Featured image of post Threat Hunting in Docker Uncovering Weaknesses
Threat Hunting Docker

Threat Hunting in Docker Uncovering Weaknesses

Explore Docker misconfigurations attackers exploit, like exposed APIs and privileged containers, and learn detection tips for threat hunters

Hi 👋, in this post, we’ll explore common Docker misconfigurations attackers exploit to compromise systems, such as exposed APIs and privileged containers, with detection strategies for threat hunters.

Exposed Docker APIs

Exposing Docker’s API to the internet without authentication allows attackers full control over containers.

Exploitation

Attackers use tools like Shodan to find exposed APIs on ports 2375 or 2376 and create containers remotely:

1

curl -X POST http://<docker_host_ip>:2375/containers/create -d '{"Image":"alpine"}'

Detection

  1. Use Nmap to scan for open Docker API ports:
1

nmap -p 2375 --open <target_subnet>
  1. Monitor API logs for requests from external IPs.

Privileged Containers

Running containers in privileged mode gives attackers root-level access to the host.

Exploitation

An attacker inside a privileged container can mount the host’s root directory:

1

docker run --privileged -v /:/host --rm -it alpine chroot /host

Detection

Identify privileged containers:

1

docker inspect --format '{{ .HostConfig.Privileged }}' $(docker ps -q)

Insecure Volume Mounts

Improper mounts of sensitive directories (like /etc or /root) give attackers access to critical host data.

Exploitation

Attackers can mount the host file system:

1
2

docker run -v /:/host --rm -it alpine /bin/sh
cat /host/etc/shadow

Detection

Check for dangerous mounts:

1

docker inspect --format '{{ .Mounts }}' $(docker ps -q)

Cgroups and Namespace Escapes

Excessive privileges, like SYS_ADMIN, can break Docker’s isolation.

Exploitation

Run a container with the SYS_ADMIN capability to escape to the host:

1

docker run --cap-add=SYS_ADMIN -it alpine /bin/sh

Detection

Inspect running containers for dangerous capabilities:

1

docker inspect --format '{{ .HostConfig.CapAdd }}' $(docker ps -q)

Resource Exhaustion: Denial of Service

Containers without resource limits can overwhelm system resources, leading to Denial of Service (DoS) attacks.

Exploitation

Run a container to consume excessive CPU:

1

docker run --rm -it --cpu-shares=1024 --memory=1g stress --cpu 8 --timeout 60

Detection

Monitor resource usage with docker stats:

1

docker stats

References: