Edit

5000 - Pentesting Docker Registry

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Basic Information

A storage and distribution system known as a Docker registry is in place for Docker images that are named and may come in multiple versions, distinguished by tags. These images are organized within Docker repositories in the registry, each repository storing various versions of a specific image. The functionality provided allows for images to be downloaded locally or uploaded to the registry, assuming the user has the necessary permissions.

DockerHub serves as the default public registry for Docker, but users also have the option to operate an on-premise version of the open-source Docker registry/distribution or opt for the commercially supported Docker Trusted Registry. Additionally, various other public registries can be found online.

To download an image from an on-premise registry, the following command is used:

docker pull my-registry:9000/foo/bar:2.1

This command fetches the foo/bar image version 2.1 from the on-premise registry at the my-registry domain on port 9000. Conversely, to download the same image from DockerHub, particularly if 2.1 is the latest version, the command simplifies to:

docker pull foo/bar

Default port: 5000

PORT    STATE SERVICE  VERSION
5000/tcp open  http    Docker Registry (API: 2.0)

Discovering

The easiest way to discover this service running is get it on the output of nmap. Anyway, note that as it's a HTTP based service it can be behind HTTP proxies and nmap won't detect it. Some fingerprints:

  • If you access / nothing is returned in the response

  • If you access /v2/ then {} is returned

  • If you access /v2/_catalog you may obtain:

    • {"repositories":["alpine","ubuntu"]}

    • {"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"registry","Class":"","Name":"catalog","Action":"*"}]}]}

Enumeration

HTTP/HTTPS

Docker registry may be configured to use HTTP or HTTPS. So the first thing you may need to do is find which one is being configured:

Authentication

Docker registry may also be configured to require authentication:

If the Docker Registry is requiring authentication you can try to brute force it using this. If you find valid credentials you will need to use them to enumerate the registry, in curl you can use them like this:

Enumeration using DockerRegistryGrabber

DockerRegistryGrabber is a python tool to enumerate / dump docker degistry (without or with basic authentication)

Enumeration using curl

Once you obtained access to the docker registry here are some commands you can use to enumerate it:

Note that when you download and decompress the blobs files and folders will appear in the current directory. If you download all the blobs and decompress them in the same folder they will overwrite values from the previously decompressed blobs, so be careful. It may be interesting to decompress each blob inside a different folder to inspect the exact content of each blob.

Enumeration using docker

Backdooring WordPress image

In the scenario where you have found a Docker Registry saving a wordpress image you can backdoor it. Create the backdoor:

Create a Dockerfile:

Create the new image, check it's created, and push it:

Backdooring SSH server image

Suppose that you found a Docker Registry with a SSH image and you want to backdoor it. Download the image and run it:

Extract the sshd_config file from the SSH image:

And modify it to set: PermitRootLogin yes

Create a Dockerfile like the following one:

Create the new image, check it's created, and push it:

References

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks
Previous4840 - OPC Unified ArchitectureNext5353/UDP Multicast DNS (mDNS) and DNS-SD

Last updated