Abusing exposed Docker socket

In the case of the Kiss-a-Dog campaign, this was the initial access vector. The gap between the exposed socket and the initial payload download is not described, but my guess it is the deployment of malicious container that runs the script upon start.

Exposed docker socket is an extremely bad practice because of the lack of authentication on the socket. As such, any bad actor can accessing the socket can perform the following actions:

• List running containers
• Create a container
• Execute code within the created container
• Escape to the host from the created container

As such, exposed Docker socket is one trivial hop away from host RCE.