Docker release_agent cgroups escape
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Kwa maelezo zaidi, rejelea blogu ya asili. Hii ni muhtasari tu:
Original PoC:
The proof of concept (PoC) demonstrates a method to exploit cgroups by creating a release_agent file and triggering its invocation to execute arbitrary commands on the container host. Here's a breakdown of the steps involved:
Prepare the Environment:
A directory /tmp/cgrp is created to serve as a mount point for the cgroup.
The RDMA cgroup controller is mounted to this directory. In case of absence of the RDMA controller, it's suggested to use the memory cgroup controller as an alternative.
Set Up the Child Cgroup:
Cgroup ya mtoto inayoitwa "x" inaundwa ndani ya saraka ya cgroup iliyowekwa.
Arifa zinawekwa kuwa active kwa cgroup "x" kwa kuandika 1 kwenye faili yake ya notify_on_release.
Sanidi Wakala wa Kutolewa:
Njia ya kontena kwenye mwenyeji inapatikana kutoka kwa faili ya /etc/mtab.
Faili ya release_agent ya cgroup kisha inasanidiwa kutekeleza skripti inayoitwa /cmd iliyoko kwenye njia ya mwenyeji iliyopatikana.
Unda na Sanidi Skripti ya /cmd:
Skripti ya /cmd inaundwa ndani ya kontena na inasanidiwa kutekeleza ps aux, ikielekeza matokeo kwenye faili lililo na jina /output ndani ya kontena. Njia kamili ya /output kwenye mwenyeji imeainishwa.
Trigger the Attack:
Mchakato unaanzishwa ndani ya cgroup ya mtoto "x" na mara moja unakatishwa.
Hii inasababisha release_agent (script ya /cmd), ambayo inatekeleza ps aux kwenye mwenyeji na kuandika matokeo kwenye /output ndani ya kontena.
Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
