HackSpeak/CVE-2026-17106

GitHubRepository PoCExploit

PoC files

12 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a complete exploit for CVE-2026-17106 (CopyEscape), a Docker `docker cp` arbitrary file write vulnerability. It contains C source code implementing a TOCTOU race condition attack using inotify and symlink pivoting, along with shell scripts to build and run the exploit in Docker containers targeting macOS and Linux hosts.

Backdoor review

No backdoor observed in reviewed code

The repository contains a proof-of-concept exploit for CVE-2026-17106 (CopyEscape). All reviewed source code and scripts implement the documented TOCTOU race condition to demonstrate arbitrary file write via 'docker cp'. The Linux variant targets /usr/bin/runc, and the macOS variant targets ~/pwnd, exactly as described in the README. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed harm beyond the stated exploit was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesCShell
Target softwareDocker Engine/CLIDocker DesktopDocker Sandboxes
Attack typesTOCTOU race conditionsymlink attackarbitrary file write
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains complete, compilable C code (monitor.c) that actively exploits a TOCTOU race condition to achieve arbitrary file write outside the container, along with shell scripts that build and execute the attack. This is code intended to exercise a vulnerability, not merely detect or report it.

linux/monitor.c:1-233macos/monitor.c:1-259macos/demo-macos.sh:1-88

Requirements

  • A vulnerable version of Docker (e.g., Engine/CLI 29.6.1, Desktop 4.81.0) must be installed on the host.README.md:18-19
  • The attacker must be able to build and run a malicious Docker container on the target host.macos/demo-macos.sh:54-60
  • The user must execute `docker cp` from the malicious container to the host.macos/demo-macos.sh:74-75

Observed behavior

  • The exploit sets up a directory layout inside the container with a regular file, a large trigger file, and a pre-staged symlink pointing to a host target directory.linux/monitor.c:117-131macos/monitor.c:142-156
  • A monitor process uses inotify to detect when `docker cp` accesses the trigger file, then performs a rename-based symlink pivot to replace a directory with the pre-staged symlink.linux/monitor.c:148-225macos/monitor.c:173-250
  • The TOCTOU race causes `docker cp` to follow the symlink and write files to an attacker-chosen location on the host (e.g., `/usr/bin/runc` on Linux or `~/pwnd` on macOS).README.md:11-14linux/monitor.c:23-24macos/monitor.c:60-62
  • The Linux variant overwrites `/usr/bin/runc` with a malicious script that creates a marker file, enabling subsequent root code execution.linux/monitor.c:123
  • The macOS variant creates a file `~/pwnd` in the user's home directory as a proof of successful exploitation.macos/monitor.c:148macos/demo-macos.sh:80-83
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Target
/usr/bin/runc (Linux) and ~/pwnd (macOS)The PoC overwrites these files to demonstrate the vulnerability, consistent with the README description.linux/monitor.c:23-24macos/monitor.c:60-62
Exploit Mechanism
TOCTOU symlink race via inotify and directory renameThe monitor programs use inotify to detect 'docker cp' access and perform a directory swap to redirect writes outside the container, matching the CVE description.linux/monitor.c:133-146macos/monitor.c:158-171
File Redirection
LD_PRELOAD library redirects /watched/file.txt to /watched/.file.txt.regularThe preload library hides the symlink directory from the container's own view, a necessary part of the PoC setup.linux/watched_preload.c:31-37macos/watched_preload.c:31-37
Review boundaries

What the analysis did not establish

  • The evidence packet reports 4 unclassified files (binary or other) that were not provided as text; their content is unknown.
  • The evidence packet reports complete_artifact_coverage is false; 4 of 12 total files were omitted from the text selection.
  • The CVE record for CVE-2026-17106 was absent from the acquired CVEList V5 dataset, so no authoritative CVE description is available for cross-reference.
  • 4 text files were omitted from the evidence packet due to size constraints; their content was not reviewed.
  • Binary files were not analyzed (binary_policy: FLAGGED_METADATA_ONLY_NOT_ANALYZED), though none were identified in the inventory.
  • The review is limited to the supplied static source code; runtime behavior was not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

2
GitHub

macos

Created Vuln labNo linked CVEDockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker-based vulnerability lab for CVE-2026-17106 (CopyEscape), demonstrating a TOCTOU race condition in 'docker cp' that allows a container to write arbitrary files on the macOS host. The lab builds a minimal Alpine container that monitors file access and performs a symlink pivot to escape the copy destination.

