Docker release_agent cgroups escape
Kwa maelezo zaidi, rejelea blogu ya asili. Hii ni muhtasari tu:
Original PoC:
The proof of concept (PoC) demonstrates a method to exploit cgroups by creating a release_agent
file and triggering its invocation to execute arbitrary commands on the container host. Here's a breakdown of the steps involved:
Tayarisha Mazingira:
A directory
/tmp/cgrp
is created to serve as a mount point for the cgroup.The RDMA cgroup controller is mounted to this directory. In case of absence of the RDMA controller, it's suggested to use the
memory
cgroup controller as an alternative.
Set Up the Child Cgroup:
Cgroup ya mtoto inayoitwa "x" inaundwa ndani ya saraka ya cgroup iliyowekwa.
Arifa zinawekwa kuwa active kwa cgroup "x" kwa kuandika 1 kwenye faili yake ya notify_on_release.
Sanidi Wakala wa Kutolewa:
Njia ya kontena kwenye mwenyeji inapatikana kutoka kwa faili ya /etc/mtab.
Faili ya release_agent ya cgroup kisha inasanidiwa kutekeleza skripti inayoitwa /cmd iliyoko kwenye njia ya mwenyeji iliyopatikana.
Create and Configure the /cmd Script:
Skripti ya /cmd inaundwa ndani ya kontena na inasanidiwa kutekeleza ps aux, ikielekeza matokeo kwenye faili linaloitwa /output ndani ya kontena. Njia kamili ya /output kwenye mwenyeji imeainishwa.
Trigger the Attack:
Mchakato unaanzishwa ndani ya cgroup ya mtoto "x" na mara moja unakatishwa.
Hii inasababisha
release_agent
(script ya /cmd), ambayo inatekeleza ps aux kwenye mwenyeji na kuandika matokeo kwenye /output ndani ya kontena.
Last updated