Análise Forense de Contêineres Docker

Quando Usar

• Ao investigar um contêiner Docker comprometido ou o host do contêiner
• Para analisar imagens Docker maliciosas baixadas de registros
• Durante a resposta a incidentes envolvendo violações de aplicações conteinerizadas
• Ao examinar tentativas de "escape" de contêineres ou escalonamento de privilégios
• Para auditar configurações de contêineres e identificar configurações incorretas

Pré-requisitos

• Acesso à CLI do Docker na estação de trabalho forense
• Acesso ao sistema de arquivos do host Docker (imagem forense ou ao vivo)
• Compreensão do sistema de arquivos em camadas do Docker (overlay2, aufs)
• dive, docker-explorer ou container-diff para análise de imagens
• Conhecimento da configuração do daemon Docker e segurança do socket
• Trivy ou Grype para varredura de vulnerabilidades de imagens de contêineres

Fluxo de Trabalho

Passo 1: Preservar o Estado do Contêiner e Evidências

# List all containers (including stopped)
docker ps -a --no-trunc > /cases/case-2024-001/docker/container_list.txt

# Inspect the compromised container
CONTAINER_ID="abc123def456"
docker inspect $CONTAINER_ID > /cases/case-2024-001/docker/container_inspect.json

# Export container filesystem as tarball (preserves current state)
docker export $CONTAINER_ID > /cases/case-2024-001/docker/container_export.tar

# Create an image from the container's current state
docker commit $CONTAINER_ID forensic-evidence:case-2024-001
docker save forensic-evidence:case-2024-001 > /cases/case-2024-001/docker/container_image.tar

# Capture container logs
docker logs $CONTAINER_ID --timestamps > /cases/case-2024-001/docker/container_logs.txt 2>&1

# Capture running processes (if container is still running)
docker top $CONTAINER_ID > /cases/case-2024-001/docker/container_processes.txt

# Capture network connections
docker exec $CONTAINER_ID netstat -tlnp 2>/dev/null > /cases/case-2024-001/docker/container_network.txt

# Copy specific files from the container
docker cp $CONTAINER_ID:/var/log/ /cases/case-2024-001/docker/container_var_log/
docker cp $CONTAINER_ID:/tmp/ /cases/case-2024-001/docker/container_tmp/
docker cp $CONTAINER_ID:/etc/passwd /cases/case-2024-001/docker/container_passwd

# Hash all exported evidence
sha256sum /cases/case-2024-001/docker/*.tar > /cases/case-2024-001/docker/evidence_hashes.txt

Passo 2: Analisar Camadas da Imagem do Contêiner

# Install dive for image layer analysis
wget https://github.com/wagoodman/dive/releases/latest/download/dive_linux_amd64.deb
sudo dpkg -i dive_linux_amd64.deb

# Analyze image layers interactively
dive forensic-evidence:case-2024-001

# Non-interactive layer analysis
dive forensic-evidence:case-2024-001 --ci --json /cases/case-2024-001/docker/dive_analysis.json

# Extract and examine individual layers
mkdir -p /cases/case-2024-001/docker/layers/
tar -xf /cases/case-2024-001/docker/container_image.tar -C /cases/case-2024-001/docker/layers/

# List the image manifest and layer order
cat /cases/case-2024-001/docker/layers/manifest.json | python3 -m json.tool

# Examine each layer for changes
for layer in /cases/case-2024-001/docker/layers/*/layer.tar; do
    echo "=== Layer: $(dirname $layer | xargs basename) ==="
    tar -tf "$layer" | head -20
    echo "..."
done

# Use container-diff to compare with original base image
# Install container-diff
curl -LO https://storage.googleapis.com/container-diff/latest/container-diff-linux-amd64
chmod +x container-diff-linux-amd64

# Compare committed image with original
./container-diff-linux-amd64 diff daemon://nginx:latest daemon://forensic-evidence:case-2024-001 \
   --type=file --type=apt --type=history --json \
   > /cases/case-2024-001/docker/container_diff.json

Passo 3: Examinar Artefatos do Host Docker

# Diretório de dados do Docker (padrão: /var/lib/docker/)
DOCKER_ROOT="/mnt/evidence/var/lib/docker"

# Examinar camadas do sistema de arquivos overlay2
ls -la $DOCKER_ROOT/overlay2/

# Encontrar o sistema de arquivos mesclado do contêiner
CONTAINER_HASH=$(docker inspect $CONTAINER_ID --format '{{.GraphDriver.Data.MergedDir}}' 2>/dev/null)
# Ou manualmente a partir da imagem forense:
# Procurar em /var/lib/docker/containers/<container_id>/config.v2.json

# Analisar arquivos de configuração do contêiner
cat $DOCKER_ROOT/containers/$CONTAINER_ID/config.v2.json | python3 -m json.tool \
   > /cases/case-2024-001/docker/container_config.json

# Verificar a configuração do daemon Docker
cat /mnt/evidence/etc/docker/daemon.json 2>/dev/null > /cases/case-2024-001/docker/daemon_config.json

# Examinar o log de eventos do Docker

…