
[1;90m                      ##[1;37m         .
[1;90m                ## ## ##[1;37m        ==
[1;90m             ## ## ## ##[1;37m       ===
[1;37m         /"""""""""""""""""\___/ ===
[1;34m    ~~~ [1;90m{[1;34m~~ ~~~~ ~~~ ~~~~ ~~~ ~[1;90m /  [1;37m===-[1;34m ~~~[0m
[1;90m         \______ X           __/
[1;90m           \    \         __/
[1;90m            \____\_______/[0m
          __
     ____/ /__  ___  ____  ________
    / __  / _ \/ _ \/ __ \/ ___/ _ \ [1;90m  ENUMERATE[0m
   / /_/ /  __/  __/ /_/ / (__/  __/ [1;90m ESCALATE[0m
   \__,_/\___/\___/ .___/\___/\___/[1;90m  ESCAPE[0m
                 /_/

 Docker Enumeration, Escalation of Privileges and Container Escapes (DEEPCE)
 by stealthcopter

[1;34m==========================================[1;32m( Colors )[1;34m==========================================[0m
[1;33m[+][1;32m Exploit Test ............ [0m[48;5;1mExploitable - Check this out[0m
[1;33m[+][1;32m Basic Test .............. [0m[1;33mPositive Result[0m
[1;33m[+][1;32m Another Test ............ [0m[1;31mError running check[0m
[1;33m[+][1;32m Negative Test ........... [0m[1;90mNo[0m
[1;33m[+][1;32m Multi line test ......... [0m[1;33mYes[0m
[1;90mCommand output
spanning multiple lines[0m

[1;90mTips will look like this and often contains links with additional info. You can usually 
ctrl+click links in modern terminal to open in a browser window
See [4mhttps://stealthcopter.github.io/deepce[0m[0m

[1;34m===================================[1;32m( Enumerating Platform )[1;34m===================================[0m
[1;33m[+][1;32m Inside Container ........ [0m[1;33mYes[0m
[1;33m[+][1;32m Container Platform ...... [0m[1;33mdocker[0m
[1;33m[+][1;32m Container tools ......... [0m[1;31mNone[0m
[1;33m[+][1;32m User .................... [0m[48;5;1mroot[0m
[1;33m[+][1;32m Groups .................. [0m[1;90m[1;37m[48;5;1mroot[0m[1;90m bin daemon sys adm disk [1;37m[48;5;1mwheel[0m[1;90m floppy dialout tape video[0m
[1;33m[+][1;32m Sudoers ................. [0m[1;90mNo[0m
[1;33m[+][1;32m Docker Executable ....... [0m[1;90mNot Found[0m
[1;33m[+][1;32m Docker Sock ............. [0m[1;90mNot Found[0m
[1;33m[+][1;32m Docker Version .......... [0m[1;31mVersion Unknown[0m
[1;34m==================================[1;32m( Enumerating Container )[1;34m===================================[0m
[1;33m[+][1;32m Container ID ............ [0m[1;33m706e2d7b0e33[0m
[1;33m[+][1;32m Container Full ID ....... [0m[1;33m/[0m
[1;33m[+][1;32m Container Name .......... [0m[1;31mCould not get container name through reverse DNS[0m
[1;33m[+][1;32m Container IP ............ [0m[1;33m172.17.0.2[0m
[1;33m[+][1;32m DNS Server(s) ........... [0m[1;33m168.63.129.16 [0m
[1;33m[+][1;32m Host IP ................. [0m[1;33m172.17.0.1[0m
[1;33m[+][1;32m Operating System ........ [0m[1;90mLinux[0m
[1;33m[+][1;32m Kernel .................. [0m[1;90m6.2.0-1018-azure[0m
[1;33m[+][1;32m Arch .................... [0m[1;90mx86_64[0m
[1;33m[+][1;32m CPU ..................... [0m[1;90mAMD EPYC 7763 64-Core Processor[0m
[1;33m[+][1;32m Useful tools installed .. [0m[1;33mYes[0m
[1;90m/usr/bin/wget
/usr/bin/nc
/usr/bin/nslookup
/bin/hostname[0m
[1;33m[+][1;32m Dangerous Capabilities .. [0m[1;31mcapsh not installed, listing raw capabilities[0m
[1;31mlibcap2-bin is required but not installed[0m
[1;31mapk add libcap2-bin[0m

[1;90mCurrent capabilities are:[0m
[1;90mCapInh:	0000000000000000
CapPrm:	000001ffffffffff
CapEff:	000001ffffffffff
CapBnd:	000001ffffffffff
CapAmb:	0000000000000000[0m
[1;90m> This can be decoded with: "capsh --decode=000001ffffffffff"[0m
[1;33m[+][1;32m SSHD Service ............ [0m[1;90mNo[0m
[1;33m[+][1;32m Privileged Mode ......... [0m[48;5;1mYes[0m
[1;90mThe container appears to be running in privilege mode, we should be able to access the 
raw disks and mount the hosts root partition in order to gain code execution.
See [4mhttps://stealthcopter.github.io/deepce/guides/docker-privileged.md[0m[0m

[1;33m[+][1;32m Alpine Linux Version .... [0m[1;33m3.19.0[0m
[1;33m[+][1;32m └── CVE-2019-5021 ....... [0m[1;90mNo[0m
[1;34m====================================[1;32m( Enumerating Mounts )[1;34m====================================[0m
[1;33m[+][1;32m Docker sock mounted ....... [0m[1;90mNo[0m
[1;33m[+][1;32m Other mounts .............. [0m[1;33mYes[0m
[1;90m/home/runner/work/deepce/deepce/deepce.sh /root/deepce.sh rw,relatime - ext4 /dev/root rw,discard,errors=remount-ro[0m
[1;33m[+][1;32m Possible host usernames ... [0m[1;33mrunner [0m
[1;34m====================================[1;32m( Interesting Files )[1;34m=====================================[0m
[1;33m[+][1;32m Interesting environment variables ... [0m[1;90mNo[0m
[1;90mHOME=/root
HOSTNAME=706e2d7b0e33
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PWD=/
SHLVL=1[0m
[1;33m[+][1;32m Any common entrypoint files ......... [0m[1;33mYes[0m
[1;90m-rwxr-xr-x    1 1001     127        38.5K Dec 28 14:30 /root/deepce.sh[0m
[1;33m[+][1;32m Interesting files in root ........... [0m[1;90mNo[0m
[1;33m[+][1;32m Passwords in common files ........... [0m[1;90mNo[0m
[1;33m[+][1;32m Home directories .................... [0m[1;90mNo[0m
[1;33m[+][1;32m Hashes in shadow file ............... [0m[1;90mNo[0m
[1;33m[+][1;32m Searching for app dirs .............. [0m
[1;34m==================================[1;32m( Enumerating Containers )[1;34m==================================[0m
[1;90mBy default containers can communicate with other containers on the same network and the 
host machine, this can be used to enumerate further[0m

[1;34m===============================================[1;32m[1;34m===============================================[0m