{"id":1043,"date":"2019-10-13T13:44:30","date_gmt":"2019-10-13T13:44:30","guid":{"rendered":"https:\/\/www.devsecops.ltd\/?p=1043"},"modified":"2024-05-24T15:52:23","modified_gmt":"2024-05-24T15:52:23","slug":"lesson-3-container-reconnaissance-techniques-for-beginners","status":"publish","type":"post","link":"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/","title":{"rendered":"Lesson #3: Container reconnaissance techniques for beginners"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_67_1 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title \" >Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 eztoc-toggle-hide-by-default' ><ul class='ez-toc-list-level-2' ><li class='ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#Introduction\" title=\"Introduction\">Introduction<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#Docker_Containers\" title=\"Docker Containers\">Docker Containers<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#Identifying_the_right_container\" title=\"Identifying the right container\">Identifying the right container<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#Identify_a_container_using_its_creation_time\" title=\"Identify a container using its creation time\">Identify a container using its creation time<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#Identify_a_container_using_container_id\" title=\"Identify a container using container id\">Identify a container using container id<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#Identify_a_container_by_container_name\" title=\"Identify a container by container name\">Identify a container by container name<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-1'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#Analyzing_a_container\" title=\"Analyzing a container.\u00a0\">Analyzing a container.\u00a0<\/a><ul class='ez-toc-list-level-2' ><li class='ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#Block_the_container_from_exiting_by_using_interactive_commands\" title=\"Block the container from exiting by using interactive commands.\">Block the container from exiting by using interactive commands.<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#Block_the_container_from_exiting_by_using_an_infinite_loop_etc\" title=\"Block the container from exiting by using an infinite loop etc.,\">Block the container from exiting by using an infinite loop etc.,<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#Pause_the_container_temporarily\" title=\"Pause the container temporarily.\">Pause the container temporarily.<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#Docker_volumes\" title=\"Docker volumes\">Docker volumes<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#i\" title=\"\u00a0\">\u00a0<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#Docker_port_forwarding\" title=\"Docker port forwarding.\">Docker port forwarding.<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#Docker_environment_variables\" title=\"Docker environment variables\">Docker environment variables<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#Docker_inspect\" title=\"Docker inspect\">Docker inspect<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#Docker_top\" title=\"Docker top\">Docker top<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#Task\" title=\"Task\u00a0\">Task\u00a0<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#Docker_stats\" title=\"Docker stats\">Docker stats<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#Reference_and_Further_Reading\" title=\"Reference and Further Reading\">Reference and Further Reading<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/www.devsecops.ltd\/lesson-3-container-reconnaissance-techniques-for-beginners\/#Conclusion\" title=\"Conclusion\">Conclusion<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"Introduction\"><\/span><b>Introduction<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>We started our docker security journey with Docker basics like Docker images, Dockerfile and Docker Registry, we are now laying the groundwork for attacking the docker containers.<\/p>\r\n<p>The reconnaissance aka Information gathering is the first step of any security assessment. Once you get a shell; you, as a pentester or red teamer, your aim should be to learn about the victim as much as possible so you can do lateral movement and privilege escalation.<\/p>\r\n<p>For exactly this reason, you will need to know how to move around in the docker ecosystem for security misconfigurations, hardcoded credentials, and other interesting information.<\/p>\r\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1068 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/phases_of_hacking.png\" alt=\"\" width=\"1024\" height=\"768\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/phases_of_hacking.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/phases_of_hacking-300x225.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/phases_of_hacking-768x576.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/phases_of_hacking-510x382.png 510w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\r\n<p>In this lesson, we are going to cover the reconnaissance techniques which includes<\/p>\r\n<ol>\r\n<li>Starting and stopping of a container.<\/li>\r\n<li>Interacting with a container.<\/li>\r\n<li>Mounting container file system and volume mount.<\/li>\r\n<li>Connecting a container with the host&#8217;s network.<\/li>\r\n<li>Log storage mechanism.