5000 - Pentesting Docker Registry

Basic Information

Info from here.

A Docker registry is a storage and distribution system for named Docker images. The same image might have multiple different versions, identified by their tags. A Docker registry is organized into Docker repositories , where a repository holds all the versions of a specific image. The registry allows Docker users to pull images locally, as well as push new images to the registry (given adequate access permissions when applicable).

By default, the Docker engine interacts with DockerHub , Docker’s public registry instance. However, it is possible to run on-premise the open-source Docker registry/distribution, as well as a commercially supported version called Docker Trusted Registry . There are other public registries available online.

To pull an image from an on-premises registry, you could run a command similar to:

docker pull my-registry:9000/foo/bar:2.1

where you pull the version of foo/bar image with tag 2.1 from our on-premise registry located at my-registry domain, port 9000 . If you used DockerHub instead, and 2.1 was also the latest version, you could run this command to pull the same image locally:

docker pull foo/bar

Default port: 5000

PORT    STATE SERVICE  VERSION
5000/tcp open  http    Docker Registry (API: 2.0)

Discovering

The easiest way to discover this service running is get it on the output of nmap. Anyway, note that as it's a HTTP based service it can be behind HTTP proxies and nmap won't detect it. Some fingerprints:

  • If you access / nothing is returned in the response

  • If you access /v2/ then {} is returned

  • If you access /v2/_catalog you may obtain:

    • {"repositories":["alpine","ubuntu"]}

    • {"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"registry","Class":"","Name":"catalog","Action":"*"}]}]}

Enumeration

HTTP/HTTPS

Docker registry may be configured to use HTTP or HTTPS. So the first thing you may need to do is find which one is being configured:

Authentication

Docker registry may also be configured to require authentication:

If the Docker Registry is requiring authentication you can try to brute force it using this. If you find valid credentials you will need to use them to enumerate the registry, in curl you can use them like this:

Enumeration using curl

Once you obtained access to the docker registry here are some commands you can use to enumerate it:

Note that when you download and decompress the blobs files and folders will appear in the current directory. If you download all the blobs and decompress them in the same folder they will overwrite values from the previously decompressed blobs, so be careful. It may be interesting to decompress each blob inside a different folder to inspect the exact content of each blob.

Enumeration using docker

Backdooring WordPress image

In the scenario where you have found a Docker Registry saving a wordpress image you can backdoor it. Create the backdoor:

Create a Dockerfile:

Create the new image, check it's created, and push it:

Backdooring SSH server image

Suppose that you found a Docker Registry with a SSH image and you want to backdoor it. Download the image and run it:

Extract the sshd_config file from the SSH image:

And modify it to set: PermitRootLogin yes

Create a Dockerfile like the following one:

Create the new image, check it's created, and push it:

Previous4369 - Pentesting Erlang Port Mapper Daemon (epmd)Next5353/UDP Multicast DNS (mDNS)

Last updated