# Docker Escape / Breakout

## Tools

Escape a container with /proc/sys/kernel/core\_pattern

{% embed url="<https://gist.github.com/magisterquis/0bb2c256d870f198a43f015d7a70869f>" %}

Docker scan:

{% embed url="<https://github.com/cr0hn/dockerscan>" %}

Docker breakout :

* Mounted Docker UNIX socket.
* Reachable Docker network socket (on both default port 2375/2376).
* Mountable devices (e.g. host / disk)
* CVE-2019-5736

{% embed url="<https://github.com/PercussiveElbow/docker-escape-tool>" %}

Docker Enumeration, Escalation of Privileges and Container Escapes (DEEPCE)

{% embed url="<https://github.com/stealthcopter/deepce>" %}

Ed is a tool used to identify and exploit accessible UNIX Domain Sockets

{% embed url="<https://github.com/brompwnie/ed>" %}

CDK is an open-sourced container penetration toolkit, designed for offering stable exploitation in different slimmed containers without any OS dependency. It comes with useful net-tools and many powerful PoCs/EXPs and helps you to escape container and take over K8s cluster easily.

{% embed url="<https://github.com/cdk-team/CDK>" %}

Break out the Box (BOtB)

{% embed url="<https://github.com/brompwnie/botb>" %}

## Security Cheat Sheet

{% embed url="<https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html>" %}

## Resources

{% embed url="<https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation>" %}

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Container%20-%20Docker%20Pentest.md>" %}
