CopyEscape: Arbitrary File Write in moby/go-archive Tar Extraction

Repository is a standalone PoC/distribution mirror for CopyEscape (CVE-2026-17106), a Docker `docker cp` container-to-host arbitrary file write vulnerability. It is not tied to a common exploit framework. The repo is split into `linux/` and `macos/` demos, each containing a Dockerfile, entrypoint wrapper, a C monitor program, and an LD_PRELOAD shared library; macOS also includes an orchestration script `demo-macos.sh`. Core exploit structure: the container exposes `/watched/file.txt` as the apparent copy source, but `watched_preload.c` intercepts `open/openat/fopen/stat/lstat` and redirects accesses on that path to `/watched/.file.txt.regular`, making it look like a normal top-level file. Meanwhile `monitor.c` prepares a crafted directory tree under `/watched/file.txt/`, including a large child file `aaa.txt` and a directory `escape`. It uses inotify to detect when Docker's archive/walk logic opens/accesses `aaa.txt`; at that precise moment it renames `escape` out of the way and swaps in a symlink (`.swap-escape`) pointing to a host path. This exploits the TOCTOU/symlink handling flaw described in the README so that subsequent extraction on the host follows the symlink and writes outside the intended destination. Linux path: `linux/monitor.c` targets `/usr/bin/runc`, writing a bash script payload there and marking it executable. If a privileged user runs `docker cp`, later Docker/runc activity can execute the replaced binary, yielding host code execution and creating `/imperva_red_team` as proof. macOS path: `macos/monitor.c` derives the target from `COPYESCAPE_HOST_HOME` and writes a benign marker file `<home>/pwnd`; `macos/demo-macos.sh` builds the image, runs the container, waits until ready, and invokes `docker cp` to demonstrate success. Overall purpose: provide a practical, reproducible exploit demonstrating that a malicious container can coerce a vulnerable Docker client into overwriting arbitrary host files during `docker cp`, with a safe-ish macOS marker demo and a destructive Linux privilege-escalation demonstration.

This repository is a real proof-of-concept exploit for CVE-2026-17106 ('CopyEscape'), targeting a flaw in Docker `docker cp` handling. It contains two parallel demonstrations under `linux/` and `macos/`, each built around the same technique: make `/watched/file.txt` appear to be a normal file to processes inside the container while the Docker daemon encounters a directory tree that can be pivoted into a symlink during archive creation. The exploit races Docker’s archive producer so the tar stream contains a symlink followed by a child entry beneath it; a vulnerable Docker CLI then follows that symlink during extraction and writes outside the user-selected local destination. Repository structure: both `linux/` and `macos/` contain a `Dockerfile`, `entrypoint.sh`, `monitor.c`, and `watched_preload.c`. The Dockerfiles compile a monitor binary and an LD_PRELOAD shared library inside Alpine, then package them into a runtime image. `entrypoint.sh` unsets `LD_PRELOAD` before launching the monitor so only ordinary container processes see the redirected file behavior, while the monitor itself sees the real filesystem layout. `watched_preload.c` hooks `open`, `openat`, `fopen`, `stat`, and `lstat` to transparently redirect access from `/watched/file.txt` to `/watched/.file.txt.regular`, preserving the illusion that the watched path is a regular file. `monitor.c` creates the malicious directory/symlink layout, writes the payload file, watches filesystem activity with inotify, and performs the rename-based pivot when `aaa.txt` is accessed during `docker cp` traversal. Linux PoC purpose and capability: `linux/monitor.c` stages a symlink to `/usr/bin` and writes an attacker-controlled replacement script to `/usr/bin/runc`. When the race succeeds, the host-side extraction overwrites `/usr/bin/runc`; subsequent execution of that path creates `/imperva_red_team`, demonstrating privileged host impact and effective code execution as root. This is a destructive local/container-to-host escape demonstration requiring root-level consequences on the Docker client host. macOS PoC purpose and capability: `macos/monitor.c` derives the host target from `COPYESCAPE_HOST_HOME`, stages a symlink to the user’s home directory, and writes a benign marker payload to `<HOME>/pwnd`. `macos/demo-macos.sh` automates image build, container startup, readiness checks, and the triggering `docker cp` command. Successful exploitation creates `~/pwnd`, demonstrating arbitrary host file write on Docker Desktop without destructive runtime replacement. No external network communication, C2, or remote endpoints are present. The exploit is local/container-based and relies on Docker CLI interaction with a malicious container rather than network delivery.