├── .gitignore ├── AUTHORS ├── LICENSE ├── README.md ├── setns-common ├── Cargo.lock ├── Cargo.toml └── src │ └── lib.rs └── setns-so ├── .cargo ├── .gitignore └── config.bak ├── .gitignore ├── Cargo.lock ├── Cargo.toml ├── build.rs ├── build.sh ├── frida ├── .gitignore └── x86_64-unknown-linux-gnu │ └── .gitignore ├── patch.py └── src ├── lib.rs └── main.rs /.gitignore: -------------------------------------------------------------------------------- 1 | .idea/ 2 | -------------------------------------------------------------------------------- /AUTHORS: -------------------------------------------------------------------------------- 1 | Creators: 2 | --------- 3 | - Jeff Dileo 4 | 5 | 6 | Maintainers: 7 | ------------ 8 | - Jeff Dileo 9 | 10 | 11 | Contributors: 12 | ------------- 13 | 14 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Copyright (c) NCC Group, 2021 2 | All rights reserved. 3 | 4 | Redistribution and use in source and binary forms, with or without 5 | modification, are permitted provided that the following conditions are met: 6 | 7 | 1. Redistributions of source code must retain the above copyright notice, this 8 | list of conditions and the following disclaimer. 9 | 2. Redistributions in binary form must reproduce the above copyright notice, 10 | this list of conditions and the following disclaimer in the documentation 11 | and/or other materials provided with the distribution. 12 | 13 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND 14 | ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 15 | WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 16 | DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR 17 | ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 18 | (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 19 | LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 20 | ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 21 | (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 22 | SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 23 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Insject 2 | 3 | `insject` is a tool for poking at containers. It enables you to run an 4 | arbitrary command in a container or any mix of Linux namespaces. It supports 5 | three main use-cases: 6 | 7 | * LD_PRELOAD-mode using `libsetns.so` (`LD_PRELOAD=./libsetns.so SETNS_ARGS="..."`) 8 | * Running a host command in a container (`insject ... -- ...`) 9 | * Forcing a running process into a container (`insject ... -! `) 10 | 11 | When using the first two modes, the `-s ` option is used to place a 12 | function hook that triggers the containerization of the process. This can help 13 | with simple commands that need to load resources from the host filesystem by 14 | having them containerize on calling a specific function after initializing. 15 | 16 | For processes with more complicated initialization routines, such as scripting 17 | languages, the third use-case may be preferable, enabling one to ensure full 18 | initialization before entering a container. 19 | 20 | ***Note:*** insject and libsetns.so share the same limitations as `setns(2)` in 21 | that they may fail when a process contains multiple threads. 22 | 23 | ***WARNING:*** Be careful when accessing or executing files in containers as 24 | they may be able to abuse the access of the joined process to escape. 25 | 26 | ## Installation 27 | 28 | ``` 29 | $ wget https://github.com/frida/frida/releases/download/14.2.17/frida-gum-devkit-14.2.17-linux-x86_64.tar.xz 30 | $ tar -xvJf frida-gum-devkit-14.2.17-linux-x86_64.tar.xz 31 | $ mv frida-gum.h setns-so/frida/ 32 | $ mv libfrida-gum.a setns-so/frida/x86_64-unknown-linux-gnu/ 33 | $ pip3 install --user lief 34 | $ cd setns-so 35 | $ cargo build --lib --release 36 | $ cargo build --bin insject --release 37 | $ python3 patch.py target/release/insject 38 | ``` 39 | 40 | ## Examples 41 | 42 | ``` 43 | ## Terminal 1 44 | $ docker run --rm -it -v $(PWD):/FOO:ro alpine /bin/sh 45 | / # ls / 46 | bin dev etc FOO home lib media mnt opt proc root run sbin srv sys tmp usr var 47 | ``` 48 | 49 | ``` 50 | ## Terminal 2 51 | $ sudo bash 52 | # echo $$ 53 | 164001 54 | # 55 | ``` 56 | 57 | ``` 58 | ## Terminal 3 59 | $ docker ps -q 60 | acd1d4d97027 61 | $ docker inspect acd1d4d97027 | jq .