Use this as a quick reference while enumerating containers.
Detect Container
cat /.dockerenv 2>/dev/null
grep -iE "docker|containerd|kubepods|lxc" /proc/1/cgroup
systemd-detect-virt
hostnamectl
Identity
id
whoami
groups
cat /proc/self/uid_map
cat /proc/self/gid_map
Capabilities
capsh --print
cat /proc/self/status | grep -E "Cap(Inh|Prm|Eff|Bnd|Amb)"
High-value:
CAP_SYS_ADMIN
CAP_SYS_PTRACE
CAP_DAC_READ_SEARCH
CAP_DAC_OVERRIDE
CAP_SYS_MODULE
CAP_SYS_CHROOT
CAP_NET_ADMIN
CAP_MKNOD
Mounts
mount
findmnt
cat /proc/self/mountinfo
findmnt -o TARGET,SOURCE,FSTYPE,OPTIONS
find / -maxdepth 3 -type d -name "*host*" 2>/dev/null
find / -maxdepth 3 -type d -name "*mnt*" 2>/dev/null
find / -maxdepth 3 -type d -name "*data*" 2>/dev/null
find / -maxdepth 4 -type d -name "*backup*" 2>/dev/null
Interesting:
/var/run/docker.sock
/run/containerd/containerd.sock
/var/lib/docker
/host
/hostfs
/mnt
/var/run/secrets
/proc
/sys
/dev
Runtime Sockets
ls -la /var/run/docker.sock
ls -la /run/docker.sock
ls -la /run/containerd/containerd.sock
ls -la /var/run/crio/crio.sock
Docker socket with curl:
curl --unix-socket /var/run/docker.sock http://localhost/version
curl --unix-socket /var/run/docker.sock http://localhost/containers/json
Namespaces
readlink /proc/self/ns/*
readlink /proc/1/ns/*
lsns
ps aux
Network
ip addr
ip route
cat /etc/resolv.conf
cat /etc/hosts
Docker bridge gateway often appears as:
172.17.0.1
Secrets
env
find / -maxdepth 4 -type f \( -iname "*secret*" -o -iname "*token*" -o -iname "*key*" -o -iname "*.env" \) 2>/dev/null
grep -R "password" / 2>/dev/null
grep -R "mysql" / -n 2>/dev/null
grep -R "ssh" / -n 2>/dev/null
ls -la /var/run/secrets/kubernetes.io/serviceaccount 2>/dev/null
Tools
deepce
CDK
amicontained
linpeas
docker
curl
crictl
ctr
kubectl