> For the complete documentation index, see [llms.txt](https://ctf.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ctf.zeyu2001.com/2021/umdctf-2021/donnie-docker.md).

# Donnie Docker

## Problem

I found this weird machine online, looks like they're using docker for security but I'm not sure their OPSEC is as good as they think!

`ssh user@chals2.umdctf.io -p 5000 password: umdctf`

## Solution

Reference: <https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout>

The docker socket is mounted inside the docker container. This allows us to run regular docker commands to communicate with the docker daemon, for instance mounting the host disk, and chroot-ing to it.

![](/files/-MYc6rW25rHnB-IS8TwY)

We find the flag.txt here:

![](/files/-MYc6uUcdDThe6sybxK0)

Obtaining our flag:

![](/files/-MYc6xhBtCi-HNRhlteS)