Linux Container Enumeration

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Post
  include Msf::Post::File

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Linux Container Enumeration',
        'Description' => %q{
          This module attempts to enumerate containers on the target machine and optionally run a command on each active container found.
          Currently it supports Docker, LXC and RKT.
        },
        'License' => MSF_LICENSE,
        'Author' => ['stealthcopter'],
        'Platform' => ['linux'],
        'SessionTypes' => ['shell', 'meterpreter'],
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'SideEffects' => [IOC_IN_LOGS],
          'Reliability' => []
        }
      )
    )
    register_options(
      [
        OptString.new('CMD', [false, 'Optional command to run on each running container', ''])
      ]
    )
  end

  def cmd
    datastore['CMD']
  end

  # Check if a container program is installed and usable by current user
  def runnable(container_type)
    case container_type
    when 'docker'
      command = 'docker >/dev/null 2>&1 && echo true'
    when 'lxc'
      command = 'lxc >/dev/null 2>&1 && echo true'
    when 'rkt'
      # Apparently rkt doesn't play nice with 2>&1 for most commands, though `rkt help`
      # seems to be fine so this is why its used here vs just 'rkt'
      command = 'rkt help >/dev/null 2>&1 && echo true'
    else
      print_error("Invalid container type #{container_type}")
      return false
    end
    cmd_exec(command) =~ /true$/
  end

  # Count the number of currently running containers
  def count_containers(container_type, count_inactive: true)
    case container_type
    when 'docker'
      command = if count_inactive
                  'docker container ls --format "{{.Names}}" | wc -l'
                else
                  'docker container ls -a --format "{{.Names}}" | wc -l'
                end
    when 'lxc'
      command = if count_inactive
                  'lxc list -c n --format csv | wc -l'
                else
                  'lxc list -c n,s --format csv | grep ,RUNNING | wc -l'
                end
    when 'rkt'
      command = if count_inactive
                  'rkt list | tail -n +2 | wc -l'
                else
                  'rkt list | tail -n +2 | grep running | wc -l'
                end
    else
      print_error("Invalid container type '#{container_type}'")
      return 0
    end

    result = cmd_exec(command)
    if result =~ /denied/
      print_error("Was unable to enumerate the number of #{container_type} containers due to a lack of permissions!")
      return 0
    else
      result.to_i
    end
  end

  # List containers
  def list_containers(container_type)
    case container_type
    when 'docker'
      result = cmd_exec('docker container ls -a')
    when 'lxc'
      # LXC does some awful table formatting, lets try and fix it to be more uniform
      result = cmd_exec('lxc list').each_line.reject { |st| st =~ /^\+--/ }.map.with_index.map do |s, i|
        if i == 0
          s.split('| ').map { |t| t.strip.ljust(t.size, ' ').gsub(/\|/, '') }.join + "\n"
        else
          s.gsub(/\| /, '').gsub(/\|/, '')
        end
      end.join.strip
    when 'rkt'
      result = cmd_exec('rkt list')
    else
      print_error("Invalid container type '#{container_type}'")
      return nil
    end
    result
  end

  # List running containers identifiers
  def list_running_containers_id(container_type)
    case container_type
    when 'docker'
      command = 'docker container ls --format "{{.Names}}"'
    when 'lxc'
      command = 'lxc list -c n,s --format csv 2>/dev/null | grep ,RUNNING|cut -d, -f1'
    when 'rkt'
      command = 'rkt list | tail -n +2 | cut -f1'
    else
      print_error("Invalid container type '#{container_type}'")
      return nil
    end
    cmd_exec(command).each_line.map(&:strip)
  end

  # Execute a command on a container
  def container_execute(container_type, container_identifier, command)
    case container_type
    when 'docker'
      command = "docker exec '#{container_identifier}' #{command}"
    when 'lxc'
      command = "lxc exec '#{container_identifier}' -- #{command}"
    when 'rkt'
      print_error("RKT containers do not support command execution\nUse the command \"rkt enter '#{container_identifier}'\" to manually enumerate this container")
      return nil
    else
      print_error("Invalid container type '#{container_type}'")
      return nil
    end
    vprint_status("Running #{command}")
    cmd_exec(command)
  end

  # Run Method for when run command is issued
  def run
    platforms = %w[docker lxc rkt].select { |p| runnable(p) }

    if platforms.empty?
      print_error('No container software appears to be installed or runnable by the current user')
      return
    end

    platforms.each do |platform|
      print_good("#{platform} was found on the system!")
      num_containers = count_containers(platform, count_inactive: false)

      if num_containers == 0
        print_error("No active or inactive containers were found for #{platform}\n")
      else
        num_running_containers = count_containers(platform, count_inactive: true)
        print_good("#{platform}: #{num_running_containers} Running Containers / #{num_containers} Total")
      end

      next unless num_containers > 0

      containers = list_containers(platform)
      next if containers.nil?

      # Using print so not to mess up table formatting
      print_line(containers.to_s)

      p = store_loot("host.#{platform}_containers", 'text/plain', session, containers, "#{platform}_containers.txt", "#{platform} Containers")
      print_good("Results stored in: #{p}\n")

      next if cmd.blank?

      running_container_ids = list_running_containers_id(platform)
      next if running_container_ids.nil?

      running_container_ids.each do |container_id|
        print_status("Executing command on #{platform} container #{container_id}")
        command_result = container_execute(platform, container_id, cmd)
        next if command_result.nil?

        print_good(command_result)
        p = store_loot("host.#{platform}_command_results", 'text/plain', session, command_result, "#{platform}_containers_command_results.txt", "#{platform} Containers Command Results")
        print_good("Command execution results stored in: #{p}\n")
      end
    end
  end
end