portainer-tactics

Portainer exploitation skill

• Product: Portainer (Docker/Kubernetes container management platform)
• Default ports: 9000 (HTTP), 9443 (HTTPS) | Identification: /api/status returns JSON | FOFA: app="Portainer"

Vulnerability overview

Vulnerability ID	Affected versions	Vulnerability type	Exploitation conditions	Impact
Default/weak credentials	All versions	Authentication bypass	Weak credentials	Critical
CVE-2024-29296	CE 2.19.4	User enumeration (timing)	No authentication required	Medium
CVE-2018-12678	<=1.17	Request Splitting SSRF→RCE	No authentication required	Critical
Docker API abuse	All versions	Privileged container escape RCE	Authentication required	Critical

Exploitation decision tree

1. 识别: GET /api/status → 确认Portainer
2. 认证突破:
   ├── 尝试默认凭据 admin/已知密码
   ├── CVE-2024-29296: 用户枚举确定有效用户名
   └── 暴力破解密码
3. 认证后: JWT Token → 枚举端点 → 特权容器 → 挂载宿主机 → RCE
4. 未认证(老版本): CVE-2018-12678 → Request Splitting → Docker API → RCE

Exploitation chain priority

1. 默认/弱口令 → JWT Token → Docker API → 特权容器 → RCE
2. CVE-2024-29296 用户枚举 → 定向暴力破解 → 同上
3. CVE-2018-12678 (仅<=1.17) → SSRF → Docker API → RCE

Common API endpoints

Endpoint	Purpose
GET /api/status	System status/version
POST /api/auth	Login authentication
GET /api/endpoints	Docker endpoint list
POST /api/endpoints/{id}/docker/containers/create	Create container
POST /api/endpoints/{id}/docker/containers/{cid}/start	Start container
POST /api/endpoints/{id}/docker/containers/{cid}/wait	Wait for container

Privileged container escape methodology

Technique: Create a privileged container via the Portainer Docker API, mount the host filesystem, and achieve container escape RCE.

• Exploit the Docker API /containers/create endpoint to create a privileged mode container
• Mount the host root directory / into the container in read-write mode
• Via chroot to switch to the host filesystem, commands act directly on the host
• Requires an authenticated JWT Token and an available Docker endpoint

Detailed reference

• Post-authentication RCE API quick reference