Containers Attack and Defense
summary
Claim: break out of a privileged container with a 140 character cgroup release_agent sequence that maps container paths to host paths and triggers a host-side script. Demonstrations show remote SSH from container after exploiting docker.sock, extraction of deleted files from image layers with Scavenger, and automated lateral movement and persistence using the docker exploitation toolkit and Shiva. Uploaded demos succeed, and scans find ~140,000 privileged containers on GitHub and ~30,000 images mounting the docker socket.
AI-written summary · about
chapters (11)
- 0:00Start
- 0:54The Docker Exploitation Toolkit
- 5:39Enable that Release Agent
- 6:46Who Runs Container in Privilege Mode
- 7:46Docker Socket
- 11:33Docker Registry
- 18:03Terminologies Specific to Kubernetes
- 27:26Root Privilege Container
- 28:26Lateral Movement Example
- 29:44Privileged Container
- 32:49Defense Techniques
related talks
45mThe Container Escape Room: An Exploration of Container Escapes
47mSecuring Containers By Breaking In
43mA Compendium of Container Escapes
57mWhat vulnerabilities? Live hacking of containers and orchestrators
23mPensieve: Finding Malicious Artifacts in Container Environments
50mInsights in Container Security
44mContainers Everywhere: Advanced Threat Actors Heavily Leverage Them
37mSecuring Containers by Breaking In