Docker - Port 2375,2376
Become VeryLazyTech member! 🎁
Follow us on:
✖ Twitter @VeryLazyTech.
👾 Github @VeryLazyTech.
📜 Medium @VeryLazyTech.
📺 YouTube @VeryLazyTech.
📩 Telegram @VeryLazyTech.
🕵️♂️ My Site @VeryLazyTech.
Visit our shop for e-books and courses. 📚
Basic info
Docker is a widely used containerization platform that allows developers to package applications with their dependencies into isolated units. However, misconfigurations, exposed APIs, and poor access control practices can create serious security risks. This guide provides comprehensive techniques for Docker penetration testing, focusing on real-world attack vectors, privilege escalation, container escape, and host exploitation.
Identifying Docker in a Target Environment
Detecting Docker Services via Network Scanning
Docker’s remote API may be exposed on:
Port 2375 (unencrypted)
Port 2376 (TLS-encrypted)
Scan using Nmap:
Check for Docker API access:
If you receive JSON output, the Docker API is unauthenticated and exposed.
Exploiting Exposed Docker API
Listing Containers
Running a New Container (Interactive Shell)
Then start it:
Access with:
This allows you to escape to the host by accessing /host.
Docker Socket Abuse (/var/run/docker.sock)
/var/run/docker.sock)When Docker is exposed via the Docker socket, it allows root-level control over the host.
Check access:
Privilege Escalation via Docker Socket
If you have write access to docker.sock, you can create a container with the host mounted:
This drops you into the host filesystem as root.
Container Escape Techniques
1. Privileged Containers
Check if container runs with --privileged:
If you see docker with no restrictions, and cap_sys_admin, then:
2. Mounting Host Filesystems
Containers running with -v /:/mnt allow direct access to the host’s root filesystem.
Escalate:
Then modify /etc/shadow, /etc/sudoers, or inject SSH keys.
Detecting Docker Environment From Inside a Container
Check for containerized environment:
Look for environment variables like:
Presence of /docker-entrypoint.sh, /var/run/docker.sock, or .dockerenv are telltale signs.
Attacking Misconfigured Docker Registries
Discovering Registries
Access registry:
List tags:
Pull vulnerable images:
Analyze locally for secrets or backdoors.
Privilege Escalation via Docker Group Membership
If a user is in the docker group, they can effectively become root:
Check:
If docker is listed, the user has full control over the host.
Learn & practice For the Bug Bounty
Last updated
Was this helpful?