Docker containers are like tiny, self-contained universes—efficient, portable, and perfect for running applications. But here’s the catch: if you don’t configure them properly, they can turn into a hacker’s playground. Think of it as building a fortress but forgetting to lock the doors. Oops.

As a penetration tester, I’ve seen my fair share of misconfigured Docker containers. From exposed ports to privileged containers, there are plenty of ways to break out of the box and wreak havoc on the host system. And let’s be honest, who doesn’t love a good escape room challenge?

In this guide, we’ll dive into the world of Docker exploitation. We’ll cover common misconfigurations, creative ways to break out of containers, and advanced techniques to escalate privileges and take control of the host system. Whether you’re a Docker newbie or a seasoned pro, this article will give you the tools and knowledge to exploit (and defend) containerized environments.

Exploiting Docker:

Grab your favorite terminal emulator, fire up your Docker engine, and let’s get started. By the end of this, you’ll be breaking out of containers like a digital Houdini.

1. Exposed Docker Sockets: The Golden Ticket

What it is: Docker sockets exposed to the container, allowing full control of the Docker daemon.
Why it works: The Docker socket is the gateway to the Docker daemon, and if it’s exposed, attackers can control containers and the host system.

How to exploit it:

• Mount the Docker socket: If the Docker socket is mounted inside the container, you can use it to control the Docker daemon.
• Create new containers: Use the Docker socket to create new containers with privileged access.
• Escape to the host: Use the Docker socket to execute commands on the host system.

Examples:

1. Mounting the Docker Socket: If the Docker socket is mounted at /var/run/docker.sock, you can use it to control the Docker daemon.
2. Creating a Privileged Container: Use the Docker socket to create a new container with privileged access and escape to the host.

Tools to use:

• Docker CLI: For interacting with the Docker daemon.
• curl: For sending HTTP requests to the Docker API.

How to defend: Avoid mounting the Docker socket inside containers, and restrict access to the Docker daemon.

---

2. Privileged Containers: The Ultimate Escape

What it is: Containers running with privileged access, allowing full control of the host system.
Why it works: Privileged containers have access to the host’s kernel and devices, making it easy to escape to the host.

How to exploit it:

• Access host devices: Use privileged access to mount the host’s filesystem and escape to the host.
• Modify kernel parameters: Use privileged access to modify kernel parameters and gain control of the host.
• Execute commands on the host: Use privileged access to execute commands on the host system.

Examples:

1. Mounting the Host Filesystem: Use privileged access to mount the host’s filesystem and escape to the host.
2. Modifying Kernel Parameters: Use privileged access to modify kernel parameters and gain control of the host.

Tools to use:

• Docker CLI: For interacting with the Docker daemon.
• nsenter: For entering the host’s namespaces.

How to defend: Avoid running containers with privileged access, and use user namespaces to isolate containers.

---

3. Misconfigured Capabilities: A Hacker’s Playground

What it is: Containers with unnecessary capabilities, allowing attackers to escalate privileges.
Why it works: Capabilities grant containers specific privileges, and if misconfigured, they can be exploited to escalate privileges.

How to exploit it:

• Exploit CAP_SYS_ADMIN: Use the CAP_SYS_ADMIN capability to mount the host’s filesystem and escape to the host.
• Exploit CAP_NET_RAW: Use the CAP_NET_RAW capability to perform network attacks.
• Exploit CAP_DAC_READ_SEARCH: Use the CAP_DAC_READ_SEARCH capability to bypass file permissions.

Examples:

1. Exploiting CAP_SYS_ADMIN: Use the CAP_SYS_ADMIN capability to mount the host’s filesystem and escape to the host.
2. Exploiting CAP_NET_RAW: Use the CAP_NET_RAW capability to perform network attacks.

Tools to use:

• Docker CLI: For interacting with the Docker daemon.
• capsh: For manipulating capabilities.

How to defend: Use the principle of least privilege, and only grant necessary capabilities to containers.

---

4. Exposed Ports: The Open Door

What it is: Containers with unnecessary ports exposed to the network.
Why it works: Exposed ports can be exploited to gain access to the container or the host system.

How to exploit it:

• Scan for open ports: Use tools like Nmap to scan for open ports on the container.
• Exploit vulnerable services: Exploit vulnerable services running on exposed ports to gain access to the container.
• Pivot to the host: Use access to the container to pivot to the host system.

Examples:

1. Exploiting a Vulnerable Web Server: Exploit a vulnerable web server running on an exposed port to gain access to the container.
2. Pivoting to the Host: Use access to the container to pivot to the host system.

Tools to use:

• Nmap: For scanning open ports.
• Metasploit: For exploiting vulnerable services.

How to defend: Only expose necessary ports, and use network segmentation to isolate containers.

---

5. Insecure Images: The Trojan Horse

What it is: Containers running insecure or malicious images.
Why it works: Insecure images can contain vulnerabilities or backdoors that can be exploited to gain access to the container or the host system.

How to exploit it:

• Use malicious images: Run containers from malicious images to gain access to the container or the host system.
• Exploit vulnerabilities in images: Exploit vulnerabilities in insecure images to gain access to the container or the host system.

Examples:

1. Running a Malicious Image: Run a container from a malicious image to gain access to the container or the host system.
2. Exploiting a Vulnerable Image: Exploit a vulnerability in an insecure image to gain access to the container or the host system.

Tools to use:

• Docker CLI: For interacting with the Docker daemon.
• Trivy: For scanning images for vulnerabilities.

How to defend: Use trusted images, scan images for vulnerabilities, and implement image signing.

---

Conclusion

Docker containers are a powerful tool, but they’re also a prime target for attackers. By understanding and exploiting these vulnerabilities, you can help organizations strengthen their defenses and protect their containerized environments. Remember, the goal isn’t just to break in—it’s to make the system more secure.

TL;DR

• Exposed Docker Sockets: Control the Docker daemon and escape to the host.
• Privileged Containers: Gain full control of the host system.
• Misconfigured Capabilities: Escalate privileges and escape to the host.
• Exposed Ports: Exploit vulnerable services and pivot to the host.
• Insecure Images: Run malicious or vulnerable images to gain access.