Docker Exploitation

After learning how to exploit and defend Active Directory, let's continue our journey. This chapter will walk you through the different aspects of Docker containers. In this chapter, we will cover the basics from installing and configuring Docker to exploiting it. You will also get a glimpse of the power of Docker containers by learning how to build a complete penetration testing laboratory.

The following topics will be covered in this chapter:

• Docker threats
• Docker breakout
• Build a Docker penetration testing lab

Docker fundamentals

Docker has spread like wildfire across modern organizations, thanks to its capabilities and promising services. It is an open source project with an Apache 2.0 license that allows developers to package up their applications, without caring about dependencies issues, that has made a huge impact in modern application development. Since its development in March 2013, it has allowed developers to focus on their products instead of wasting time on fixing library problems. Thus, the three main principles of Docker are: develop, ship, and run. These three terms explain the main concept of Docker. Developers just need to develop their applications, and Docker will take care of the rest, in other words. It allows them to ship the applications and deploy them in any system. For more information about container management services, have a look at the project official...

Docker exploitation

You learned how to install and configure Docker containers. As a penetration tester, you need to be aware of the potential security issues and the potential threats against Docker systems. According to ClusterHQ in 2015, more than 60% of enterprises are concerned about containers' security more than any other issue in the Docker production environment. There are many security concerns that face Docker containers. In order to do that, penetration testers should consider the following common container security challenges and vectors:

• Kernel exploits
• Denial-of-service (DoS)
• Container breakout
• Poisoned images
• Data theft

Kernel exploits

Docker containers are running on servers, but remember that there...

Docker bench security

Docker delivers an important script named Docker bench security. It is really useful to collect and reporting information, warnings, and pass messages using a simple output. You can clone the bench from its official GitHub repository https://github.com/docker/docker-bench-security:

sudo git clone https://github.com/docker/docker-bench-security

Run the script, and it will check Docker, thanks to predefined best practices. Basically, it is based on the CIS Docker Community Edition Benchmark v1.1.0:

./docker-bench-security.sh

Docker vulnerability static analysis with Clair

Clair is an open source project for the static analysis of vulnerabilities in Docker containers. It allows penetration testers to identify vulnerabilities in containers. You can find its official repository at https://github.com/coreos/clair.

The Clair project is composed of the following seven components, illustrated in the diagram:

• Content detectors
• Datastore
• Vulnerability updaters
• RESTful API
• Notifiers
• Clients
• Vulnerabilities databases

To build a Dockernized environment, visit the official QUAY website https://quay.io/:

Complete your profile with the required information:

Create a new repository and choose its visibility:

Select a link to your repository, for example, I used a Dockerfile:

Wait until the building operation is finished:

If you click on the build, you will see the content of the Dockerfile:

Wait for couple...

Building a penetration testing laboratory

In the previous sections, we discovered the power of Docker containers and learned how to defend against Docker exploitation techniques. Let's move on to another aspect of Docker containers. In this section, you will learn how to build a penetration testing laboratory based on a Dockernized environment.

We started our learning process using Kali Linux distribution, so we will use the same distribution as a demonstration.

First, let's clone a Kali Linux container file from GitHub, using the git clone command:

git clone https://github.com/offensive-security/kali-linux-docker.git

Open the Dockerfile and add any additional configuration:

For example, I added metasploit-framework:

Now, let's build the image using the build command:

sudo docker build -t kali ~/kali-linux-docker

After completing the pull operation, the files...

Summary

This chapter was a hands-on experience of learning how to install and configure Docker. You learned the capabilities of the Docker environment and how to secure it. You also discovered the power of Docker by building a penetration testing laboratory. In the next chapter, we will have a clear understanding of how to secure continuous integration (CI) servers.