Docker API Remote Root Shell Exploit

A Simple Python Program that uses Docker Module to communicate with Docker API and gets a Remote Root Shell on the Target Device

Requirements

Language Used = Python3
Modules/Packages used:

• os
• docker
• paramiko
• socket
• random
• string
• base64
• getpass
• datetime
• subprocess
• optparse
• multithreading
• colorama
• time

Install the dependencies:

pip install -r requirements.txt

Setup

After installing Docker on your local device, run the following commands as root user

docker pull ubuntu:20.04
docker save ubuntu:20.04 -o ubuntu_image.tar
chmod 666 ubuntu_image.tar

Working

Result

After Successful Exploitation, we can directly ssh to the target device as root user or the provided user.

Note

This Method won't work if the Docker API is password Protected or when Docker is run with non-root user.