This post is part 2 of a series of blog posts on container hacking. If you haven’t read part 1, you should check it out. Today I’m going to tell you about a new collection of scripts, and a lab VM for hacking containers. Both of these resources are currently works in progress, and are open source… *cough* contributions are welcome *cough*.
Board the Whaling Ship
*btw the Moby Dick/whale references will not stop*. Pequod is a Vagrant project which spins up a VM loaded with vulnerable containers to hack on. There’s still a lot to explore and build out here as I learn more and more. Currently, Pequod is built with a deliberately vulnerable Linux kernel and a few insecurely configured Docker containers. I highly encourage anybody to download the project, spin it up, and learn to escape the containers in the VM.
Cast Your Harpoon
Harpoon is a post exploitation tool written in bash with the intentions of aiding you in identifying if that swanky shell, RCE, or whatever it is that you’ve got, is in a container. Currently it only supports fingerprinting for Docker containers, but support for CloudFoundry Garden is on the way. The tool also currently supports identifying the Docker socket (which you can read how dangerous it is in part 1). There are also plans to implement the ability to automatically exploit the Docker socket and establish a shell, among a lot of other things.
Conclusion
So, that’s it. Both Pequod and Harpoon are projects which I work on when I have some spare time. They aim to arm pentesters, DevOps, and developers with some extra knowledge about container security. I’m hoping that you find the tools and concepts interesting and tinker with them on your own. If there is anything that you don’t understand, I encourage you to make an issue or a pull request on the GitHub repo, especially if you figure out something new and cool! Look out for part 3 of this series where I will do a deep dive on container fingerprinting techniques.
Want to know if your containers can be escaped?
Our team tests Docker environments, container orchestration platforms, and cloud infrastructure for misconfigurations and escape paths. Reach out to discuss a penetration test.
