Docker Group


The current user, eleanor, has many group memberships including, docker. This was pointed out by PEAS at a later stage.

I could mount the root filesystem of the host machine to an instance’s volume, so when the instance starts it immediately loads a chroot into that volume. This effectively gives root access on the machine.

Moving on to the Privilege Escalation phase