Subject: Re: [vserver] vserver git server and misc. thoughts
From: Martin Fick <mogulguy@yahoo.com>
Date: Wed, 20 Aug 2008 13:36:36 -0700 (PDT)

 Wed, 20 Aug 2008 13:36:36 -0700 (PDT)
--- On Wed, 8/13/08, Björn Steinbrink <B.Steinbrink@gmx.de> wrote:
>>>> does someone have a working exploit to break 
>>>> out of a vserver that they can show me?
...
>>> with the barrier intact, hopefully not :)
>>> without, one of those should do:
>>> 
>>>  http://vserver.13thfloor.at/Stuff/rootesc.c
>>>  http://vserver.13thfloor.at/Stuff/chrootescape
>>
>> Well, I am sad?/happy? to report that I cannot 
>> seem to get either of those exploits to work. 
>> I have eliminated the barrier and added 
>> CAP SYS CHROOT to bcapabilities for one
>> of my vservers and cannot seem to escape it.  
>> Any thoughts on what I could be doing wrong?
> 
> I've been away from this stuff for quite a while, but
> the last exploit I've "seen" required you not to step 
> past the /-bind-mount, so the chdir("..") loop needs 
> to stop at the right point. That usually puts you
> in /vservers then IIRC, it's been quite I while since I
> did that one.
> Not sure whether I figured out if/how you can get rid of
> that bind mount (well, except if you have permissions to 
> umount it), to reach the real root mount, but you could 
> at the very least visit the other vservers.

Are you suggesting that the (way) above exploits should 
not work?  I am not sure what you mean by the bind mount?
Where does this bind mount come into play, where is it 
set to?  If I have my vservers roots set to 
/vservers/<vsname>/var, where are you suggesting that
I should be able to break out to and why?  

If a mount can be used to limit a breakout, would it
not be possible to simply setup mounts correctly so 
that the chroot barrier is not needed at all?


> If that still doesn't work, let me know. 

Perhaps I am being obtuse, but I am not sure what 
specifically you are suggesting that I try to see 
if it works?  To not do too many "cd .."s?


> I might dig into my archives and see if I still 
> have the sources for that one.

That would be greatly appreciated if you could.  I
am now beginning to believe that I need a valid
exploit to be able to even be confident that my
directory/barrier setups are doing what they are
supposed to and that I am not unknowingly 
vulnerable.

Thanks,

-Martin