<\/li>\r\n<\/ol>\r\n<p>So without further ado, let&#8217;s get started.<\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Docker_Containers\"><\/span><b>Docker Containers<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>We already know that a running form of an image is a container and container helps in packaging the application and its dependency into a single executable.<\/p>\r\n<p>Imagine, we compromised a host and we want to do some information gathering. You might not know them now but by the end of this lesson, you will be well versed in the art of Docker information gathering.<\/p>\r\n<p><strong>Tip<\/strong>: As a pentester, your job is to ensure you are doing a security assessment without taking systems\/machines offline. So, it&#8217;s important to understand what starts, stops or crashes a docker container.<\/p>\r\n<blockquote>\r\n<p><span style=\"color: #e02b20;\"><strong>If you are our paid customer and taking any of our courses like CDE\/CDP\/CCSE\/CCNSE, please use the browser based lab portal to do all the exercises and do not use the below Virtual Machine.<\/strong>\u00a0<\/span><\/p>\r\n<\/blockquote>\r\n<p>&nbsp;<\/p>\r\n<p>Let&#8217;s try to start\/create a alpine container using the following command.<\/p>\r\n<blockquote>\r\n<pre>$ docker run alpine<\/pre>\r\n<\/blockquote>\r\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1077 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/image15.gif\" alt=\"\" width=\"1296\" height=\"674\" \/><\/p>\r\n<p>But there is no output for the above command. Let&#8217;s see what&#8217;s going on under the hood (sherlock mode on \ud83d\ude0e)<\/p>\r\n<p>Docker provides a nifty tool called ps to list running containers.<\/p>\r\n<blockquote>\r\n<pre>$ docker ps<\/pre>\r\n<\/blockquote>\r\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1069 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps.png\" alt=\"\" width=\"1578\" height=\"164\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps.png 1578w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps-300x31.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps-768x80.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps-1024x106.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps-1080x112.png 1080w\" sizes=\"(max-width: 1578px) 100vw, 1578px\" \/><\/p>\r\n<p>Interesting! it&#8217;s not running anymore. The docker ps command also has -a option to show the stopped containers.<\/p>\r\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1060 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps_a.png\" alt=\"\" width=\"1184\" height=\"268\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps_a.png 1184w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps_a-300x68.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps_a-768x174.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps_a-1024x232.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps_a-1080x244.png 1080w\" sizes=\"(max-width: 1184px) 100vw, 1184px\" \/><\/p>\r\n<p>You can see that our alpine container started, the shell executed and then exited.<\/p>\r\n<p><strong>Note:<\/strong> The <strong>docker ps<\/strong> is probably the first command you run once you know the host (<strong>ps aux | grep dockerd<\/strong>) is using docker.<\/p>\r\n<p>This is bad news for us, why?<\/p>\r\n<p>One, we didn&#8217;t get time to analyze the container for security issues, the container was short-lived. Two, there are many alpine containers in the above output. Which one is ours? and how do we ensure, we are targeting the right container (without affecting other containers)?<\/p>\r\n<p>In short, we have two problems to solve before we can analyze this image.<\/p>\r\n<ol>\r\n<li>Identify the right container.<\/li>\r\n<li>Stop a container from exiting.<\/li>\r\n<\/ol>\r\n<h2><span class=\"ez-toc-section\" id=\"Identifying_the_right_container\"><\/span><b>Identifying the right container<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>We can use the following techniques to identify the right container for us to play with.<\/p>\r\n<ol>\r\n<li>Identify a container using its creation time.<\/li>\r\n<li>Identify a container using container id.<\/li>\r\n<li>Identify a container by container name.<\/li>\r\n<\/ol>\r\n<h2><span class=\"ez-toc-section\" id=\"Identify_a_container_using_its_creation_time\"><\/span><b>Identify a container using its creation time<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>In this technique, we will run alpine image once again and assume the latest entry in it would be ours.<\/p>\r\n<p>Scientific technique? probably not as this machine might be a production machine running multiple container instances of the same image. Helps in a pinch? definitely!<\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Identify_a_container_using_container_id\"><\/span><b>Identify a container using container id<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>By default, the docker container tries to attach to your terminal and shows you the container output in the terminal. Since we are not providing any options to alpine image&#8217;s CMD i.e, \/bin\/sh, it just exits. You can get this container id by using -d option which detaches it from the terminal (STDIN, STDERR, and STDOUT).<\/p>\r\n<blockquote>\r\n<pre>$ docker run -d alpine<\/pre>\r\n<\/blockquote>\r\n<p><b><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1067 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_run_d_alpine.png\" alt=\"\" width=\"1538\" height=\"128\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_run_d_alpine.png 1538w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_run_d_alpine-300x25.