Wed, 20 Aug 2008 13:36:36 -0700 (PDT) --- On Wed, 8/13/08, Björn Steinbrink <B.Steinbrink@gmx.de> wrote: >>>> does someone have a working exploit to break >>>> out of a vserver that they can show me? ... >>> with the barrier intact, hopefully not :) >>> without, one of those should do: >>> >>> http://vserver.13thfloor.at/Stuff/rootesc.c >>> http://vserver.13thfloor.at/Stuff/chrootescape >> >> Well, I am sad?/happy? to report that I cannot >> seem to get either of those exploits to work. >> I have eliminated the barrier and added >> CAP SYS CHROOT to bcapabilities for one >> of my vservers and cannot seem to escape it. >> Any thoughts on what I could be doing wrong? > > I've been away from this stuff for quite a while, but > the last exploit I've "seen" required you not to step > past the /-bind-mount, so the chdir("..") loop needs > to stop at the right point. That usually puts you > in /vservers then IIRC, it's been quite I while since I > did that one. > Not sure whether I figured out if/how you can get rid of > that bind mount (well, except if you have permissions to > umount it), to reach the real root mount, but you could > at the very least visit the other vservers. Are you suggesting that the (way) above exploits should not work? I am not sure what you mean by the bind mount? Where does this bind mount come into play, where is it set to? If I have my vservers roots set to /vservers/<vsname>/var, where are you suggesting that I should be able to break out to and why? If a mount can be used to limit a breakout, would it not be possible to simply setup mounts correctly so that the chroot barrier is not needed at all? > If that still doesn't work, let me know. Perhaps I am being obtuse, but I am not sure what specifically you are suggesting that I try to see if it works? To not do too many "cd .."s? > I might dig into my archives and see if I still > have the sources for that one. That would be greatly appreciated if you could. I am now beginning to believe that I need a valid exploit to be able to even be confident that my directory/barrier setups are doing what they are supposed to and that I am not unknowingly vulnerable. Thanks, -Martin