Chw00t: How To Break Out from Various Chroot Solutions

No ratings

Presented at DeepSec 2015 by

Chroot syscall is part of POSIX. All Unix systems have this syscall, so it is possible to create separated environments. Until this presentation there was no documentation/tutorial about the techniques how to create a reasonably "secure" chroot environment or how to breakout from a misconfigured one. Now, with this presentation, I attempt to create a knowledge base for this topic. I've managed to collect 6 different techniques that are working fully on Linuxes (not all of them requires root privs). Furthermore I wrote a tool that automates the breakouts and helps the user to get a shell outside of the chrooted environment. This tool is an opensource tool, already released. The tool supports only Linux at the moment, but will be improved until the conference. Additionally I tested 7 Unix systems overall and compared my findings there. I'm going to explain all of the techniques that are implemented in the tool, how they work and why and about the difference between operating systems.