Kali Linux Tutorials
Whoc : A Container Image That Extracts The Underlying Container Runtime

Whoc is a container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!

How does it work?

As shown by runc CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they’re running through /proc/self/exe. whocuses this link to read the container runtime executing it.

Dynamic Mode

This is whocdefault mode that works against dynamically linked container runtimes.

1. The whocimage entrypoint is set to /proc/self/exe, and the image’s dynamic linker (ld.so) is replaced with upload_runtime.
2. Once the image is run, the container runtime re-executes itself inside the container.
3. Given the runtime is dynamically linked, the kernel loads our fake dynamic linker (upload_runtime) to the runtime process and passes execution to it.
4. upload_runtimereads the runtime binary through /proc/self/exeand sends it to the configured remote server.
https://blogger.googleusercontent.com/img/a/AVvXsEhoOtXTTgwAILo7_iVmwKDHiYFqUbdTTAaLwtkxF_o1uEl7cVjxgpPyycB1hmrcJSoO90Y4AtQLloD-nlpUfcurdePCzt5E-Za6ZryJW_LfFnAViUjIOVrhRxo0ggi0HDzk8rx5xJ3puaZ94h7wElqjr0Ei2xDYrIVBlfjrUN-g425lpMXY4pY5DD3d=s728
Wait-For-Exec Mode

For statically linked container runtimes, whoccomes in another flavor: whoc:waitforexec.

1. upload_runtimeis the image entrypoint, and runs as the whoccontainer PID 1.
2. The user is expected to exec into the whoccontainer and invoke a file pointing to /proc/self/exe(e.g. docker exec whoc_ctr /proc/self/exe).
3. Once the exec occurs, the container runtime re-executes itself inside the container.
4. upload_runtimereads the runtime binary through /proc/$runtime-pid/exeand sends it to the configured remote server.
https://blogger.googleusercontent.com/img/a/AVvXsEi3a_UpD_rXLfW9moPrDkZzlJOXXYrKnldu3IW_BpKgXSHTWzA2Efb8KtZx97cwQ8GasivuxnMs5vrYUYOgK8WE_FQ6ErQp_5t0Ykff-b2qMNl9Kzsn2j2dm3K2AoNGm_CS-EF4Q6NPJ5086YaoPXUJJtVZM9pLx43xRy04KhKoCiR92O8Y03DJUyFI=s571
Try Locally

You’ll need dockerand python3installed. Clone the repository:
$ git clone git@github.com:twistlock/whoc.git
Set up a file server to receive the extracted container runtime:
$ cd whoc
$ mkdir -p stash && cd stash
$ ln -s ../util/fileserver.py fileserver
$ ./fileserver
From another shell, run the whocimage in your container environment of choice, for example Docker:
$ cd whoc
$ docker build -f Dockerfile_dynamic -t whoc:latest src # or ./util/build.sh
$ docker run --rm -it --net=host whoc:latest 127.0.0.1 # or ./util/run_local.sh
See that the file server received the container runtime. If you run whocunder vanilla Docker, the received container runtime should be runc. --net=hostis only used in local tests so that the whoccontainer could easily reach the fileserver on the host via 127.0.0.1.

Other Platforms

By default whocis built for linux/amd64, but it also supports other CPU architectures. Wait-for-exec mode can be built as usual. To build whocin dynamic mode for other CPU architectures, you must populate the PLATFORM_LD_PATH_ARGbuild argument with the path of the dynamic linker on the target architecture.

An example build script for arm64is available at util/build_arm64.sh.

Help

Help for whoc‘s main binary, upload_runtime:
Usage: upload_runtime [options] ___________________________
@hacking_Attack
@Hacking_Video

Port of remote server, defaults to 8080
-e, --exec Wait-for-exec mode for static container runtimes, waits until an exec to the container occurred
-b, --exec-bin In exec mode, overrides the default binary created for the exec, default is /bin/enter
-a, --exec-extra-argument In exec mode, pass an additional argument to the runtime so it won't exit quickly
-r, --exec-readdir-proc In exec mode, instead of guessing the runtime pid (which gives whoc one shot of catching the runtime),
find the runtime by searching for new processes under '/proc' Download

___________________________
@hacking_Attack
@Hacking_Video

Mobile and API Penetration Testing
https://www.reddit.com/r/Pentesting/comments/rb7vxf/mobile_and_api_penetration_testing/

Hi everybody, I have a question because i want to learn how to do a correct penetration test in mobile apps and APIs. Someone know a good course or book that recommend me to start. My background is network and web pentest (SAST-DAST) but is other world. regards! submitted by /u/pwnhun7 (https://www.reddit.com/user/pwnhun7)
[link] (https://www.reddit.com/r/Pentesting/comments/rb7vxf/mobile_and_api_penetration_testing/) [comments] (https://www.reddit.com/r/Pentesting/comments/rb7vxf/mobile_and_api_penetration_testing/)

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty and Response to SPL Lending Vulnerability

Neodyme recently disclosed a vulnerability in the SPL token-lending library that Solend and others use, which caused an estimated $350M in…Continue reading on Solend »
Read more...

Hacking on Medium
Por qué el Phishing es más difícil de detectar en el móvil

https://cdn-images-1.medium.com/max/1524/0*rENu10_G-oX23isq
PUBLICADO EN 7 DICIEMBRE, 2021POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Five Useful Tips for Securing Java Apps

https://cdn-images-1.medium.com/max/2600/0*Ez3YYA85cxmYkvHR
A look at Java security and how to improve it.

Continue reading on ShiftLeft Blog »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Amazon Web Services Experiencing Outages—Disney+, Amazon And Other Major Sites Impacted

https://external-preview.redd.it/ZtihgoPySldTimla2LX-plMVwfjrC7NFW1xtaMBDRmI.jpg?width=640&crop=smart&auto=webp&s=da8600f364cd47cd1c3373fbf18278d6487e842c submitted by /u/Stevogangstar
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Airtel Xstream Fiber WPA/WPA2 Hack

submitted by /u/U1karsh
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Python Cybersecurity - Network Tracking using Wireshark and Google Maps

https://external-preview.redd.it/ye4UqtaM6Gr1qiyuNmko3MUjkuB5HcHvdoNqbeaBH0E.jpg?width=320&crop=smart&auto=webp&s=8af92600d8101a9b06fbe32c747097a1ecdd2cf0 submitted by /u/Best_Fold_2554
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Explore Hackthebox Walkthrough

“Explore” is a Capture the Flag challenge that we’ll be solving today. (HTB) Hack the Box is where you can get your hands on one,

The post Explore Hackthebox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
5 Ways GRC & Security Can Partner to Reduce Insider Risk

In 2022, data governance, risk, and compliance (GRC) and security need to partner to implement a modern approach to data protection: insider risk management.

Dark Reading: Attacks/Breaches
The Dark Web Has Its Own People's Court

Many underground forums have processes for arbitrating disputes between cybercriminals.

Dark Reading: Attacks/Breaches
DigiCert Advances Passwordless Authentication with Support for Windows Hello for Business

Managing Windows Hello hybrid certificate trust model on DigiCert PKI platform streamlines enterprise passwordless authentication and access, an industry first for public Certification Authorities (CAs).

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Virtual-Network Vulnerability Found in AWS, Other Clouds

The privilege-escalation flaws affect Amazon WorkSpaces and more than a dozen services that use a particular implementation of USB over Ethernet.