-
Notifications
You must be signed in to change notification settings - Fork 13.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
runc cwd priv esc (docker) (cve-2024-21626) #18780
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks @h00die for this great module! I just left a few minor comments. I tested against an old Kali Linux (Debian-based with runc
version 1.1.10+ds1
) and it works great.
However, I noticed a long delay after the payload has been executed and before the session is available. I managed to get rid of this delay by setting the MeterpreterTryToFork
option to true
.
output.each_line { |line| vprint_status line.chomp } | ||
|
||
# delete our docker image | ||
if output =~ /Successfully built ([a-z0-9]+)$/ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not a big deal, but to avoid having to parse the output for the image ID, you can also add an image name when building with the -t
flag:
docker build -t image_name .
and then, you can use it to delete the image:
docker image rm image_name
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I had thought about this, but then we'd want to make it random. If it's random, theres a (very very small) chance of a collision, so we'd want to check that first. Then I decided that a random string is basically what we get anyways because its a hash, so may as well just go with the flow
[!] SESSION may not be compatible with this module: | ||
[!] * incompatible session architecture: python |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is a bit odd: while it's indeed a python-powered session, it's a meterpreter one, and this module is explicitly compatible with meterpreter sessions.
Thanks for updating this @h00die ! Everything looks good to me now. I tested against
|
Release NotesThis adds a local privilege escalation exploit that leverages an internal file descriptor leak in runc versions prior to 1.1.12. An attacker with docker privileges is able write an arbitrary file on the host file system with the permissions of runc (typically root). With this, the module uploads a payload, sets the execute and the SUID permissions to escalate privileges. |
fixes #18777
This PR adds a new LPE to take advantage of the vulnerability disclosed yesterday. A user w/ docker privileges and a vulnerable runc (ubuntu 18.04, 20.04, 22.04, 22.10) is able to use a file descriptor within a docker image to mount the root file system. Once we do that, we
chmod
andsuid
our payload and can become root on the host.Verification
List the steps needed to make sure this thing works
use exploit/linux/local/runc_cwd_priv_esc
set session [session]
run