Escaping Linux CHROOT jail – Cyber Security Training & Ethical Hacking


Isolation is a security approach provided by many computer systems.It is based on splitting the system to smaller independent pieces to make sure that a compromised sub-system cannot affect the entire entity.This approach is present in every modern operating system (e.g User accounts,process address spaces etc..)

Chroot Jail is a way to separate a process that don’t run as root and its children from the rest of the system by creating a Jail using chroot() system call (system call is an interface between an application and the Linux kernel).The idea is to create a directory and make the process think that it is in the root folder and not letting it access or modify outside that jail.Let’s see how to build this jail and how to escape it.

Setup a Prisoner user

Create a new user: sudo adduser prisoner

Add prisoner to root group : sudo gpasswd -a prisoner root

(Check by visiting the /etc/group path)

Create a Chroot folder : mkdir chroot

Enter chroot (cd /chroot ) and create : bin,dev, etc, home, home/prisoner, lib, var, usr, usr/bin folders: mkdir bin dev etc home home/prisoner lib var usr usr/bin

(we need at least bin and lib directory inside the jail.)

Now let’s copy the bash shell utility that we want the prisoner user to be able to use.

Type: cp /bin/bash /chroot/bin/

To make sure that the bash shell will work properly we need to locate its necessary libraries and copying them to /lib jail folder: ldd /bin/bash

Now let’s use the Magic Chroot command : sudo chroot /chroot /bin/bash

Ps: if you get this error: chroot: failed to run command ‘/bin/bash’ no such file or directory please check this answer.


Escaping the jail:

Now let’s see how to escape this type of jails:

First we need to guess the available commands by just typing some commands: cd,ls,pwd,cp,vi etc… to know what we can use to escape.

Know the $SHELL and the $PATH variables using: echo $PATH and echo $SHELL.

There are different methods and ideas to escape the jail for example:

If ‘/’ is available just run /bin/bash.

If ‘set’ is available use: export PATH=/bin:/usr/bin:$PATH

and export SHELL=/bin/sh

Use other system commands e.g: awk ‘BEGIN {system(“/bin/sh”)}’

Use scripting language e.g: python – c ‘import os;os.system(“/bin/bash”)’




The post Escaping Linux CHROOT jail appeared first on Cyber Security Training & Ethical Hacking.


Deixe um comentário

Preencha os seus dados abaixo ou clique em um ícone para log in:

Logotipo do

Você está comentando utilizando sua conta Sair /  Alterar )

Foto do Google+

Você está comentando utilizando sua conta Google+. Sair /  Alterar )

Imagem do Twitter

Você está comentando utilizando sua conta Twitter. Sair /  Alterar )

Foto do Facebook

Você está comentando utilizando sua conta Facebook. Sair /  Alterar )


Conectando a %s