From b20a0db319567d38c49abfd8d42d6d230725635c Mon Sep 17 00:00:00 2001 From: SirBroccoli Date: Mon, 22 Jun 2026 12:00:16 +0200 Subject: [PATCH 1/2] Auto-merge PR #651 (Chack Agent) Co-authored-by: HackTricks PEASS Wordlist Updater --- .../linpeas_parts/variables/kernel_cve_registry_data.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/linPEAS/builder/linpeas_parts/variables/kernel_cve_registry_data.sh b/linPEAS/builder/linpeas_parts/variables/kernel_cve_registry_data.sh index 6c9b4f9..8a779e8 100644 --- a/linPEAS/builder/linpeas_parts/variables/kernel_cve_registry_data.sh +++ b/linPEAS/builder/linpeas_parts/variables/kernel_cve_registry_data.sh @@ -1,7 +1,7 @@ # Title: Variables - kernel_cve_registry_data # ID: kernel_cve_registry_data # Author: Carlos Polop -# Last Update: 08-06-2026 +# Last Update: 22-06-2026 # Description: Embedded kernel exploit matching datasets extracted from linux-exploit-suggester and linux-exploit-suggester-2 examples. Data is split across KERNEL_CVE_DATA_1..X with a maximum of 25 rows per env variable. This file also stores reference-only CVE tokens found in example repos when no explicit suggester matching rule exists. # License: GNU GPL # Version: 1.0 @@ -610,8 +610,10 @@ CVE-2017-16994 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token CVE-2020-27171 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token from example repos; appears as related comment in exploit source CVE-2024-0193 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token from example repos; appears as upstream source reference CVE-2026-43284 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token from official Ubuntu/Red Hat Dirty Frag advisories; no stable matcher added +CVE-2026-43494 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token from official Ubuntu PinTheft advisory; no stable matcher added CVE-2026-43500 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token from official Ubuntu/Red Hat Dirty Frag advisories; no stable matcher added CVE-2026-46243 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token from official Red Hat CIFSwitch advisory; no stable matcher added CVE-2026-46300 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token from official Ubuntu/Red Hat Fragnesia advisories; no stable matcher added +CVE-2026-46333 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token from official Ubuntu/Red Hat ssh-keysign-pwn advisories; no stable matcher added EOF_DATA_21 )" From a7a09a338e224f91721a80aef1613df7ee5cf752 Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Wed, 24 Jun 2026 13:30:12 +0200 Subject: [PATCH 2/2] CVE-2025-9074 --- .../2_container/4_Docker_container_details.sh | 4 ++- .../functions/enumerateDockerDesktopAPI.sh | 36 +++++++++++++++++++ 2 files changed, 39 insertions(+), 1 deletion(-) create mode 100644 linPEAS/builder/linpeas_parts/functions/enumerateDockerDesktopAPI.sh diff --git a/linPEAS/builder/linpeas_parts/2_container/4_Docker_container_details.sh b/linPEAS/builder/linpeas_parts/2_container/4_Docker_container_details.sh index d795587..b5087ae 100644 --- a/linPEAS/builder/linpeas_parts/2_container/4_Docker_container_details.sh +++ b/linPEAS/builder/linpeas_parts/2_container/4_Docker_container_details.sh @@ -6,7 +6,7 @@ # License: GNU GPL # Version: 1.0 # Mitre: T1613 -# Functions Used: checkDockerRootless, checkDockerVersionExploits, containerCheck, enumerateDockerSockets, inDockerGroup, print_2title, print_list +# Functions Used: checkDockerRootless, checkDockerVersionExploits, containerCheck, enumerateDockerDesktopAPI, enumerateDockerSockets, inDockerGroup, print_2title, print_list # Global Variables: $containerType, $DOCKER_GROUP, $DOCKER_ROOTLESS, $dockerVersion, $inContainer, $VULN_CVE_2019_5736, $VULN_CVE_2019_13139, $VULN_CVE_2021_41091 # Initial Functions: containerCheck # Generated Global Variables: @@ -29,6 +29,8 @@ if echo "$containerType" | grep -qi "docker"; then if [ "$inContainer" ]; then checkDockerRootless print_list "Rootless Docker? ............... $DOCKER_ROOTLESS\n"$NC | sed -${E} "s,No,${SED_RED}," | sed -${E} "s,Yes,${SED_GREEN}," + print_list "Checking Docker Desktop internal Engine API (CVE-2025-9074):\n"$NC + enumerateDockerDesktopAPI echo "" fi if df -h | grep docker; then diff --git a/linPEAS/builder/linpeas_parts/functions/enumerateDockerDesktopAPI.sh b/linPEAS/builder/linpeas_parts/functions/enumerateDockerDesktopAPI.sh new file mode 100644 index 0000000..08023bc --- /dev/null +++ b/linPEAS/builder/linpeas_parts/functions/enumerateDockerDesktopAPI.sh @@ -0,0 +1,36 @@ +# Title: Container - enumerateDockerDesktopAPI +# ID: enumerateDockerDesktopAPI +# Author: Carlos Polop +# Last Update: 24-06-2026 +# Description: Check from inside a container if the Docker Desktop internal Engine API (CVE-2025-9074) is reachable over TCP on 192.168.65.7:2375 even when the docker socket is NOT mounted, which allows a full container escape. +# License: GNU GPL +# Version: 1.0 +# Functions Used: +# Global Variables: $GREP_DOCKER_SOCK_INFOS, $GREP_DOCKER_SOCK_INFOS_IGNORE +# Initial Functions: +# Generated Global Variables: $SEARCHED_DOCKER_DESKTOP_API, $ddEndpoint, $ddInfoResponse +# Fat linpeas: 0 +# Small linpeas: 1 + + +enumerateDockerDesktopAPI() { + if ! [ "$SEARCHED_DOCKER_DESKTOP_API" ]; then + SEARCHED_DOCKER_DESKTOP_API="1" + # Docker Desktop exposes its internal Engine API on the VM services host 192.168.65.7. + # CVE-2025-9074 (fixed in Docker Desktop 4.44.3) let a container reach this UNAUTHENTICATED + # Engine API on 192.168.65.7:2375 even when /var/run/docker.sock was NOT mounted, enabling a + # full container escape (e.g. creating a container that bind-mounts the host filesystem). + # Ref: https://nvd.nist.gov/vuln/detail/CVE-2025-9074 + ddEndpoint="http://192.168.65.7:2375/info" + ddInfoResponse="" + if [ "$(command -v curl 2>/dev/null || echo -n '')" ]; then + ddInfoResponse="$(curl -s --max-time 3 "$ddEndpoint" 2>/dev/null)" + elif [ "$(command -v wget 2>/dev/null || echo -n '')" ]; then + ddInfoResponse="$(wget -q -T 3 -O - "$ddEndpoint" 2>/dev/null)" + fi + if echo "$ddInfoResponse" | grep -q "ServerVersion"; then + echo "Docker Desktop internal Engine API (CVE-2025-9074) reachable at 192.168.65.7:2375 - container escape possible!" | sed -${E} "s,reachable at 192.168.65.7:2375,${SED_RED_YELLOW},g" + echo "$ddInfoResponse" | tr ',' '\n' | grep -E "$GREP_DOCKER_SOCK_INFOS" | grep -v "$GREP_DOCKER_SOCK_INFOS_IGNORE" | tr -d '"' + fi + fi +}