Spawns a *new* privileged container — visible to docker/containerd events |

| NVIDIAScape (CVE-2025-23266) | image ENV LD_PRELOAD=/proc/self/cwd/*.so; nvidia hook loads .so from container fs | Falco shared-lib load by nvidia-ctk/hook from container path | Needs only image push + run; no kernel bug — image scan catches the ENV |

| nodes/proxy → kubelet exec | WebSocket GET to kubelet /exec//run on :10250; no API-server audit entry | Runtime/L7 only — invisible to API audit & GuardDuty; monitor kubelet access log | Bypasses API-server audit & admission entirely — extremely stealthy |

| K8s RBAC privesc / SA-token theft | read of /var/run/secrets/.../token; can-i probes; bind to cluster-admin | API audit create rolebindings/escalate; Falco Read SA token | kubectl auth can-i probing is logged at API server |

| IngressNightmare (CVE-2025-1974) | AdmissionReview with injected NGINX directive; .so loaded from /proc/<pid>/fd | Sysdig/Falco "IngressNightmare"; shared-lib load from /proc in nginx | Code runs during nginx -t validation; controller SA grabs all-namespace secrets |

Deep Dives

references/runtime-cve-escapes.md — runc CVE-2024-21626 (working-dir fd leak), the Nov-2025 runc trio (CVE-2025-31133/52565/52881 masked-path & /dev/console), and the BuildKit Leaky Vessels CVEs, with full PoCs and version matrices.
references/privileged-misconfig-escape.md — --privileged/capability escapes: cgroup-v1 release_agent, core_pattern, hostPID+nsenter, mounted docker/containerd sockets, and hostPath// mounts, with complete scripts.
references/nvidia-gpu-escape.md — NVIDIAScape (CVE-2025-23266 LD_PRELOAD OCI-hook) and the CVE-2024-0132 / CVE-2025-23359 TOCTOU mount escapes in the NVIDIA Container Toolkit; build-and-run PoCs.
references/k8s-rbac-escalation.md — RBAC privilege escalation (wildcards, escalate/bind, pods/exec, impersonation), SA-token harvest, the nodes/proxy GET → kubelet WebSocket exec RCE, and open kubelet :10250.
references/ingress-admission-attacks.md — IngressNightmare (CVE-2025-1974 + the annotation-injection chain), admission-webhook abuse, and how a controller SA leads to cluster-wide secret theft.
references/node-host-pivot.md — post-escape playbook: from one node to the whole cluster — etcd looting, kubelet/crictl, SA-token mining across pods, cloud IMDS role theft, and the defensive counterweight.

How to use it

Copy the folder

Take hypnguyen1209/container-k8s-escape from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.

Install what it needs

The instructions reference docker. Without those the skill loads but fails at the first command.