https://baozongwi.xyz/tags/docker-remote-api/Currently exploring Java security and internal network penetration, with CTFs as a hobby.Hugozh-cnhttps://baozongwi.xyz/p/docker-remote-api-unauthorized-access-exploit/Mon, 22 Sep 2025 20:20:51 +0800https://baozongwi.xyz/p/docker-remote-api-unauthorized-access-exploit/概念 一位大佬使用docker swarm管理docker集群的时候，发现了管理的docker 节点上会开放一个TCP端口2375，绑定在0.0.0.0上，http访问会返回 404 page not found，然后他研究了下，发现这是 Docker Remote API，可以执行docker命令，比如访问 …