forked from Ne0nd0g/merlin
-
Notifications
You must be signed in to change notification settings - Fork 113
cGroup Breakout
yanivyakobovich edited this page Jan 17, 2022
·
1 revision
Abusing the Linux cgroup v1 release agent feature to escape container to the host
info:
Overlay - https://blogs.cisco.com/developer/373-containerimages-03
Exploit - https://0xdf.gitlab.io/2021/05/17/digging-into-cgroups.html#background
Requirements:
-
Running as root inside the container
-
Running with CAP_SYS_ADMIN and the container must lack an AppArmor profile
OR
cGroup v1 virtual file system as read-write
Exploit:
- The first step is to gain access to the RDMA controller. If cgroup is mounted read-write, you already have access to the default mount point of RDMA controller, which is -
/sys/fs/cgroup/rdma
. Or, by mounting a controller in the desired mount point (if you have cap_sys_admin) - Create a new cgroup within that controller - create folder under the RDMA controller
- Register
notify_on_release
for that cgroup - write 1 to notify_on_release under the relevant folder - Use
sed
to get the string'supperdir
path of the current container in the host machine. Any write to this path will appear in the current container as well ( see info about overlay) - Write to
release_agent
a path to the desired script in the container. let's say the script's name is cmd, and his located in/cmd
at the container. Then the path to the script will be$upperdir/cmd
(the upperdir is from stage 4) - Trigger release, set up a process within this new cgroup
cgroup.procs
so when this process terminates, the system sees that PID terminate and finds its PID in the cgroup we created. It removes that PID from thecgroups.procs
file, and triggers the release agent, which will execute the cmd script in the host.
Wish to contribute module?
Exploit Module Guide
- cGroup Breakout
- Mount Breakout
- DockerSock Breakout
- Kubelet Attack
- Var Log Escape
- Kernel Module Breakout
Other Modules