> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/exploit/docker.md).

# Docker

## Deepce

DEEPCE stands for Docker Enumeration, Escalation of Privileges and Container Escapes.

It is a container enumeration and exploit script designed for pen testers, hackers and developers. Think of it like linpeas/linenum for containers.

### Enumerations

The following is the list of enumerations performed by DEEPCE.

* Container ID & name (via reverse dns)
* Container IP / DNS Server
* Docker Version
* Interesting mounts
* Passwords in common files
* Environment variables
* Password hashes
* Common sensitive files stored in containers
* Other containers on same network
* Port scan other containers, and the host machine itself
* Find exposed docker sock

### Exploits

* Docker Group Privilege Escalation
* Privileged mode host command execution
* Exposed Docker Sock

### Payloads

For each of the exploits above payloads can be defined in order to exploit the host system. These include:

* Reverse TCP shell
* Print /etc/shadow
* Add new root user
* Run custom commands
* Run custom payload binaries

## Execution

```bash
# Make the script executable and then run it
chmod +x ./deepce.sh
./deepce.sh 
```

## Resources

deepce - GitHub: <https://github.com/stealthcopter/deepce>

Docker Breakout / Privilege Escalation: <https://desecurity.github.io/hacktricks/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/>