bb-container

Container Escape Analysis

Purpose

When you have shell access inside a container, this command systematically checks all escape vectors and provides ready-to-run exploitation commands.

Workflow

Step 1: Confirm Container Environment

Run these checks to confirm containerization:

# Quick container detection
echo "[*] Container Detection"
[ -f /.dockerenv ] && echo "[+] Docker: /.dockerenv found"
grep -q docker /proc/1/cgroup 2>/dev/null && echo "[+] Docker: cgroup match"
grep -q lxc /proc/1/cgroup 2>/dev/null && echo "[+] LXC container"
[ -d /var/run/secrets/kubernetes.io ] && echo "[+] Kubernetes pod"
echo "[*] Hostname: $(hostname)"
echo "[*] Processes: $(ps aux 2>/dev/null | wc -l)"

Step 2: Check Escape Vectors

Docker Socket

echo "[*] Checking Docker socket..."
if [ -S /var/run/docker.sock ]; then
    echo "[!] VULNERABLE: Docker socket found!"
    curl -s --unix-socket /var/run/docker.sock http://localhost/version
fi

Docker Desktop API (Critical for HTB Windows hosts)

echo "[*] Checking Docker Desktop API..."
for ip in 192.168.65.7 192.168.65.1 host.docker.internal 172.17.0.1 172.18.0.1; do
    if curl -s -m 2 http://$ip:2375/version 2>/dev/null | grep -q Version; then
        echo "[!] VULNERABLE: Docker API at $ip:2375"
    fi
done

Privileged Mode

echo "[*] Checking privileged mode..."
if fdisk -l 2>/dev/null | grep -q "/dev/"; then
    echo "[!] VULNERABLE: Privileged container - can access disks"
    fdisk -l 2>/dev/null | grep "^Disk /dev"
fi

Capabilities

echo "[*] Checking capabilities..."
capsh --print 2>/dev/null | grep -E "cap_sys_admin|cap_sys_ptrace|cap_net_admin" && \
    echo "[!] Dangerous capabilities found"

Host Mounts

echo "[*] Checking for host filesystem..."
for path in /host /hostfs /mnt/host /rootfs; do
    [ -f "$path/etc/passwd" ] && echo "[!] Host filesystem at $path"
done

Step 3: Exploitation

Based on findings, use appropriate escape: