Making a Boot2root machine with docker

I've been trying to learn about Docker recently and experiment with it and I thought what would be a better way to test my basics than to make a dockerized boot2root machine, so here we are.

The boot2root machine we'll be implementing is a very simple one

• Find ftp and ssh service are open through nmap

• get user creds from ftp and login via ssh

• and a very simple sudo priv esc

Base Setup

The first thing to do would be install docker which you can install from here and then pull an Ubuntu latest image from docker to work with.

docker pull ubuntu
docker images #gives image ID's for all repos
docker run -cap-add=NET_ADMIN -it <ubuntu image ID> 

Following the above you'll be inside the docker image with root privileges. One thing you should remember is that this is image is stripped of everything nothing is installed from the start. You have to install the basic needed tools and ones you're gonna use for boot2root manually including sudo

apt-get update  
apt-get install -y vsftpd wget curl nano sudo ufw ftp openssh-server

Now you have to manually start all the services that you'll be using in this machine which are FTP and SSH

service ufw start
service ssh start
service vsftpd start

Now we have to configure the ports for ftp and ssh to allow traffic through them,

sudo ufw allow 20/tcp 
sudo ufw allow 21/tcp  
sudo ufw allow 22/tcp  

Setting up FTP server

Without setting the root directory for the ftp it'll just show empty when you connect to it.

We need to make a ftpuser and also make a directory in /var for the ftp server and give it appropriate permissions.

sudo useradd <username>
sudo mkdir -p /var/ftp/pub
sudo chown nobody:nogroup /var/ftp/pub

We also need to edit the vsftpd.conf file to allow anon login and also set the root directory.

/etc/vsftpd.conf

anonymous_enable=YES
local_enable=YES

anon_root=/var/ftp/pub/
hide_ids=YES

Now just add a file with user creds you wanna give for ssh or any other hint

nano /var/ftp/pub/creds.txt

At the end you have to restart the service for the changes to take place

service vsftpd restart

Setting up SSH

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.factory-defaults
sudo chmod a-w /etc/ssh/sshd_config.factory-defaults
service ssh restart

These commands make a backup copy of our config, and gives it permissions so that it cant be tampered with and restarts the service with all the implemented changes.

Make lower privilege user for the user flag

useradd -m <username> #creates user with home directory
usermod --shell /bin/bash <username> #sets bash as shell for the user
passwd <username> #set the password for the user

Setting the sudo Privesc

For privilege escalation I thought of letting the user run cat and ls meaning he can list and read the files in the root directory.

To do this we have to edit the sudoers file, run the below command as root

visudo

and add the following to your user

/etc/sudoers

<username>    ALL=(ALL) NOPASSWD:/bin/cat, /usr/bin/ls

add your root flag to root.txt in the /root directory and then we just have add appropriate permissions to the user and root flags and we are good to go

sudo chown <username>:<username /home/<username/user.txt
sudo chmod u+rx /home/<username/user.txt
sudo chmod u-w /home/<username/user.txt
sudo chmod go-rwx /home/<username

sudo chown root:root /root/root.txt
sudo chmod u+rx /root/root.txt
sudo chmod u-w /root/root.txt
sudo chmod go-rwx /root

Sanity Check

Don't forget to restart all the services before doing the sanity check

service ufw restart
service ssh restart
service vsftpd restart

Do a sanity check to see if everything you restarted and updated is working perfectly. We need to get the ip-address of the container to test it out. We can do this by

docker container ls
docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' <container-id>

After you get the ip you can do your checks with the ftp server and ssh with the accounts you created. If everything is working fine we can move on to commit the image and push it to docker hub.

Pushing to docker hub

After all this the one thing we need to do is make your docker container available to the whole world wide web. To do this we have to commit your docker container.

Exit your container after making all the changes and testing it.

docker ps -a

Use the above command to get the container-id of the container you just exited.

docker commit <container-id> <image-name>

You can now check your new image using

docker images

To upload this onto docker hub, you first need to make an account on Docker Hub. Click on your profile image and go to account settings. Click on Security in the left navigation and add New Access Token. Copy your access token and back in your terminal do the following

docker login -u <username>

you'll be prompted to enter the access token. Now to upload on to docker hub you need to tag it and then push it.

docker image tag <image-name> <username>/<image-name>:latest
docker image push <username>/<image-name>:latest

Making docker-compose file

The docker-compose file for this image is very simple

• We'll be pulling the image from docker hub

• adding the additional capability to it --cap-add=NET_ADMIN

• run a command to restart the services ufw, vsftpd and ssh

• add a tails command to keep the container from exiting in detached mode

docker-compose.yaml

version: '2'

services:
    app:
        cap_add:
        - NET_ADMIN
        image: <username>/<image-name>
        command: sh -c "service ufw restart && service vsftpd restart && service ssh restart && tail -f /dev/null"

you just need to run the below command in the same directory as the file for the container to be up and running

docker-compose up

If you make any changes to to .yaml file make sure to take the container down before running it again

docker-compose down
docker-compose up

Hope you learnt something about docker or about configuring boot2root machines, If you're interested check out my other blogs too.