exploiters: Fix extraction of container IP address

[razvand]

The JSON structure for the container IP address is not correct. Update to the current (potentially new) path in the JSON schema when inspecting a container.

[Copilot]

Pull request overview

Updates the Docker container inspection logic used by the zeratool exploiter to retrieve the container’s IP address from the newer Docker inspection JSON structure.

Changes:

• Adjust container IP extraction to use NetworkSettings.Networks.<network>.IPAddress instead of NetworkSettings.IPAddress.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

automatic_exploit_generation/exploiters/zeratool/zeratool.py:91

• container.kill() is only called after a successful gRPC request (and in the missing-IP branch). If _request_exploitation_to_grpc_service raises, the container will be left running. Consider wrapping the request in a try/finally so the container is always terminated.

        if not container_ip:
            container.kill()
            raise RuntimeError("Could not determine container IP address.")
        exploit = self._request_exploitation_to_grpc_service(
            container_ip, overflow_only, format_only, win_funcs

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (3)

automatic_exploit_generation/exploiters/zeratool/zeratool.py:98

• Unconditional container.kill() in finally can raise and override the original exception (or even a successful return), making failures harder to diagnose. Cleanup in finally should not be allowed to mask the main control flow; suppress/handle kill errors.

        finally:
            container.kill()

automatic_exploit_generation/exploiters/zeratool/zeratool.py:87

• When multiple networks are attached, next(iter(networks.values())) may pick a network entry without an IPAddress even if another network has one. This can cause false failures determining the container IP. Prefer iterating networks until a non-empty IPAddress is found (still preferring bridge).

            if "bridge" in networks:
                container_ip = (networks.get("bridge", {}) or {}).get("IPAddress")
            elif networks:
                container_ip = (next(iter(networks.values())) or {}).get("IPAddress")
            else:

automatic_exploit_generation/exploiters/zeratool/zeratool.py:90

• container.kill() is called both here and again in the finally block. If the first kill succeeds, the second kill may raise (e.g., container already stopped) and can interfere with the intended error path. The finally block already guarantees cleanup.

This issue also appears on line 97 of the same file.

            if not container_ip:
                container.kill()
                raise RuntimeError("Could not determine container IP address.")

[ClaraStefania]

It works as expected.