README.md:1-49macos/Dockerfile:1-22macos/demo-macos.sh:1-88

Lab assessment

Vulnerability lab

The README explicitly states the repository is a PoC for CVE-2026-17106, a 'docker cp' container-to-host arbitrary file write vulnerability. The Dockerfile, C source files, and demo script are all designed to reproduce this vulnerability in a controlled macOS environment.

README.md:1-3README.md:7-15macos/demo-macos.sh:1-88
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

minimal-monitor

vulnerability triggerTOCTOU race orchestrator

A C program that sets up a watched directory layout, creates a symlink to the host home directory, and uses inotify to detect access to a trigger file. Upon access, it performs a rename-based symlink pivot to redirect 'docker cp' extraction to the host home directory, writing a marker file 'pwnd'.

macos/monitor.c:1-259

libwatchedfile.so

file access redirectionLD_PRELOAD library

A shared library that intercepts open, openat, fopen, stat, and lstat calls via LD_PRELOAD. It redirects accesses to '/watched/file.txt' to '/watched/.file.txt.regular', ensuring that 'docker exec cat /watched/file.txt' reads the backing file while the monitor can still detect the access.

macos/watched_preload.c:1-89

minimal-entrypoint

container entrypointLD_PRELOAD unsetter

A shell script that unsets LD_PRELOAD and then execs minimal-monitor. This prevents the LD_PRELOAD redirection from affecting the monitor itself, ensuring the monitor can manipulate the real filesystem.

macos/entrypoint.sh:1-3

demo-macos.sh

lab runnerorchestration script

A shell script that builds the Docker image, runs the container with the host home directory as an environment variable, waits for readiness, executes 'docker cp' to trigger the vulnerability, and verifies that the marker file '~/pwnd' was created on the host.

macos/demo-macos.sh:1-88
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker Engine/CLI version 29.6.1 or Docker Desktop 4.81.0 (vulnerable versions) must be installed on macOS.README.md:19-20
  • The host must be running macOS, and the HOME environment variable must be set to a path under /Users/<username>.macos/demo-macos.sh:10-12macos/demo-macos.sh:22-28
  • The marker file '~/pwnd' must not already exist on the host.macos/demo-macos.sh:35-38
  • The copy destination file 'file.txt' in the demo root must not already exist.macos/demo-macos.sh:40-43

Evidence-described exercise path

  1. Build the Docker image from the macos/ directory using 'docker build'.macos/demo-macos.sh:50-51
  2. Run the container in detached mode, passing COPYESCAPE_HOST_HOME environment variable set to the host's HOME.macos/demo-macos.sh:53-57
  3. Wait for the container to become ready by polling 'docker exec cat /watched/file.txt' until it returns content.macos/demo-macos.sh:59-67
  4. Execute 'docker cp' to copy /watched/file.txt from the container to the local demo root, triggering the race condition.macos/demo-macos.sh:70-73
  5. Verify that the marker file '~/pwnd' was created on the host, indicating successful exploitation.macos/demo-macos.sh:75-79
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The lab is a self-contained vulnerability demonstration. The container writes a harmless marker file '~/pwnd' on the macOS host to prove the exploit, which is the documented and expected behavior. There is no evidence of hidden persistence, credential theft, data destruction, backdoor, or any behavior beyond the intended lab target. The demo script even refuses to overwrite existing files and cleans up after itself.

macos/demo-macos.sh:35-38macos/demo-macos.sh:75-79macos/demo-macos.sh:82-84
Review boundaries

What the analysis did not establish

  • The packet does not include the linux/ directory or its contents, so the Linux demonstration (which overwrites /usr/bin/runc) is not part of this unit's evidence.
  • The CVE-2026-17106 identifier is not present in the acquired CVE list, and the unit_cve_ids array is empty, so no CVE assessment is performed.
  • The Dockerfile uses privileged mode? No, it does not. The container runs without --privileged or host mounts, but the vulnerability itself allows host file writes via 'docker cp'.
  • The demo script is limited to macOS and will refuse to run on other platforms.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

linux

Created Vuln labNo linked CVEDockerfile

1 Dockerfile

AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Environment assessment

A Dockerized Linux environment for demonstrating CVE-2026-17106 (CopyEscape), a container-to-host arbitrary file write vulnerability via 'docker cp'. It builds a minimal monitor that sets up a race condition to overwrite /usr/bin/runc on the host.

