Escaping Linux CHROOT jail

 

Introduction

Isolation is a security approach provided by many computer systems.It is based on splitting the system to smaller independent pieces to make sure that a compromised sub-system cannot  affect the entire entity.This approach is present in every modern operating system (e.g User accounts,process address spaces etc..)

Chroot Jail is a way to separate a process that don’t run as root and its children from the rest of the system by creating a Jail using chroot() system call (system call is an interface between an application and the Linux kernel).The idea is to create a directory and make the process think that it is in the root folder and not letting it access or modify outside that jail.Let’s see how to build this jail and how to escape it.

 

Setup a Prisoner user

Create a new user:    sudo adduser prisoner

 

Add  prisoner to root group :  sudo gpasswd -a prisoner root

(Check by visiting the /etc/group path)

Create a Chroot folder : mkdir chroot

Enter chroot (cd /chroot ) and create : bin,dev, etc, home, home/prisoner, lib, var,  usr, usr/bin folders:  mkdir bin dev  etc home  home/prisoner  lib  var  usr  usr/bin

(we need at least bin and lib directory inside the jail.)

Now let’s copy the bash shell utility that we want the prisoner user to be able to use.

Type:  cp /bin/bash /chroot/bin/

To make sure that the bash shell will work properly we need to locate its necessary libraries and copying them to /lib jail folder:  ldd /bin/bash

Now let’s use the Magic Chroot command : sudo chroot /chroot  /bin/bash

Ps: if you get this error: chroot: failed to run command ‘/bin/bash’ no such file or directory please check this answer.

Voila!

Escaping the jail:

Now let’s see how to escape this type of jails:

  1. First we need to guess the available commands by just typing some commands: cd,ls,pwd,cp,vi etc… to know what we can use to escape.
  2. Know the $SHELL and the $PATH variables using: echo $PATH and echo $SHELL.
  3. There are different methods and ideas to escape the jail for example:
  • If ‘/’ is available just run /bin/bash.
  • If ‘set’ is available use: export PATH=/bin:/usr/bin:$PATH       

            and export SHELL=/bin/sh

  • Use other system commands e.g: awk ‘BEGIN {system(“/bin/sh”)}’
  • Use scripting language e.g: python – c  ‘import os;os.system(“/bin/bash”)’  

References:

[1] http://www.adminarticles.com

[2] https://speakerdeck.com/knaps/escape-from-shellcatraz-breaking-out-of-restricted-unix-shells