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_run_d_alpine-768x64.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_run_d_alpine-1024x85.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_run_d_alpine-1080x90.png 1080w\" sizes=\"(max-width: 1538px) 100vw, 1538px\" \/><\/b><\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Identify_a_container_by_container_name\"><\/span><b>Identify a container by container name<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>This technique is not always possible as the application might be already running. But if you are doing an internal assessment then maybe you can stop an existing container and spin up a new one with a new name.<\/p>\r\n<p>Conveniently docker allows us to name containers using the &#8211;name argument.<\/p>\r\n<blockquote>\r\n<pre>$ docker run --name myalpine alpine<\/pre>\r\n<\/blockquote>\r\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1061 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps_alpine.png\" alt=\"\" width=\"1534\" height=\"506\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps_alpine.png 1534w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps_alpine-300x99.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps_alpine-768x253.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps_alpine-1024x338.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps_alpine-1080x356.png 1080w\" sizes=\"(max-width: 1534px) 100vw, 1534px\" \/><\/p>\r\n<p>As you can see the docker container is not running but we know which alpine container is ours i.e, myalpine. It&#8217;s also a best practice to name the containers wherever possible.<\/p>\r\n<p>We have discussed a few of the techniques to find out the right containers to target, let&#8217;s move on to analyzing the containers by either pausing\/stopping.<\/p>\r\n<h1><span class=\"ez-toc-section\" id=\"Analyzing_a_container\"><\/span><b>Analyzing a container.\u00a0<\/b><span class=\"ez-toc-section-end\"><\/span><\/h1>\r\n<ol>\r\n<li>Block the container from exiting by using interactive commands.<\/li>\r\n<li>Block the container from exiting by using an infinite loop etc.,<\/li>\r\n<li>Pause the container temporarily.<\/li>\r\n<\/ol>\r\n<h2><span class=\"ez-toc-section\" id=\"Block_the_container_from_exiting_by_using_interactive_commands\"><\/span><b>Block the container from exiting by using interactive commands.<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>The alpine image is created using the following Dockerfile.<\/p>\r\n<blockquote>\r\n<pre>FROM scratch\r\n ADD alpine-minirootfs-3.10.2-x86_64.tar.gz \/\r\n CMD [\"\/bin\/sh\"]<\/pre>\r\n<\/blockquote>\r\n<p>As you can see line 3, the alpine container doesn&#8217;t do much, just runs \/bin\/sh and exits but we can run some interactive commands inside a container to make it wait for user input (like sh, shell).<\/p>\r\n<p>You can use -i and -t options to achieve this.<\/p>\r\n<blockquote>\r\n<pre>$ docker run -it alpine \/bin\/sh<\/pre>\r\n<\/blockquote>\r\n<p>-i stands for interactive mode<br \/>-t stands for tty (terminal)<\/p>\r\n<p>Open another terminal\/tab and type \u201cdocker ps\u201d command, you will see that the container is up and running and we can proceed to analyze it.<\/p>\r\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1059 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps_id.png\" alt=\"\" width=\"643\" height=\"161\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps_id.png 643w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_ps_id-300x75.png 300w\" sizes=\"(max-width: 643px) 100vw, 643px\" \/><\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Block_the_container_from_exiting_by_using_an_infinite_loop_etc\"><\/span><b>Block the container from exiting by using an infinite loop etc.,<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>Another technique to stop a container from exiting immediately is to run it in an infinite loop using shell commands.<\/p>\r\n<blockquote>\r\n<pre>$ docker run -d -it alpine sh -c \"while true; do sleep 2; done\"<\/pre>\r\n<\/blockquote>\r\n<p>option &#8211;detach or -d, means that a Docker container runs in the background of your terminal. It does not receive input or display output.<\/p>\r\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1063 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_while_true.png\" alt=\"\" width=\"1538\" height=\"240\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_while_true.png 1538w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_while_true-300x47.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_while_true-768x120.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_while_true-1024x160.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_while_true-1080x169.png 1080w\" sizes=\"(max-width: 1538px) 100vw, 1538px\" \/><\/p>\r\n<p>We can see that our docker container (with id 2cc32e7c0178) is running in the detached mode<\/p>\r\n<p>Now, if you want to log into a container (for lack of a better word), you can use docker exec command to run any arbitrary commands inside a container like downloading a kernel exploit, installing compilers, security tools etc.,<\/p>\r\n<blockquote>\r\n<pre>$ docker exec -it 2cc32e7c0178 sh<\/pre>\r\n<\/blockquote>\r\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1065 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_exec_running_as_root.png\" alt=\"\" width=\"1398\" height=\"268\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_exec_running_as_root.png 1398w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_exec_running_as_root-300x58.