README.md:1-49linux/Dockerfile:1-22

Lab assessment

Vulnerability lab

The README explicitly states it is a PoC for CVE-2026-17106, a Docker cp vulnerability. The Dockerfile and source code build a monitor and preload library to orchestrate a TOCTOU race condition, which is the core of the exploit demonstration.

README.md:1-3linux/monitor.c:1-233
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

minimal-monitor

exploit orchestratorrace condition trigger

A C program that sets up a directory layout with a symlink to /usr/bin, creates a fake 'runc' payload, and uses inotify to detect when a 'docker cp' operation accesses a trigger file. It then performs a rename-based symlink swap (pivot) to redirect the copy into the host's /usr/bin directory, overwriting /usr/bin/runc.

linux/monitor.c:16-25linux/monitor.c:120-150linux/monitor.c:152-233

libwatchedfile.so

LD_PRELOAD libraryfile access redirector

A shared library intended to be preloaded into processes inside the container. It intercepts open, openat, fopen, stat, and lstat calls, redirecting accesses from '/watched/file.txt' to '/watched/.file.txt.regular'. This is used to hide the real file from the 'docker cp' walk while the monitor manipulates the directory structure.

linux/watched_preload.c:1-89linux/Dockerfile:18

minimal-entrypoint

entrypoint scriptLD_PRELOAD unsetter

A shell script that unsets LD_PRELOAD before executing the minimal-monitor. This ensures the monitor itself does not have its file operations redirected by the preload library.

linux/entrypoint.sh:1-3linux/Dockerfile:20
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker Engine/CLI version 29.6.1 or Docker Desktop 4.81.0 (vulnerable versions).README.md:25-26
  • The container must be run with a volume mount for the /watched directory, or the 'docker cp' command must be executed from the host to copy the /watched directory out of the container.README.md:37-40
  • The 'docker cp' command must be executed with sufficient privileges to write to /usr/bin on the host (e.g., using sudo).README.md:23
  • The host must be a Linux system where overwriting /usr/bin/runc is the intended demonstration target.README.md:37-40

Evidence-described exercise path

  1. Build the Docker image from the linux/ directory.README.md:37-40
  2. Run the container, which executes the minimal-monitor to set up the exploit layout and wait for the race condition.linux/Dockerfile:20linux/monitor.c:120-233
  3. From the host, execute 'docker cp' to copy the /watched directory out of the running container. The monitor detects the access, performs the symlink swap, and the cp operation writes the fake 'runc' payload to /usr/bin/runc on the host.README.md:37-40linux/monitor.c:152-233
Safety-review evidence

Behaviors behind the stored safety assessment

Suspicious behavior

The lab is designed to overwrite the host's /usr/bin/runc binary with a payload that prints 'you have been pwned' and creates /imperva_red_team. This is a concrete, documented host compromise that occurs as part of the exercise. While disclosed in the README, the impact is real and severe, making the behavior suspicious.

linux/monitor.c:120-130README.md:37-40

Indicators requiring review

  • The monitor.c code writes a payload to /usr/bin/runc that prints 'you have been pwned' and creates /imperva_red_team, then sets up a symlink to redirect a 'docker cp' operation to overwrite the host's runc binary.linux/monitor.c:120-130linux/monitor.c:140-150
Review boundaries

What the analysis did not establish

  • The packet does not include the macos/ directory or any Docker Compose file, so the full multi-platform demonstration is not visible.
  • The exact 'docker cp' command and any required volume mounts are not specified in the provided files, only implied by the README.
  • The repository README references an upstream source (masasron/CopyEscape-CVE-2026-17106) which is not included in the packet.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1