基础知识

容器一共有7个攻击面:Linux Kernel、Namespace/Cgroups/Aufs、Seccomp-bpf、Libs、Language VM、User Code、Container(Docker) engine。

Dockerd实际调用的是containerd的API接口,containerd是Dockerd和runc之间的一个中间交流组件,主要负责容器运行、镜像管理等。containerd向上为Dockerd提供了gRPC接口,使得Dockerd屏蔽下面的结构变化,确保原有接口向下兼容;向下,通过containerd-shim与runc结合创建及运行容器。

docker 的内部通信图:

OCI Bundle

OCI Bundle 是指满足OCI标准的一系列文件,这些文件包含了运行容器所需要的所有数据,它们存放在一个共同的目录,该目录包含以下两项:

(1)config.json:包含容器运行的配置数据

(2)container的root filesystem

环境搭建

漏洞复现环境搭建

host 环境:

osboxes@osboxes:~/study/vul/docker-15257$ uname -a
Linux osboxes 4.15.0-47-generic #50-Ubuntu SMP Wed Mar 13 10:44:52 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
osboxes@osboxes:~/study/vul/docker-15257$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.1 LTS
Release:    18.04
Codename:   bionic

(1)安装 18.09 版本的docker:

参考链接:https://bbs.huaweicloud.com/forum/thread-59673-1-1.html

wget https://download.docker.com/linux/static/stable/x86_64/docker-18.09.0.tgz
tar xvpf docker-18.09.0.tgz
sudo cp -p docker/* /usr/bin

配置docker.service文件 :

cat >/lib/systemd/system/docker.service <<EOF

[Unit] 
Description=Docker Application Container Engine 
Documentation=http://docs.docker.com 
After=network.target docker.socket 
[Service] 
Type=notify 
EnvironmentFile=-/run/flannel/docker 
WorkingDirectory=/usr/local/bin 
ExecStart=/usr/bin/dockerd -H tcp://0.0.0.0:4243 -H unix:///var/run/docker.sock --selinux-enabled=false --log-opt max-size=1g
ExecReload=/bin/kill -s HUP $MAINPID 
# Having non-zero Limit*s causes performance problems due to accounting overhead 
# in the kernel. We recommend using cgroups to do container-local accounting. 
LimitNOFILE=infinity 
LimitNPROC=infinity 
LimitCORE=infinity 
# Uncomment TasksMax if your systemd version supports it. 
# Only systemd 226 and above support this version. 
#TasksMax=infinity 
TimeoutStartSec=0 
# set delegate yes so that systemd does not reset the cgroups of docker containers 
Delegate=yes 
# kill only the docker process, not all processes in the cgroup 
KillMode=process 
Restart=on-failure 
[Install] 
WantedBy=multi-user.target 
EOF

启动相关服务,输出Docker的状态:

systemctl daemon-reload
systemctl status docker
systemctl restart docker
systemctl status docker
systemctl enable docker

(2)安装1.3.7 版本的containerd

sudo apt install containerd.io=1.3.7-1

安装完后的版本信息为:

(3)安装go:

sudo apt install golang

(4)安装ubuntu docker 镜像:

sudo docker pull ubuntu:18.04

ubuntu docker 镜像拉取:

https://hub.docker.com/_/ubuntu?tab=tags&page=1&ordering=last_updated

(5)运行docker:

sudo docker run -ti --rm --network=host b205c8547463

(6)下载poc, 编译:

wget https://raw.githubusercontent.com/summershrimp/exploits-open/9f2e0a28ffcf04ac81ce9113b2f8c451c36fe129/CVE-2020-15257/shim.pb.go

go mod init example.com/poc
go build .

(7)搭建环境中记录的命令:

export GO111MODULE=on
go mod init example.com/m

编译v1 版本还是v2 版本:

Example usage:
    'go mod init example.com/m' to initialize a v0 or v1 module
    'go mod init example.com/m/v2' to initialize a v2 module

https://blog.csdn.net/benben_2015/article/details/82227338

进入同一个docker:

sudo docker exec -it 17ca27eb15e1 sh

保存docker 修改:

点击收藏 | 2 关注 | 1
  • 动动手指,沙发就是你的了!
登录 后跟帖