"Carton" is fine. I generally use carton for milk in a small cardboard package, like a tetrapak, for example. However, we can also use carton for large and small plastic bottles that have a handle on them too. In the UK milk comes in 1, 2, 4 and 6 litre cartons.
"Box" must be an American version - we never use "box" in England for milk - but as Khun Peter points out, he does so a "milk box" is equally correct.
Like is often the case, as Thais, take your pick. Whichever works for you. I would say though that the plastic bottle, 500ml and 1l Meiji and Dutch Mill brands you can buy in a 7-11, that looks like a bottle, is a bottle, not a carton.
All the little differences are very interesting though.
Tetrapak is a company famous for a particular type of packaging it designed. I once taught English to the Thai wife of the American CEO of Tetrapak Asia - before that, I didn't know about Tetrapak either!