Wargame/CTF 문제에서 dockerfile이 주어졌을 때 도커 환경 구축

DreamHack의 Bypass SECCOMP-1 문제로 테스트

1. 도커 이미지 빌드

docker build <directory of dockerfile> 명령어로 도커 이미지를 빌드한다. 만약 dockerfile의 파일명이 Dockerfile이 아닌 경우, docker build <directory of dockerfile> -f <name of dockerfile> 명령어를 사용한다.

$ docker build .
[+] Building 1.7s (17/17) FINISHED
 => [internal] load build definition from Dockerfile                                               0.0s
 => => transferring dockerfile: 38B                                                                0.0s
 => [internal] load .dockerignore                                                                  0.0s
 => => transferring context: 2B                                                                    0.0s
 => [internal] load metadata for docker.io/library/ubuntu:18.04                                    1.5s
 => [ 1/12] FROM docker.io/library/ubuntu:18.04@sha256:d8ac28b7bec51664c6b71a9dd1d8f788127ff310b8  0.0s
 => [internal] load build context                                                                  0.0s
 => => transferring context: 59B                                                                   0.0s
 => CACHED [ 2/12] RUN apt-get update                                                              0.0s
 => CACHED [ 3/12] RUN apt-get -y install socat                                                    0.0s
 => CACHED [ 4/12] RUN adduser bypass_syscall                                                      0.0s
 => CACHED [ 5/12] ADD ./flag /home/bypass_syscall/flag                                            0.0s
 => CACHED [ 6/12] ADD ./bypass_syscall /home/bypass_syscall/bypass_syscall                        0.0s
 => CACHED [ 7/12] RUN chown -R root:root /home/bypass_syscall                                     0.0s
 => CACHED [ 8/12] RUN chown root:bypass_syscall /home/bypass_syscall/flag                         0.0s
 => CACHED [ 9/12] RUN chown root:bypass_syscall /home/bypass_syscall/bypass_syscall               0.0s
 => CACHED [10/12] RUN chmod 755 /home/bypass_syscall/bypass_syscall                               0.0s
 => CACHED [11/12] RUN chmod 440 /home/bypass_syscall/flag                                         0.0s
 => CACHED [12/12] WORKDIR /home/bypass_syscall                                                    0.0s
 => exporting to image                                                                             0.0s
 => => exporting layers                                                                            0.0s
 => => writing image sha256:7f023c3a4f545fe9e9850bb5e5ab48a92b28cf48af4db2566e89dc27bfc4ab14       0.0s

Use 'docker scan' to run Snyk tests against images to find vulnerabilities and learn how to fix them

$ docker image ls
REPOSITORY   TAG       IMAGE ID       CREATED       SIZE
<none>       <none>    7f023c3a4f54   3 hours ago   109MB

2. 도커 실행

도커를 실행하면 도커 컨테이너가 생성된다.

$ docker run 7f023c3a4f54 &
[1] 6018

$ docker container ls
CONTAINER ID   IMAGE          COMMAND                  CREATED         STATUS         PORTS      NAMES
e324d6905cd7   7f023c3a4f54   "/bin/sh -c 'socat -…"   6 seconds ago   Up 5 seconds   7182/tcp   nervous_meninsky

3. 도커 컨테이너에 bash 셸로 연결

$ docker exec -it e324d6905cd7 /bin/bash
bypass_syscall@e324d6905cd7:~$ id
uid=1000(bypass_syscall) gid=1000(bypass_syscall) groups=1000(bypass_syscall)

apt install 등을 사용하기 위해 루트 권한이 필요한 경우 -u 0 옵션을 줘서 root 로 로그인할 수 있다.

$ docker exec -u 0 -it e324d6905cd7 /bin/bash
root@e324d6905cd7:/home/bypass_syscall# id
uid=0(root) gid=0(root) groups=0(root)

exit 명령어로 도커 환경에서 빠져나올 수 있다.

bypass_syscall@e324d6905cd7:~$ exit
exit

4. 정리

도커를 다 사용했으면 생성된 도커 컨테이너와 이미지를 삭제한다.

$ docker container stop e324d6905cd7
e324d6905cd7
$ docker container rm e324d6905cd7
e324d6905cd7
[1]+  Exit 137                docker run 7f023c3a4f54
$ docker container ls
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES

$ docker image rm 7f023c3a4f54
Deleted: sha256:7f023c3a4f545fe9e9850bb5e5ab48a92b28cf48af4db2566e89dc27bfc4ab14
$ docker image ls
REPOSITORY   TAG       IMAGE ID   CREATED   SIZE