96 lines
4.7 KiB
Bash
96 lines
4.7 KiB
Bash
##############################################
|
|
#---------------) Containers (---------------#
|
|
##############################################
|
|
containerCheck
|
|
|
|
print_2title "Container related tools present"
|
|
command -v "$CONTAINER_CMDS"
|
|
|
|
print_2title "Container details"
|
|
print_list "Is this a container? ...........$NC $containerType"
|
|
|
|
print_list "Any running containers? ........ "$NC
|
|
# Get counts of running containers for each platform
|
|
dockercontainers=$(docker ps --format "{{.Names}}" 2>/dev/null | wc -l)
|
|
podmancontainers=$(podman ps --format "{{.Names}}" 2>/dev/null | wc -l)
|
|
lxccontainers=$(lxc list -c n --format csv 2>/dev/null | wc -l)
|
|
rktcontainers=$(rkt list 2>/dev/null | tail -n +2 | wc -l)
|
|
if [ "$dockercontainers" -eq "0" ] && [ "$lxccontainers" -eq "0" ] && [ "$rktcontainers" -eq "0" ] && [ "$podmancontainers" -eq "0" ]; then
|
|
echo_no
|
|
else
|
|
containerCounts=""
|
|
if [ "$dockercontainers" -ne "0" ]; then containerCounts="${containerCounts}docker($dockercontainers) "; fi
|
|
if [ "$podmancontainers" -ne "0" ]; then containerCounts="${containerCounts}podman($podmancontainers) "; fi
|
|
if [ "$lxccontainers" -ne "0" ]; then containerCounts="${containerCounts}lxc($lxccontainers) "; fi
|
|
if [ "$rktcontainers" -ne "0" ]; then containerCounts="${containerCounts}rkt($rktcontainers) "; fi
|
|
echo "Yes $containerCounts" | sed -${E} "s,.*,${SED_RED},"
|
|
|
|
# List any running containers
|
|
if [ "$dockercontainers" -ne "0" ]; then echo "Running Docker Containers" | sed -${E} "s,.*,${SED_RED},"; docker ps | tail -n +2 2>/dev/null; echo ""; fi
|
|
if [ "$podmancontainers" -ne "0" ]; then echo "Running Podman Containers" | sed -${E} "s,.*,${SED_RED},"; podman ps | tail -n +2 2>/dev/null; echo ""; fi
|
|
if [ "$lxccontainers" -ne "0" ]; then echo "Running LXC Containers" | sed -${E} "s,.*,${SED_RED},"; lxc list 2>/dev/null; echo ""; fi
|
|
if [ "$rktcontainers" -ne "0" ]; then echo "Running RKT Containers" | sed -${E} "s,.*,${SED_RED},"; rkt list 2>/dev/null; echo ""; fi
|
|
fi
|
|
|
|
#If docker
|
|
if echo "$containerType" | grep -qi "docker"; then
|
|
print_2title "Docker Container details"
|
|
inDockerGroup
|
|
print_list "Am I inside Docker group .......$NC $DOCKER_GROUP\n" | sed -${E} "s,Yes,${SED_RED_YELLOW},"
|
|
print_list "Looking and enumerating Docker Sockets\n"$NC
|
|
enumerateDockerSockets
|
|
print_list "Docker version .................$NC$dockerVersion"
|
|
checkDockerVersionExploits
|
|
print_list "Vulnerable to CVE-2019-5736 ....$NC$VULN_CVE_2019_5736"$NC | sed -${E} "s,Yes,${SED_RED_YELLOW},"
|
|
print_list "Vulnerable to CVE-2019-13139 ...$NC$VULN_CVE_2019_13139"$NC | sed -${E} "s,Yes,${SED_RED_YELLOW},"
|
|
if [ "$inContainer" ]; then
|
|
checkDockerRootless
|
|
print_list "Rootless Docker? ................ $DOCKER_ROOTLESS\n"$NC | sed -${E} "s,No,${SED_RED}," | sed -${E} "s,Yes,${SED_GREEN},"
|
|
fi
|
|
if df -h | grep docker; then
|
|
print_2title "Docker Overlays"
|
|
df -h | grep docker
|
|
fi
|
|
fi
|
|
|
|
if [ "$inContainer" ]; then
|
|
echo ""
|
|
print_2title "Container & breakout enumeration"
|
|
print_info "https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout"
|
|
print_list "Container ID ...................$NC $(cat /etc/hostname)"
|
|
if echo "$containerType" | grep -qi "docker"; then
|
|
print_list "Container Full ID ..............$NC $(basename $(cat /proc/1/cpuset))\n"
|
|
fi
|
|
if echo "$containerType" | grep -qi "kubernetes"; then
|
|
print_list "Kubernetes namespace ...........$NC $(cat /run/secrets/kubernetes.io/serviceaccount/namespace /secrets/kubernetes.io/serviceaccount/namespace 2>/dev/null)\n"
|
|
print_list "Kubernetes token ...............$NC $(cat /run/secrets/kubernetes.io/serviceaccount/token /secrets/kubernetes.io/serviceaccount/token 2>/dev/null)\n"
|
|
fi
|
|
|
|
checkContainerExploits
|
|
print_list "Vulnerable to CVE-2019-5021 .. $VULN_CVE_2019_5021\n"$NC | sed -${E} "s,Yes,${SED_RED_YELLOW},"
|
|
echo ""
|
|
|
|
print_2title "Container Capabilities"
|
|
capsh --print 2>/dev/null | sed -${E} "s,$containercapsB,${SED_RED},g"
|
|
echo ""
|
|
|
|
print_2title "Privilege Mode"
|
|
if [ -x "$(command -v fdisk)" ]; then
|
|
if [ "$(fdisk -l 2>/dev/null | wc -l)" -gt 0 ]; then
|
|
echo "Privilege Mode is enabled"| sed -${E} "s,enabled,${SED_RED_YELLOW},"
|
|
else
|
|
echo "Privilege Mode is disabled"| sed -${E} "s,disabled,${SED_GREEN},"
|
|
fi
|
|
else
|
|
echo_not_found
|
|
fi
|
|
echo ""
|
|
|
|
print_2title "Interesting Files Mounted"
|
|
(mount -l || cat /proc/self/mountinfo || cat /proc/1/mountinfo || cat /proc/mounts || cat /proc/self/mounts || cat /proc/1/mounts )2>/dev/null | grep -Ev "$GREP_IGNORE_MOUNTS"
|
|
echo ""
|
|
|
|
print_2title "Possible Entrypoints"
|
|
ls -lah /*.sh /*entrypoint* /**/entrypoint* /**/*.sh /deploy* 2>/dev/null | sort | uniq
|
|
echo ""
|
|
fi |