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_exec_running_as_root-768x147.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_exec_running_as_root-1024x196.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_exec_running_as_root-1080x207.png 1080w\" sizes=\"(max-width: 1398px) 100vw, 1398px\" \/><\/p>\r\n<p>Game Over?<\/p>\r\n<p>&nbsp;<\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Pause_the_container_temporarily\"><\/span><b>Pause the container temporarily.<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>Sometimes, you just want to stop a container temporarily(pause) to see what happens in the network or on the file system.<\/p>\r\n<p>Let&#8217;s start another alpine container with an infinite loop with date echo and see how it behaves with pausing and unpausing.<\/p>\r\n<blockquote>\r\n<pre>$ docker run --name your-alpine -it alpine sh -c \"while true; do sleep 3; date; done\"<\/pre>\r\n<\/blockquote>\r\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1071 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_pause.png\" alt=\"\" width=\"1538\" height=\"492\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_pause.png 1538w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_pause-300x96.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_pause-768x246.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_pause-1024x328.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_pause-1080x345.png 1080w\" sizes=\"(max-width: 1538px) 100vw, 1538px\" \/><\/p>\r\n<p>As you can see it outputs the current date every 3 seconds.<\/p>\r\n<p>Open another terminal and run the following command.<\/p>\r\n<blockquote>\r\n<pre>$ docker pause your-alpine<\/pre>\r\n<\/blockquote>\r\n<p>Go back to the first terminal and see the container is no longer showing date. Let&#8217;s unpause it using the below command.<\/p>\r\n<blockquote>\r\n<pre>$ docker unpause your-alpine<\/pre>\r\n<\/blockquote>\r\n<p>Don&#8217;t forget to stop the docker container by either using Ctrl+C or docker stop command<\/p>\r\n<blockquote>\r\n<pre>$ docker stop your-alpine<\/pre>\r\n<\/blockquote>\r\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1075 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_unpause.png\" alt=\"\" width=\"1082\" height=\"350\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_unpause.png 1082w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_unpause-300x97.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_unpause-768x248.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_unpause-1024x331.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_unpause-1080x349.png 1080w\" sizes=\"(max-width: 1082px) 100vw, 1082px\" \/><\/p>\r\n<p>Note: You can usually use container id wherever you can use a name and vice versa.<\/p>\r\n<p>e.g. docker pause 357de0241336 == docker pause your-alpine<\/p>\r\n<p>Now that you know how to interact with Docker containers, let&#8217;s explore some interesting docker features which are especially relevant to docker security\/reconnaissance.<\/p>\r\n<ol>\r\n<li>Docker volumes<\/li>\r\n<li>Docker port forwarding<\/li>\r\n<li>Docker environment variables<\/li>\r\n<li>Docker inspect<\/li>\r\n<li>Docker top<\/li>\r\n<li>Docker stats<\/li>\r\n<\/ol>\r\n<h2><span class=\"ez-toc-section\" id=\"Docker_volumes\"><\/span><b>Docker volumes<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>By default, when you stop and remove a container, all the changes made inside the container are lost. We can use the docker\u2019s volume mounting feature to store data even after container stops or is destroyed.<\/p>\r\n<p>Pro tip: Unlike VMs, docker volumes are not well guarded and are a good source for sensitive information like passwords, backups, and configurations.<\/p>\r\n<p>Let&#8217;s create an alpine container in the interactive mode and see how docker volume works.<\/p>\r\n<blockquote>\r\n<pre>$ docker run -it --rm alpine sh<\/pre>\r\n<\/blockquote>\r\n<p>Here &#8211;rm flag tells the daemon to remove\/destroy the container once it finishes its execution.<\/p>\r\n<p>Let&#8217;s create a file called top-secret under \/tmp directory and see if docker saves this file on the host.<\/p>\r\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1066 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_touch_top_secret.png\" alt=\"\" width=\"1048\" height=\"262\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_touch_top_secret.png 1048w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_touch_top_secret-300x75.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_touch_top_secret-768x192.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_touch_top_secret-1024x256.png 1024w\" sizes=\"(max-width: 1048px) 100vw, 1048px\" \/><\/p>\r\n<p>We came out of the container by typing exit in the container shell and unfortunately, we have lost our top-secret file because we haven\u2019t implemented the docker volume feature yet.<\/p>\r\n<p>Let\u2019s start implementing it by creating a folder in the host-system called secret.<\/p>\r\n<blockquote>\r\n<pre>$ mkdir secret<\/pre>\r\n<\/blockquote>\r\n<p>Now, mount it in the docker container using the -v or &#8211;volume flag<\/p>\r\n<blockquote>\r\n<pre>$ docker run -it --rm -v $(pwd)\/secret:\/tmp alpine sh<\/pre>\r\n<\/blockquote>\r\n<p>Here the -v flag is used for volume mounting<\/p>\r\n<p>The left-hand side points to the host volume and the right-hand side points to the container volume.