> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/privesc/docker-escape.md). # Docker 逃逸 Docker 逃逸权限提升笔记，涵盖默认 Docker Toolbox 凭据、SUID 操作、密码复用以及 SSH 密钥转移。 Docker 逃逸途径会滥用容器配置错误、挂载的主机资源、默认凭据、重复使用的密码或过高的容器权限。目标是从容器上下文转移到主机级访问。 ## 方法 * 确定 shell 是否位于容器内，并检查挂载、capabilities 和暴露的套接字。 * 检查是否挂载了主机路径、SSH 密钥、重复使用的凭据以及可写的 SUID 二进制文件。 * 使用最小侵入性的逃逸路径来证明可访问主机。 ## 快速检查 ```bash id cat /proc/1/cgroup mount ls -la /var/run/docker.sock 2>/dev/null ```

:docker:

Docker 密码重用

Docker 逃逸（密码重用）在 Linux 权限提升中的笔记，包含枚举步骤、利用示例以及面向报告的验证。Docker 密码复用 - Linux 权限提升

:docker:

Docker SUID 权限操纵

Docker 逃逸（SUID 权限操纵）在 Linux 权限提升中的笔记，包含枚举步骤、利用示例以及面向报告的验证。Docker SUID 权限操作 - Linux 权限提升

:docker:

通过 SSH 密钥进行 Docker 逃逸

Docker 逃逸（SSH 密钥）在 Linux 权限提升中的笔记，包含枚举步骤、利用示例以及面向报告的验证。Docker 逃逸（SSH 密钥）- Linux 权限提升

:docker:

Docker Toolbox 默认凭据

Docker 逃逸（Docker Toolbox 默认凭据）在 Linux 权限提升中的笔记，包含枚举步骤、利用示例以及面向报告的验证。Docker 逃逸（Docker Toolbox 默认凭据）- Linux 权限提升
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/privesc/docker-escape.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.