Scan: Scan a network trying to locate Docker Registries.
Registry
Delete: Delete remote image / tag
Info: Show info from remote registry
Push: Push an image (like Docker client)
Upload: Upload a random file
Image
Analyze: Looking for sensitive information in a Docker image.
Looking for passwords in environment vars.
Try to find any URL / IP in the environment vars.
Try to deduce the user used internally to run the software. This is not trivial. If the entry point is a .sh file. Read the file and try to find call to sudo-like: “sudo”, “gosu”, “sh -u”… And report the user found.
Extract: extract a docker image
Info: Get a image meta information
Modify:
entrypoint: change the entrypoint in a docker
trojanize: inject a reverser shell into a docker image
is a penetration testing tool for discovering and remotely
accessing Docker APIs from vulnerable Docker containers. Once it has
access to the docker daemon, you can use Gorsair to directly execute
commands on remote containers.
Gorsair hacks its way into remote docker containers that expose their APIs.
Exposing the docker API on the internet is a tremendous risk, as it
can let malicious agents get information on all of the other containers,
images and system, as well as potentially getting privileged access to
the whole system if the image uses the root user.
Install
From a release
Set the:
GORSAIR_VERSION to whatever release you are interested in
OS to your operating system (linux, windows or darwin)
ARCH to your architecture (amd64, arm, or ppc64le)
And then run the following command to install gorsair. curl https://github.com/Ullaakut/Gorsair/releases/download/$GORSAIR_VERSION/gorsair_$OS_$ARCH --output /usr/local/bin/gorsair
From the sources
Make sure that you have a go version that supports modules (versions 1.11 and above)
Make sure that your environment contains the GO111MODULE variable set to on
Run go build -o /usr/local/bin/gorsair cmd/*.go from the root of this repository
Command line options
-t, --targets: Set targets according to the nmap target format. Required. Example: --targets="192.168.1.72,192.168.1.74"
-p, --ports: (Default: 2375,2376) Set custom ports.
-s, --speed: (Default: 4)
Set custom nmap discovery presets to improve speed or accuracy. It's
recommended to lower it if you are attempting to scan an unstable and
slow network, or to increase it if on a very performant and reliable
network. You might also want to keep it low to keep your discovery
stealthy. See this for more info on the nmap timing templates.
