{"uuid": "02ec630c-c5d9-4954-ad00-e07b13a657f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/32537", "content": "Whoc - A Container Image That Extracts The Underlying Container Runtime\n\nA container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!WhoC at Defcon 29 Cloud VillageAzurescape - whoc-powered research, the first cross-account container takeover in the public cloud (70,000$ bounty)How does it work?As shown by runc CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they're running through /proc/self/exe. whoc uses this link to read the container runtime executing it.Dynamic ModeThis is whoc default mode that works against dynamically linked container runtimes.The whoc image entrypoint is set to /proc/self/exe, and the image's dynamic linker (ld.so) is replaced with fake_ld.Once the image is run, the container runtime re-executes itself inside the container.Given the runtime is dynamically linked, the kernel loads our fake dynamic linker to the runtime process and passes execution to it.fake_ld obtains a file descriptor for the runtime binary by opening /proc/self/exe, and executes upload_runtime.upload_runtime reads the runtime binary from /proc/self/fd/ and sends it to the configured remote server.Wait-For-Exec ModeFor statically linked container runtimes, whoc comes in another flavor: whoc:waitforexec.upload_runtime is the image entrypoint, and runs as the whoc container PID 1.The user is expected to exec into the whoc container and invoke a file pointing to /proc/self/exe (e.g. docker exec whoc-ctr /proc/self/exe)Once the exec occurs, the container runtime re-executes itself inside the containerupload_runtime reads the runtime binary through /proc//exe and sends it to the configured remote serverTry LocallyYou'll need docker and python3 installed. Clone the repository:$ git clone git@github.com:twistlock/whoc.gitSet up a file server to receive the extracted container runtime:$ cd whoc$ mkdir -p stash && cd stash$ ln -s ../util/fileserver.py fileserver $ ./fileserverFrom another shell, run the whoc image in your container environment of choice, for example Docker:$ cd whoc$ docker build -f Dockerfile_dynamic -t whoc:latest src # or ./util/build.sh$ docker run --rm -it --net=host whoc:latest 127.0.0.1 # or ./util/run_local.shSee that the file server received the container runtime. Since we run whoc under vanilla Docker, the received container runtime should be runc.--net=host is only used in local tests so that the whoc container could easily reach the fileserver on the host via 127.0.0.1.HelpHelp for whoc's main binary, upload_runtime:Usage: upload_runtime options Options: -p, --port Port of remote server, defaults to 8080 -e, --exec Wait-for-exec mode for static container runtimes, waits until an exec to the container occurred -b, --exec-bin In exec mode, overrides the default binary created for the exec, default is /bin/enter -a, --exec-extra-argument In exec mode, pass an additional argument to the runtime so it won't exit quickly -r, --exec-readdir-proc In exec mode, instead of guessing the runtime pid (which gives whoc one shot of catching the runtime), find the runtime by searching for new processes under '/proc'Download Whoc\nRead more...\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:08.535661Z"}