frichetten / cve-2019-5736-poc

PoC for CVE-2019-5736

"Hello there"

My name is Nick Frichette and I'm a Staff Security Researcher, primarily focused on cloud, web application, and CI/CD exploitation. Previously, I worked as a Penetration Tester and Team Lead for a large financial services company. In addition, I'm the creator and primary maintainer of Hacking the Cloud, an encyclopedia of the techniques that offensive security professionals can use against cloud environments.

Aside from that, I'm fortunate to be a part of the AWS Community Builders Program.

This GitHub profile contains a bunch of stuff, and some of it is "good". You can find most of my research at my blog.

Vulnerability Research

I conduct security research both, professionally and as a hobby. My primary focus is on AWS and web application security.

• Amplified exposure: How AWS flaws made Amplify IAM roles vulnerable to takeover
• Bypassing CloudTrail in AWS Service Catalog, and Other Logging Research
• Cross-Tenant Confused Deputy Vulnerability in AWS AppSync
• AWS CloudTrail bypass for specific IAM actions
• XSS in the AWS Console
• Enumerate AWS API Permissions without Logging to CloudTrail
• Intercept SSM Agent Communications
• CVE-2020-11108: How I Stumbled into a Pi-Hole RCE+LPE
• CVE-2020-15511: Account Takeover in Terraform Enterprise

Community Involvement

I'm involved/participate with the security community in several ways. Here are just a few.

• Black Hat USA 2023 - I spoke on the main stage of Black Hat USA 2023 about my research into CloudTrail evasion.
• Cloud Security Podcast: How to Escape Clusters in a Managed Kubernetes Cluster? - I was a guest on the Cloud Security Podcast talking about abusing managed Kubernetes clusters.
• DEF CON Cloud Village 2023 - I gave a talk at the DEF CON Cloud Village titled "Evading Logging in the Cloud: Bypassing AWS CloudTrail".
• Wiz: Top 16 cloud security experts you should follow in 2023 - I was included as a "top cloud security expert" in Wiz's yearly roundup.
• fwd:cloudsec 2023 - Gave a talk titled "Evading Logging in the Cloud: Disrupting and Bypassing AWS CloudTrail", which was an overview of my research on AWS CloudTrail bypasses.
• Cloud Securiy Podcast: Getting Started With Hacking AWS Cloud - I was a guest on the Cloud Security Podcast, discussing some of my security research.
• SANS Pentest Hackfest 2022 - Gave a talk at the main track on "What I Wish I Knew Before Pentesting AWS Environments" (slides).
• Screaming in the Cloud #226 - Corey Quinn - I was a guest on the Screaming in the Cloud podcast, hosted by Corey Quinn. We talked about offensive security in AWS, AWS security research, and more.
• Research in the News - My research has been featured in multiple well-known newsletters including CloudSecList, tl;dr sec, and Bug Bytes.
• ShellCon 2020 - Gave a talk (Hacking AWS - TTPs for the Cloud) at the Main Track of ShellCon 2020. Covered the tactics and techniques a penetration testing or red team can leverage when attacking AWS infrastructure.

Certifications

OSCP	OSWE
GXPN	GPEN
AWS Certified Security Specialist

cve-2019-5736-poc's Issues

Failed to get write handle

Thank you for your poc.
I work on Ubuntu 18.04 and Docker 18.09.1-ce. Everything went well. However, at the last step, after the command "sudo docker exec -it cve-test /bin/sh" is executed in a new terminal window, there are only two new messages printed and the program gets stuck

The printed messages:
root@10f52219f2bc:/home# ./main
[+] Overwritten /bin/sh successfully
[+] Found the PID: 15
[+] Successfully got the file handle

The last message "[+] Successfully got write handle" did not appear. The dir /tmp/shadow is still unreachable.

Thank you!

Can't execute file main inside container

@Frichetten Hello, I cloned your repo and compile main.go
After I put the executable file main inside my ubuntu container and tried to execute it
I got the following error
error while loading shared libraries: libgo.so.13: cannot open shared object file: No such file or directory

I've tried to reinstall the whole GO package and install libgo13 again and again but the error continue to pop out , any solution for it?

This POC won't work for me

Dear author:

I tried your POC file, but it didn't work, because there is a existed pid named runc in /proc//cmdline

I tried with this bash script:

    while true; do
        for pid in $(ps -ef | awk '{print $2}'); do
            cmdline=$(cat /proc/${pid}/cmdline)
            if [[ ${cmdline} == *runc* ]]; then
                echo !!!!!!!!!!!!!!!!!!!!!!!!!runc was found!!!!!!!!!!!!!!!!!!!!!!!
                echo pid:${pid}
            fi
        done
    done

and the output like this:

cat: /proc/876/cmdline: No such file or directory
cat: /proc/877/cmdline: No such file or directory
cat: /proc/878/cmdline: No such file or directory
cat: /proc/PID/cmdline: No such file or directory
！！！！！！！！runc was found ！！！！！！！！！！！！！
pid:25

So this exploit will not work for me
And when I execute the go binary file, second time when I want execute docker exec command, an error will occurred to prevent this POC

docker exec -ti runc-test /bin/sh
/proc/self/exe: error while loading shared libraries: libseccomp.so.2: cannot open shared object file: No such file or directory

Appreciated

Hangs after finding the PID

I've been trying to reproduce this exploit on Ubuntu 18.04 LTS with the below versions of runc & docker.io
runc=1.0.0~rc4+dfsg1-6 & docker.io=17.12.1-0ubuntu1

After executing the exploit in the container & running 'docker exec -it container /bin/sh` in the host the exploit hangs

Output:

./breakout
[+] Overwritten /bin/sh successfully
[+] Found the PID: 168

Any idea why? This was tested on bento/ubuntu-18.04 Vagrant box

vagrant@vagrant:~$ uname -r
4.15.0-156-generic

Also could you please specify the exact versions of runc & docker.io that were used by you? Thanks!