Docker Group
The current user,
eleanor
, has many group memberships including, docker
. This was pointed out by PEAS at a later stage.
I could mount the root filesystem of the host machine to an instance’s volume, so when the instance starts it immediately loads a chroot into that volume. This effectively gives root access on the machine.
Moving on to the Privilege Escalation phase