Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials
Whoc : A Container Image That Extracts The Underlying Container Runtime

Whoc is a container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!

How does it work?

As shown by runc CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they’re running through /proc/self/exe. whocuses this link to read the container runtime executing it.

Dynamic Mode

This is whocdefault mode that works against dynamically linked container runtimes.

1. The whocimage entrypoint is set to /proc/self/exe, and the image’s dynamic linker (ld.so) is replaced with upload_runtime.
2. Once the image is run, the container runtime re-executes itself inside the container.
3. Given the runtime is dynamically linked, the kernel loads our fake dynamic linker (upload_runtime) to the runtime process and passes execution to it.
4. upload_runtimereads the runtime binary through /proc/self/exeand sends it to the configured remote server.
https://blogger.googleusercontent.com/img/a/AVvXsEhoOtXTTgwAILo7_iVmwKDHiYFqUbdTTAaLwtkxF_o1uEl7cVjxgpPyycB1hmrcJSoO90Y4AtQLloD-nlpUfcurdePCzt5E-Za6ZryJW_LfFnAViUjIOVrhRxo0ggi0HDzk8rx5xJ3puaZ94h7wElqjr0Ei2xDYrIVBlfjrUN-g425lpMXY4pY5DD3d=s728
Wait-For-Exec Mode

For statically linked container runtimes, whoccomes in another flavor: whoc:waitforexec.

1. upload_runtimeis the image entrypoint, and runs as the whoccontainer PID 1.
2. The user is expected to exec into the whoccontainer and invoke a file pointing to /proc/self/exe(e.g. docker exec whoc_ctr /proc/self/exe).
3. Once the exec occurs, the container runtime re-executes itself inside the container.
4. upload_runtimereads the runtime binary through /proc/$runtime-pid/exeand sends it to the configured remote server.
https://blogger.googleusercontent.com/img/a/AVvXsEi3a_UpD_rXLfW9moPrDkZzlJOXXYrKnldu3IW_BpKgXSHTWzA2Efb8KtZx97cwQ8GasivuxnMs5vrYUYOgK8WE_FQ6ErQp_5t0Ykff-b2qMNl9Kzsn2j2dm3K2AoNGm_CS-EF4Q6NPJ5086YaoPXUJJtVZM9pLx43xRy04KhKoCiR92O8Y03DJUyFI=s571
Try Locally

You’ll need dockerand python3installed. Clone the repository:
$ git clone git@github.com:twistlock/whoc.git
Set up a file server to receive the extracted container runtime:
$ cd whoc
$ mkdir -p stash && cd stash
$ ln -s ../util/fileserver.py fileserver
$ ./fileserver
From another shell, run the whocimage in your container environment of choice, for example Docker:
$ cd whoc
$ docker build -f Dockerfile_dynamic -t whoc:latest src # or ./util/build.sh
$ docker run --rm -it --net=host whoc:latest 127.0.0.1 # or ./util/run_local.sh
See that the file server received the container runtime. If you run whocunder vanilla Docker, the received container runtime should be runc. --net=hostis only used in local tests so that the whoccontainer could easily reach the fileserver on the host via 127.0.0.1.

Other Platforms

By default whocis built for linux/amd64, but it also supports other CPU architectures. Wait-for-exec mode can be built as usual. To build whocin dynamic mode for other CPU architectures, you must populate the PLATFORM_LD_PATH_ARGbuild argument with the path of the dynamic linker on the target architecture.

An example build script for arm64is available at util/build_arm64.sh.

Help

Help for whoc‘s main binary, upload_runtime:
Usage: upload_runtime [options] ___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Whoc : A Container Image That Extracts The Underlying Container Runtime

Whoc is a container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container

6 viewsedited 19:28

Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials Whoc : A Container Image That Extracts The Underlying Container Runtime Whoc is a container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite…

Port of remote server, defaults to 8080
-e, --exec Wait-for-exec mode for static container runtimes, waits until an exec to the container occurred
-b, --exec-bin In exec mode, overrides the default binary created for the exec, default is /bin/enter
-a, --exec-extra-argument In exec mode, pass an additional argument to the runtime so it won't exit quickly
-r, --exec-readdir-proc In exec mode, instead of guessing the runtime pid (which gives whoc one shot of catching the runtime),
find the runtime by searching for new processes under '/proc' Download

___________________________
@hacking_Attack
@Hacking_Video

5 viewsedited 19:28

Hacking Articles Tips Tricks Videos Tutorials

Mobile and API Penetration Testing
https://www.reddit.com/r/Pentesting/comments/rb7vxf/mobile_and_api_penetration_testing/

Hi everybody, I have a question because i want to learn how to do a correct penetration test in mobile apps and APIs. Someone know a good course or book that recommend me to start. My background is network and web pentest (SAST-DAST) but is other world. regards! submitted by /u/pwnhun7 (https://www.reddit.com/user/pwnhun7)
[link] (https://www.reddit.com/r/Pentesting/comments/rb7vxf/mobile_and_api_penetration_testing/) [comments] (https://www.reddit.com/r/Pentesting/comments/rb7vxf/mobile_and_api_penetration_testing/)

___________________________
@hacking_Attack
@Hacking_Video

Mobile and API Penetration Testing

Hi everybody, I have a question because i want to learn how to do a correct penetration test in mobile apps and APIs. Someone know a good course...

6 viewsedited 20:04

Hacking Articles Tips Tricks Videos Tutorials

Bug Bounty and Response to SPL Lending Vulnerability

Neodyme recently disclosed a vulnerability in the SPL token-lending library that Solend and others use, which caused an estimated $350M in…Continue reading on Solend »
Read more...

5 views20:15

Hacking Articles Tips Tricks Videos Tutorials

5 views20:19

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Por qué el Phishing es más difícil de detectar en el móvil

https://cdn-images-1.medium.com/max/1524/0*rENu10_G-oX23isq
PUBLICADO EN 7 DICIEMBRE, 2021POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Por qué el Phishing es más difícil de detectar en el móvil

PUBLICADO EN 7 DICIEMBRE, 2021POR EHACKING

3 viewsedited 20:19

Hacking Articles Tips Tricks Videos Tutorials

3 views20:19