On 2008.08.20 13:36:36 -0700, Martin Fick wrote: > --- On Wed, 8/13/08, Björn Steinbrink <B.Steinbrink@gmx.de> wrote: > >>>> does someone have a working exploit to break out of a vserver > >>>> that they can show me? > ... > >>> with the barrier intact, hopefully not :) without, one of those > >>> should do: > >>> > >>> http://vserver.13thfloor.at/Stuff/rootesc.c > >>> http://vserver.13thfloor.at/Stuff/chrootescape > >> > >> Well, I am sad?/happy? to report that I cannot seem to get either > >> of those exploits to work. I have eliminated the barrier and added > >> CAP_SYS_CHROOT to bcapabilities for one of my vservers and cannot > >> seem to escape it. Any thoughts on what I could be doing wrong? > > > > I've been away from this stuff for quite a while, but the last > > exploit I've "seen" required you not to step past the /-bind-mount, > > so the chdir("..") loop needs to stop at the right point. That > > usually puts you in /vservers then IIRC, it's been quite I while > > since I did that one. Not sure whether I figured out if/how you can > > get rid of that bind mount (well, except if you have permissions to > > umount it), to reach the real root mount, but you could at the very > > least visit the other vservers. > > Are you suggesting that the (way) above exploits should not work? Yep, they hit the bind mount and get trapped again. > I am not sure what you mean by the bind mount? Where does this bind > mount come into play, where is it set to? util-vserver creates that bind mount, like: mount -o bind /vservers/foo / (or something like that) > If I have my vservers roots set to /vservers/<vsname>/var, where are > you suggesting that I should be able to break out to and why? If you do not have the barrier setup, yes, I guess that should still work. > If a mount can be used to limit a breakout, would it not be possible > to simply setup mounts correctly so that the chroot barrier is not > needed at all? No, you just have to stop before you hit the bind mount while traversing the directory tree. > > If that still doesn't work, let me know. > > Perhaps I am being obtuse, but I am not sure what specifically you are > suggesting that I try to see if it works? To not do too many "cd > .."s? Exactly. You need to stop at the right level, so that you don't hit the bind mount. > > I might dig into my archives and see if I still have the sources for > > that one. > > That would be greatly appreciated if you could. I am now beginning to > believe that I need a valid exploit to be able to even be confident > that my directory/barrier setups are doing what they are supposed to > and that I am not unknowingly vulnerable. #include <sys/types.h> #include <sys/stat.h> main() { chdir("/"); mkdir("baz", 0777); chroot("baz"); chroot("../../.."); execl("/bin/sh", "sh", "-i", (char *)0); } My mail archive says that this assumes the vservers to be in /vservers, no idea if that really matters. Should work when there's no barrier, but fail when the barrier is set. And as I said, it doesn't go all the way up to /, just out of the vserver, so that you can at least mess with other vservers. There _might_ be a way to get even further up though. Also, you need to be a bit careful about what you do after the breakout, so that you avoid hitting the bind mount. IIRC bash had show some "interesting" behaviour. Björn