Kernel Module Breakout

Break out of the container by abusing the SYS_MODULE capability

info:

Cap_sys_module allows you to Load and unload kernel modules

Requirements:

1. CAP_SYS_MODULE
2. Relevant version of the generic kernel module exists in the container, it is located in the host in /lib/modules/$(uname -r)
3. make && insmod command exists in the container

Exploit:

1. Create a reverse shell kernel module
2. Create makefile for the kernel module
3. Use insmodto load the module into the kernel