builder stage
build environment
Uses golang:1.25 to compile evil.go into a C shared library (evil.so) with a constructor function.
Dockerfile:1-5r0binak/CVE-2025-23266
PoC files
3 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
The artifact is a weaponized exploit for CVE-2025-23266 in the NVIDIA Container Toolkit. It builds a shared library (evil.so) that, when loaded via LD_PRELOAD inside a container, switches to the host network namespace and spawns a reverse shell to a configurable IP and port.
Backdoor review
No backdoor observed in reviewed code
The artifact is a proof-of-concept exploit for CVE-2025-23266 in NVIDIA Container Toolkit. It builds a shared library (evil.so) that, when loaded via LD_PRELOAD, switches to the host network namespace and connects back to a configurable IP/port to provide a reverse shell. The behavior is fully disclosed in the README and source code, with no concealed or materially misrepresented actions. The reverse shell target defaults to 172.17.0.1:2333 (a common Docker bridge gateway) but is overridable via environment variables. No unrelated payloads, data exfiltration, or hidden persistence mechanisms are present.
ClassificationExploit
Model confidence95%
AuthenticationUnknown
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The artifact contains complete, functional code that actively exploits the vulnerability to escape the container network namespace and establish a reverse shell. The README explicitly describes it as a 'Fully Weaponized NVIDIA Container Toolkit Exploit'.
README.md:2evil.go:1-62Requirements
- The attacker must be able to run a container with the NVIDIA Container Toolkit hooks enabled and set the LD_PRELOAD environment variable to point to the malicious shared library.
Dockerfile:10 - The malicious shared library (evil.so) must be present in the container's working directory.
Dockerfile:9
Observed behavior
- Builds a Go shared library (evil.so) with a constructor function that executes automatically when loaded.
Dockerfile:1-6evil.go:3-5 - The constructor function switches the process's network namespace to that of PID 1 (the host) using setns.
evil.go:19-34 - After escaping the container's network namespace, the exploit removes the LD_PRELOAD variable and deletes the evil.so file to clean up.
evil.go:39-40 - The exploit connects back to a configurable IP address and port (defaulting to 172.17.0.1:2333) and spawns a /bin/sh reverse shell, redirecting stdin, stdout, and stderr to the connection.
evil.go:42-59
Behaviors behind the backdoor verdict
Observables
- Reverse Shell
- net.Dial("tcp", ip+":"+port) with /bin/sh stdin/stdout/stderr piped to connectionThe exploit payload establishes a reverse shell to a configurable IP and port, which is the disclosed purpose of the PoC.
evil.go:51-59 - Network Namespace Escape
- unix.Setns to /proc/1/ns/netThe exploit switches to the host network namespace to escape container isolation, consistent with the CVE description.
evil.go:22-33 - Default Connection Target
- 172.17.0.1:2333Default fallback IP and port if TARGET_IP/TARGET_PORT environment variables are not set. This is a common Docker bridge IP, not a concealed third-party address.
evil.go:44-49
What the analysis did not establish
- The analysis is based solely on the provided source code and metadata; the code was not executed, and its effectiveness or reliability is not verified.
- The evidence does not include any runtime output, network captures, or logs confirming successful exploitation.
- The artifact was not executed; analysis is based solely on static review of the provided source code.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Docker lab environments
1GitHubRepository root
Created Vuln labCVE-2025-23266Dockerfile
Analysis
Environment assessment
A single Dockerfile environment that builds a shared library (evil.so) from Go source, then copies it into a BusyBox container where it is preloaded via LD_PRELOAD. The library, upon loading, attempts to enter the host network namespace and connect back to a configurable IP/port to provide a shell.
Dockerfile:1-13evil.go:1-62Lab assessment
Vulnerability labThe README explicitly states 'CVE-2025-23266 – Fully Weaponized NVIDIA Container Toolkit Exploit' and references a ctrsploit repository. The Dockerfile and Go code implement a container escape technique using LD_PRELOAD and network namespace manipulation, consistent with a vulnerability research lab for CVE-2025-23266.
README.md:1-2Dockerfile:1-13evil.go:1-62Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Services and files described by the evidence
runtime container
exploit delivery vehicle
Based on busybox, copies the built evil.so, sets LD_PRELOAD to load it automatically, and configures NVIDIA driver capabilities and target connection parameters. The preloaded library executes the exploit payload.
Dockerfile:7-12evil.go / evil.so
exploit payload
A Go shared library with a constructor (loader) that attempts to join the host network namespace (PID 1), then removes itself and connects to a target IP/port (default 172.17.0.1:2333) to spawn a reverse shell (/bin/sh).
evil.go:1-62How the supplied evidence relates each vulnerability
CVE-2025-23266
Supported by supplied evidence
The README explicitly associates the repository with CVE-2025-23266 and describes it as a 'Fully Weaponized NVIDIA Container Toolkit Exploit'. The code implements a container escape via network namespace manipulation, which aligns with known NVIDIA Container Toolkit vulnerabilities. The reference to ctrsploit further supports this association.
README.md:1-2evil.go:1-62Requirements and sequence described by the evidence
Prerequisites
- The container must be run with sufficient privileges to perform setns into the host network namespace (e.g., --privileged or CAP_SYS_ADMIN).
evil.go:20-30 - The host must have NVIDIA Container Toolkit installed and configured, as the exploit targets CVE-2025-23266.
README.md:1-2 - A listener must be set up on the target IP and port (default 172.17.0.1:2333) to receive the reverse shell.
evil.go:42-50
Evidence-described exercise path
- Build the Docker image using the provided Dockerfile.
Dockerfile:1-13 - Run the container with necessary privileges (e.g., --privileged) and ensure NVIDIA Container Toolkit is available on the host.
README.md:1-2 - Set up a netcat listener on the host (or target IP) on port 2333.
evil.go:42-50 - The container starts, LD_PRELOAD triggers the evil.so constructor, which escapes to the host network namespace and connects back to the listener, providing a shell.
evil.go:33-58
Behaviors behind the stored safety assessment
No harmful behavior observed
The exploit payload targets the host network namespace and establishes a reverse shell to an operator-configured listener. This is expected behavior for a documented container escape demonstration. No evidence of automatic targeting of unrelated systems, data destruction, persistence, or credential theft is present. The default target IP 172.17.0.1 is a common Docker bridge gateway, and the port is configurable via environment variables.
evil.go:33-58Dockerfile:10-11What the analysis did not establish
- The packet does not include a docker-compose.yml or explicit run command, so the exact runtime privileges required are not specified.
- The exploit's success depends on host configuration (NVIDIA Container Toolkit, kernel capabilities) which is not verified in the supplied evidence.
- The reference to ctrsploit repository is external and its content is not included in the packet.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.