<\/p>\r\n<p>Let&#8217;s repeat the same commands for creating top-secret files under tmp directory and see if we managed to retain this file.<\/p>\r\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1064 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_mkdir_secret.png\" alt=\"\" width=\"661\" height=\"210\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_mkdir_secret.png 661w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_mkdir_secret-300x95.png 300w\" sizes=\"(max-width: 661px) 100vw, 661px\" \/><\/p>\r\n<p>Now go to the secret folder in the host machine and check whether the topsecret file exists even after the termination of our alpine container.<\/p>\r\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1062 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_cd_secret.png\" alt=\"\" width=\"546\" height=\"207\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_cd_secret.png 546w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_cd_secret-300x114.png 300w\" sizes=\"(max-width: 546px) 100vw, 546px\" \/><\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"i\"><\/span>\u00a0<span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<h2><span class=\"ez-toc-section\" id=\"Docker_port_forwarding\"><\/span><b>Docker port forwarding.<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>By default, docker Containers run in an isolated environment, but if you want to expose the services running inside a docker container, we can use a docker feature known as port-forwarding.<\/p>\r\n<p><strong>Pro tip:<\/strong> If you wish to use TCP bind shell, you would need to use the port forwarding feature to expose that port on the host otherwise it won&#8217;t be reachable from outside.<\/p>\r\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1073 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_port_forwarding.png\" alt=\"\" width=\"945\" height=\"756\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_port_forwarding.png 945w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_port_forwarding-300x240.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_port_forwarding-768x614.png 768w\" sizes=\"(max-width: 945px) 100vw, 945px\" \/><\/p>\r\n<p>&nbsp;<\/p>\r\n<p>Let\u2019s run a simple Nginx server and use the port-forwarding feature to expose Nginx&#8217;s port 80 on the host machine&#8217;s port 80.<\/p>\r\n<blockquote>\r\n<pre>$ docker run --name my-server -d -p 80:80 nginx<\/pre>\r\n<\/blockquote>\r\n<p>Here -p flag is used for port mapping, the left-hand side indicates the host machine port and the right-side indicates the container port<\/p>\r\n<blockquote>\r\n<p><span style=\"color: #e02b20;\"><strong>If you are our paid customer and taking any of our courses like CDE\/CDP\/CCSE\/CCNSE, please use the browser based lab portal to do all the exercises and do not use the below Virtual Machine.<\/strong>\u00a0<\/span><\/p>\r\n<p>&nbsp;<\/p>\r\n<\/blockquote>\r\n<p>Now, open a web browser and type localhost:80 in the address bar. You will be greeted with Nginx&#8217;s default page.<\/p>\r\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1078 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/image17.gif\" alt=\"\" width=\"1296\" height=\"674\" \/><\/p>\r\n<p>As you can see we have successfully exposed the docker\u2019s isolated Nginx&#8217;s port 80 onto the host port 80.<\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Docker_environment_variables\"><\/span><b>Docker environment variables<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>Another feature which is notorious for leaking secrets is docker environment variables. If you have access to docker container, you can read all of its environment variables by typing env command.<\/p>\r\n<p>Let&#8217;s see an example to bring this point home.<\/p>\r\n<blockquote>\r\n<pre>$ docker run -it --rm -e \\\r\n USERNAME=imran -e PASSWORD=imran alpine sh<\/pre>\r\n<\/blockquote>\r\n<p>-e option here exports variables inside the container.<\/p>\r\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1072 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_environment_export.png\" alt=\"\" width=\"1538\" height=\"452\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_environment_export.png 1538w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_environment_export-300x88.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_environment_export-768x226.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_environment_export-1024x301.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_environment_export-1080x317.png 1080w\" sizes=\"(max-width: 1538px) 100vw, 1538px\" \/><\/p>\r\n<p>As you can see, anyone with shell access can read sensitive information.<\/p>\r\n<p>Pro tip: Ensure containers are not passing secrets via environment variables.<\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Docker_inspect\"><\/span><b>Docker inspect<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>Imagine, you don&#8217;t have access to the docker image but you would still want to glean some interesting information then docker inspect command is for you.