New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

arch linux compatibility for runc priv esc #19734

Open

h00die wants to merge 1 commit into rapid7:master from h00die:runc_arch

Contributor

h00die commented Dec 16, 2024

fixes #19679

Adds arch linux compatibility to the runc priv esc. See documentation for install instructions.

Verification

Start msfconsole
get a user level shell
use exploit/linux/local/runc_cwd_priv_esc
Adjust FILEDESCRIPTOR if needed (usually 7 or 8, I find mine to typically be 8)
Set your WritableDir somewhere like the user's home directory, /tmp has nosuid, so won't work there (you'll get a user shell again even though permissions look correct)
Verify check works successfully
Verify exploit gives you a root shell


          arch linux compatibility for runc priv esc

af462f7

h00die added the enhancement label

h00die mentioned this pull request

Tested exploit/linux/local/runc_cwd_priv_esc on arch linux runc 1.1.4 #19679

Open

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels