2375, 2376 Pentesting Docker
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Docker is the forefront platform in the containerization industry, spearheading continuous innovation. It facilitates the effortless creation and distribution of applications, spanning from traditional to futuristic, and assures their secure deployment across diverse environments.
containerd: This is a core runtime for containers, tasked with the comprehensive management of a container's lifecycle. This involves handling image transfer and storage, in addition to overseeing the execution, monitoring, and networking of containers. More detailed insights on containerd are further explored.
The container-shim plays a critical role as an intermediary in the handling of headless containers, seamlessly taking over from runc after the containers are initialized.
runc: Esteemed for its lightweight and universal container runtime capabilities, runc is aligned with the OCI standard. It is used by containerd to start and manage containers according to the OCI guidelines, having evolved from the original libcontainer.
grpc is essential for facilitating communication between containerd and the docker-engine, ensuring efficient interaction.
The OCI is pivotal in maintaining the OCI specifications for runtime and images, with the latest Docker versions being compliant with both the OCI image and runtime standards.
Containerd was specifically developed to serve the needs of container platforms like Docker and Kubernetes, among others. It aims to simplify the execution of containers across various operating systems, including Linux, Windows, Solaris, and more, by abstracting operating system-specific functionality and system calls. The goal of Containerd is to include only the essential features required by its users, striving to omit unnecessary components. However, achieving this goal completely is acknowledged as challenging.
A key design decision is that Containerd does not handle networking. Networking is considered a critical element in distributed systems, with complexities such as Software Defined Networking (SDN) and service discovery that vary significantly from one platform to another. Therefore, Containerd leaves networking aspects to be managed by the platforms it supports.
While Docker utilizes Containerd to run containers, it's important to note that Containerd only supports a subset of Docker's functionalities. Specifically, Containerd lacks the network management capabilities present in Docker and does not support the creation of Docker swarms directly. This distinction highlights Containerd's focused role as a container runtime environment, delegating more specialized functionalities to the platforms it integrates with.
Podman is an open-source container engine that adheres to the Open Container Initiative (OCI) standards, developed and maintained by Red Hat. It stands out from Docker with several distinct features, notably its daemonless architecture and support for rootless containers, enabling users to run containers without root privileges.
Podman is designed to be compatible with Docker's API, allowing for the use of Docker CLI commands. This compatibility extends to its ecosystem, which includes tools like Buildah for building container images and Skopeo for image operations such as push, pull, and inspect. More details on these tools can be found on their GitHub page.
Key Differences
Architecture: Unlike Docker’s client-server model with a background daemon, Podman operates without a daemon. This design means containers run with the privileges of the user who starts them, enhancing security by eliminating the need for root access.
Systemd Integration: Podman integrates with systemd to manage containers, allowing for container management through systemd units. This contrasts with Docker's use of systemd primarily for managing the Docker daemon process.
Rootless Containers: A pivotal feature of Podman is its ability to run containers under the initiating user's privileges. This approach minimizes the risks associated with container breaches by ensuring that attackers gain only the compromised user's privileges, not root access.
Podman's approach offers a secure and flexible alternative to Docker, emphasizing user privilege management and compatibility with existing Docker workflows.
Note that as podam aims to support the same API as docker, you can use the same commands with podman as with docker such as:
Remote API is running by default on 2375 port when enabled. The service by default will not require authentication allowing an attacker to start a privileged docker container. By using the Remote API one can attach hosts / (root directory) to the container and read/write files of the host’s environment.
Default port: 2375
Note that in order to enumerate the docker API you can use the docker command or curl like in the following example:
If you can contact the remote docker API with the docker command you can execute any of the docker commands previously commented to interest with the service.
You can export DOCKER_HOST="tcp://localhost:2375" and avoid using the -H parameter with the docker command
Fast privilege escalation
Curl
Sometimes you’ll see 2376 up for the TLS endpoint. I haven’t been able to connect to it with the docker client but it's possible to do it with curl.
If you want more information about this, more information is available where I copied the commands from: https://securityboulevard.com/2019/02/abusing-docker-api-socket/
In the following page you can find ways to escape from a docker container:
Docker SecurityAbusing this it's possible to escape form a container, you could run a weak container in the remote machine, escape from it, and compromise the machine:
If you are inside a host that is using docker, you may read this information to try to elevate privileges.
Check env (environment variable section) for secrets and you may find:
Passwords.
Ip’s.
Ports.
Paths.
Others… .
If you want to extract a file:
You can use the tool https://github.com/docker/docker-bench-security to inspect your current docker installation.
./docker-bench-security.sh
You can use the tool https://github.com/kost/dockscan to inspect your current docker installation.
dockscan -v unix:///var/run/docker.sock
You can use the tool https://github.com/genuinetools/amicontained the privileges a container will have when run with different security options. This is useful to know the implications of using some security options to run a container:
docker run --rm -it r.j3ss.co/amicontained
docker run --rm -it --pid host r.j3ss.co/amicontained
docker run --rm -it --security-opt "apparmor=unconfined" r.j3ss.co/amicontained
You can use a docker image of https://github.com/quay/clair to make it scan your other docker images and find vulnerabilities.
docker run --rm -v /root/clair_config/:/config -p 6060-6061:6060-6061 -d clair -config="/config/config.yaml"
clair-scanner -c http://172.17.0.3:6060 --ip 172.17.0.1 ubuntu-image
You can use the tool https://github.com/buddy-works/dockerfile-linter to inspect your Dockerfile and find all kinds of misconfigurations. Each misconfiguration will be given an ID, you can find here https://github.com/buddy-works/dockerfile-linter/blob/master/Rules.md how to fix each of them.
dockerfilelinter -f Dockerfile
You can use the tool https://github.com/replicatedhq/dockerfilelint to inspect your Dockerfile and find all kinds of misconfigurations.
dockerfilelint Dockerfile
You can use the tool https://github.com/RedCoolBeans/dockerlint to inspect your Dockerfile and find all kinds of misconfigurations.
dockerlint Dockerfile
You can use the tool https://github.com/hadolint/hadolint to inspect your Dockerfile and find all kinds of misconfigurations.
hadolint Dockerfile
You can use the tool https://github.com/falcosecurity/falco to detect suspicious behaviour in running containers.
Note in the following chunk how Falco compiles a kernel module and insert it. After that, it loads the rules and start logging suspicious activities. In this case it has detected 2 privileged containers started, 1 of them with a sensitive mount, and after some seconds it detected how a shell was opened inside one of the containers.
You can use auditd to monitor docker.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