<\/p>\r\n<p>It shows the environment variables used, IP addresses, Network IDs, AppArmor settings, image names, the current state of the container, ports, volumes, etc.,<\/p>\r\n<blockquote>\r\n<pre>$ docker inspect &lt;container-name&gt;<\/pre>\r\n<\/blockquote>\r\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1076 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_inspect.png\" alt=\"\" width=\"683\" height=\"366\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_inspect.png 683w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_inspect-300x161.png 300w\" sizes=\"(max-width: 683px) 100vw, 683px\" \/><\/p>\r\n<p>The above command shows detailed configuration information about the container.<\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Docker_top\"><\/span><b>Docker top<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>Often, you will be interested in knowing the running processes inside a container. Docker provides the top command to glean this information.<\/p>\r\n<p>Let&#8217;s try to start an alpine container and ping google inside the container shell.<\/p>\r\n<blockquote>\r\n<pre>$ docker top &lt;container-id&gt;<\/pre>\r\n<\/blockquote>\r\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1070 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_top.png\" alt=\"\" width=\"1303\" height=\"129\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_top.png 1303w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_top-300x30.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_top-768x76.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_top-1024x101.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_top-1080x107.png 1080w\" sizes=\"(max-width: 1303px) 100vw, 1303px\" \/><\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Task\"><\/span><b>Task\u00a0<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>Stop and remove the running Nginx container and run the below command in the terminal.<\/p>\r\n<blockquote>\r\n<pre>$ docker run --name my-server -d -P nginx<\/pre>\r\n<\/blockquote>\r\n<p>-P flag selects a random available port on the host and maps it to the container port.<\/p>\r\n<p>Use the docker inspect on this container and find out on which port it is running.<\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Docker_stats\"><\/span><b>Docker stats<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p>Containers allow us to limit the resources they can utilize. The following command restricts the alpine container from using more than 100mb of RAM.<\/p>\r\n<blockquote>\r\n<pre>$ docker run --rm -it -m 100mb -d alpine sh<\/pre>\r\n<\/blockquote>\r\n<p>-m flag used to specify the amount of memory that can be allocated to the container.<\/p>\r\n<p>Once a container runs, you can see this information using docker stats.<\/p>\r\n<blockquote>\r\n<pre>$ docker stats container-id<\/pre>\r\n<\/blockquote>\r\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-1074 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_limit.png\" alt=\"\" width=\"1291\" height=\"116\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_limit.png 1291w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_limit-300x27.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_limit-768x69.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_limit-1024x92.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_limit-1080x97.png 1080w\" sizes=\"(max-width: 1291px) 100vw, 1291px\" \/><\/p>\r\n<p>As you can see that only 100mb of memory is allocated to the container.<\/p>\r\n<p>Pro Tip: You can verify if a particular container is suspectable for a Denial of service attack using this command.<\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Reference_and_Further_Reading\"><\/span><b>Reference and Further Reading<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p><a href=\"https:\/\/docs.docker.com\/storage\/storagedriver\/select-storage-driver\/\">https:\/\/docs.docker.com\/storage\/storagedriver\/select-storage-driver\/<\/a><\/p>\r\n<p><a href=\"https:\/\/docs.docker.com\/storage\/volumes\/\">https:\/\/docs.docker.com\/storage\/volumes\/<\/a><\/p>\r\n<h2><span class=\"ez-toc-section\" id=\"Conclusion\"><\/span><b>Conclusion<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\r\n<p><strong>In this lesson<\/strong>, we have learned about reconnaissance\/footprinting techniques, we first saw how to target the right container, how to analyze the containers and how to stop\/pause those containers.<\/p>\r\n<p>We also saw how to work with docker volumes and observed how they may contain some sensitive information, we then moved on to discussing port forwarding and exposed environmental variables.<\/p>\r\n<p>In the next lesson, we will see Docker&#8217;s attack surface and how we can perform vulnerability assessment on docker ecosystem.<\/p>\r\n","protected":false},"excerpt":{"rendered":"<p>PRACTICAL DEVSECOPS DOCKER CONTAINER&#8230;<\/p>\n","protected":false},"author":2,"featured_media":2029,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"off","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[16],"tags":[],"_links":{"self":[{"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/posts\/1043"}],"collection":[{"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/comments?post=1043"}],"version-history":[{"count":2,"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/posts\/1043\/revisions"}],"predecessor-version":[{"id":242814,"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/posts\/1043\/revisions\/242814"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/media\/2029"}],"wp:attachment":[{"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/media?parent=1043"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/categories?post=1043"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/tags?post=1043"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}