Exposed Docker Socket
The Docker daemon can listen for Docker Engine API requests via three different types of socket:
unixtcpfd
By default, Docker runs through a non-networked UNIX socket, which is created at /var/run/docker.sock and requires either root permission or docker group membership.
A tcp socket is used to remotely access the Docker daemon, for which the default setup provides un-encrypted and un-authenticated direct access. It is conventional to use port 2375 for un-encrypted, and port 2376 for encrypted communication with the daemon.
On Systemd-based systems, communication with the Docker daemon can occur over the Systemd socket fd://.
Sometimes the Docker daemon can be accessed inside the container or over the network. It is often leads to commands execution on the host system and escape from the container.
List of all containers
curl command to list all containers on the host over unix socket.
curl command to list all containers on the host over tcp socket.
Create a container
curl command to create container over unix socket.
curl command to create container over tcp socket.
Start the container
Code execution in a container
First you need to create an instance of exec that will run in the container.
Now that exec has been created, you need to run it.
Host takeover
To execute commands on the host system, start the Docker container and mount the host root directory on the container volume.
Download ubuntu image.
Create a container.
Start the container.
In order to execute commands on the host system, change the root directory.
References
Last updated