{"uuid": "eae3b87c-3c14-4d15-bddd-f0a99ed5da97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/32550", "content": "KitPloit - PenTest Tools!\nWhoc - A Container Image That Extracts The Underlying Container Runtime\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEi_95e_qg5fMsbP6treVFuqoow00IkE5tY4k2v5rsmgUjnDB1ca-bidnn2ZtSOCXuYiZ9cUbI7VZ04PibinnHx0rHSvAZbNVZKfc7BUJ814hdlYdazoGq5kcijHfXEySNffebbB1_wbu5wzuX_AmycCum_3VhhEtw1pRAS4lwLZumzqgUCJt0kHrev2Ew=w640-h360 A container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!\n\n* WhoC at Defcon 29 Cloud Village\n* Azurescape - whoc-powered research, the first cross-account container takeover in the public cloud (70,000$ bounty) How does it work?As shown by runc CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they're running through /proc/self/exe. whocuses this link to read the container runtime executing it. Dynamic ModeThis is whocdefault mode that works against dynamically linked container runtimes.\n\n1. The whocimage entrypoint is set to /proc/self/exe, and the image's dynamic linker (ld.so) is replaced with fake_ld.\n2. Once the image is run, the container runtime re-executes itself inside the container.\n3. Given the runtime is dynamically linked, the kernel loads our fake dynamic linker to the runtime process and passes execution to it.\n4. fake_ldobtains a file descriptor for the runtime binary by opening /proc/self/exe, and executes upload_runtime.\n5. upload_runtimereads the runtime binary from /proc/self/fd/and sends it to the configured remote server. https://blogger.googleusercontent.com/img/a/AVvXsEi_95e_qg5fMsbP6treVFuqoow00IkE5tY4k2v5rsmgUjnDB1ca-bidnn2ZtSOCXuYiZ9cUbI7VZ04PibinnHx0rHSvAZbNVZKfc7BUJ814hdlYdazoGq5kcijHfXEySNffebbB1_wbu5wzuX_AmycCum_3VhhEtw1pRAS4lwLZumzqgUCJt0kHrev2Ew=w640-h360 Wait-For-Exec ModeFor statically linked container runtimes, whoccomes in another flavor: whoc:waitforexec.\n\n1. upload_runtimeis the image entrypoint, and runs as the whoccontainer PID 1.\n2. The user is expected to exec into the whoccontainer and invoke a file pointing to /proc/self/exe(e.g. docker exec whoc-ctr /proc/self/exe)\n3. Once the exec occurs, the container runtime re-executes itself inside the container\n4. upload_runtimereads the runtime binary through /proc/and sends it to the configured remote server https://blogger.googleusercontent.com/img/a/AVvXsEhbfCLFL3NwU1sTB4vduEhYxUm-_xbrXLOUlsfrgj0TSnTdcpcBZIDprF7te-xGhkLaYz1t7nttgwg-pZ2wCIzjawRmgpRK7-qwpL95QTsOooSZIgvX68UQb1pJVjNiqvhN_QstbYC0Z99gVA4ECkzjQ0pXXm-hhAb6xXqUUU5MhAJAU5fMs5d07rbu_Q=w640-h372 Try LocallyYou'll need dockerand python3installed. Clone the repository: $ git clone git@github.com:twistlock/whoc.gitSet up a file server to receive the extracted container runtime: $ cd whoc\n$ mkdir -p stash && cd stash\n$ ln -s ../util/fileserver.py fileserver \n$ ./fileserverFrom another shell, run the whocimage in your container environment of choice, for example Docker: $ cd whoc\n$ docker build -f Dockerfile_dynamic -t whoc:latest src  # or ./util/build.sh\n$ docker run --rm -it --net=host whoc:latest 127.0.0.1  # or ./util/run_local.shSee that the file server received the container runtime. Since we run whocunder vanilla Docker, the received container runtime should be runc. --net=hostis only used in local tests so that the whoccontainer could easily reach the fileserver on the host via 127.0.0.1. HelpHelp[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:08.618136Z"}