[0].State.Pid 62 | 68575 63 | $ sudo LD_PRELOAD=./target/release/libsetns.so SETNS_ARGS="-I 68575 --user 0:85:0,1,2,3,4" ls / 64 | setns -> mnt: 0, net: 0, time: 0, ipc: N/A, uts: 0, pid: 0, cgroup: 0, userns: 0, apparmor: docker-default, user: 0/0/0 65 | bin dev etc FOO home lib media mnt opt proc root run sbin srv sys tmp usr var 66 | ``` 67 | 68 | ``` 69 | ## Terminal 2 70 | # setns -> mnt: 0, net: 0, time: 0, ipc: N/A, uts: 0, pid: 0, cgroup: 0, userns: 0, apparmor: docker-default, user: 0/0/0 71 | # ls / 72 | bin dev etc FOO home lib media mnt opt proc root run sbin srv sys tmp usr var 73 | # ifconfig 74 | eth0 Link encap:Ethernet HWaddr 02:42:AC:11:00:02 75 | inet addr:172.17.0.2 Bcast:172.17.255.255 Mask:255.255.0.0 76 | UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 77 | RX packets:525 errors:0 dropped:0 overruns:0 frame:0 78 | TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 79 | collisions:0 txqueuelen:0 80 | RX bytes:49454 (48.2 KiB) TX bytes:0 (0.0 B) 81 | 82 | lo Link encap:Local Loopback 83 | inet addr:127.0.0.1 Mask:255.0.0.0 84 | UP LOOPBACK RUNNING MTU:65536 Metric:1 85 | RX packets:0 errors:0 dropped:0 overruns:0 frame:0 86 | TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 87 | collisions:0 txqueuelen:1000 88 | RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) 89 | ``` 90 | 91 | ``` 92 | ## Terminal 3 93 | $ sudo ./target/release/insject -I 68575 --user 0:85:0,1,2,3,4 -- ls / 94 | setns -> mnt: 0, net: 0, time: 0, ipc: N/A, uts: 0, pid: 0, cgroup: 0, userns: 0, apparmor: docker-default, user: 0/0/0 95 | bin dev etc FOO home lib media mnt opt proc root run sbin srv sys tmp usr var 96 | $ sudo ./target/release/insject -I 68575 --user 0:85:0,1,2,3,4 -- id 97 | setns -> mnt: 0, net: 0, time: 0, ipc: N/A, uts: 0, pid: 0, cgroup: 0, userns: 0, apparmor: docker-default, user: 0/0/0 98 | uid=0 gid=85 groups=85,0,1,2,3,4 99 | $ sudo ./target/release/insject -I 68575 --user 0:85:0,1,2,3,4 -- sh -c id 100 | setns -> mnt: 0, net: 0, time: 0, ipc: N/A, uts: 0, pid: 0, cgroup: 0, userns: 0, apparmor: docker-default, user: 0/0/0 101 | uid=0(root) gid=85(usb) groups=0(root),1(bin),2(daemon),3(sys),4(adm) 102 | ``` 103 | 104 | ## Usage 105 | 106 | ``` 107 | $ insject --help 108 | insject 1.0 109 | Jeff Dileo 110 | A tool to simplify container testing that runs an arbitrary 111 | command in the Linux namespaces of other processes. 112 | 113 | WARNING: Be careful when accessing or executing files in containers as they may 114 | be able to abuse the access of the joined process to escape. 115 | 116 | Note: The -! instrumentation mode has several differences from the LD_PRELOAD modes: 117 | * Forking is not supported 118 | * -S,--strict is not supported 119 | * errno values are not returned 120 | 121 | USAGE: 122 | insject [FLAGS] [OPTIONS] [setns-opts]... [-- ...] 123 | 124 | ARGS: 125 | ... setns.so options. For detailed information, use --help-setns 126 | ... 127 | 128 | FLAGS: 129 | -h, --help Prints help information 130 | --help-setns Prints help information for setns.so 131 | -V, --version Prints version information 132 | 133 | OPTIONS: 134 | -! PID to instrument 135 | $ insject --help-setns 136 | libsetns.so 1.0 137 | Jeff Dileo 138 | An inject-/LD_PRELOAD-able shim to simplify container testing by joining an external program 139 | run with it into the Linux namespaces of other processes. 140 | 141 | WARNING: Be careful when accessing or executing files in containers as they may 142 | be able to abuse the access of the joined process to escape. 143 | 144 | USAGE: 145 | libsetns.so [FLAGS] [OPTIONS] [target-pid] 146 | 147 | ARGS: 148 | PID to source namespaces from by default 149 | 150 | FLAGS: 151 | --help Prints help information 152 | -A, --no-apparmor Skip setting AppArmor profile 153 | -C, --no-cgroup Skip setting cgroup namespace 154 | -F, --no-fork Skip fork after entering PID namespace, if entering PID namespace 155 | -I, --no-ipc Skip setting IPC namespace 156 | -M, --no-mnt Skip setting mount namespace 157 | -N, --no-net Skip setting network namespace 158 | -P, --no-pid Skip setting PID namespace 159 | -T, --no-time Skip setting time namespace 160 | -U, --no-userns Skip setting user namespace 161 | -H, --no-uts Skip setting UTS (hostname) namespace 162 | -S, --strict Exit if any namespace attach fails 163 | -1, --userns-first Set user namespace before other namespaces 164 | -V, --version Prints version information 165 | 166 | OPTIONS: 167 | -@, --raw-address
Raw memory address to hook instead of a symbol 168 | Note: This is not an offset 169 | -c, --cgroup Path to cgroup namespace to set 170 | -i, --ipc Path to IPC namespace to set 171 | -m, --mnt Path to mount namespace to set 172 | -n, --net Path to network namespace to set 173 | -p, --pid Path to PID namespace to set 174 | -a, --apparmor-profile Alternate AppArmor profile to set 175 | -s, --symbol Symbol to hook entry of instead of main 176 | -t, --time