Package: container-arsenal
Container Arsenalcontainer-arsenal(car) is a collection ofdocker containersthat have been proven to be useful during
security assessments andCTFs. Each container is represented by adocker-composefile and its corresponding
resources. Additionally,container-arsenalships apythonscript that can be used to manage the containers.https://user-images.githubusercontent.com/49147108/163109100-3da4697b-05e2-43a5-a7f0-c0005e64c326.mp4Installationcontainer-arsenalcan be build and installed usingpip. The following command installscontainer-arsenalfor your current user profile:[qtc@devbox ~]$pip3install--usercontainer-arsenalYou can also buildcontainer-arsenalfrom source by running the following commands:[qtc@devbox ~]$gitclonehttps://github.com/qtc-de/container-arsenal[qtc@devbox ~]$cdcontainer-arsenal[qtc@devbox ~]$python3setup.pysdist[qtc@devbox ~]$pip3installdist/*container-arsenalships anautocompletion scriptfor bash. With thecompletion-helpersproject installed, the completion script is
setup automatically during the installation ofcontainer-arsenal. You can also install thecompletion-helpersproject later on and copy thecompletion scriptto your~/.bash_completion.dfolder manually.Available ContainersThe following list provides an overview on the currently available containers. Notice that each container folder contains a
dedicatedREADME.mdwhere you can find more specific information about the corresponding container. Just click on the
links listed below to get more details:File Transfer Containersftp-vsftpdserver configured for authenticated and anonymous accesstftp- A simpletftpserver forUDPbased file exchangenginx-nginxserver withWebDAVenabled. SupportsHTTPandHTTPSsamba-Sambashare configured for authenticated and anonymous accessssh-SSHserver that allowsremote port-forwardingandscpProxy Containersajp-AJPproxy server to accessJSERVports viaHTTPh2b- Ahttp-to-binaryproxy that allows accessingnon-HTTPservices usingHTTPfocused toolsUtils Containersmysql- PlainMySQLserver with randomly generated password protected user accountsneo4j- PlainNeo4jdatabase. Useful for tools likeBloodHoundphp-nginxserver withPHPenabled. Can be used to quickly test somePHPstuffGetting and Updating Containerscontainer-arsenalprovides a prebuild version for all available containers within therepository packagesYou can pull these images using the following commands:[qtc@devbox ~]$carpullssh# Just pulls the ssh container[qtc@devbox ~]$carpullall# Pulls all containersInstead of pulling prebuild containers, you can also build them locally by using thebuildaction:[qtc@devbox ~]$carbuildssh# Just builds the ssh container[qtc@devbox ~]$carbuildall# Builds all containersBuilding the containers locally has the advantage that the corresponding software is installed from scratch
and associated files and resources are not publicly available, as it is the case for the prebuild containers.
Moreover, building locally installs the most recent version of the corresponding software, while prebuild
containers use the most recent software version that was available on their build date. Therefore, using
locally build containers may be preferred in security critical contexts.ConfigurationAfter installingcontainer-arsenal, a configuration file will be placed at~/.config/car/car.toml.
This configuration file contains some global variables and default mappings for the provided containers.
The first few lines look like this:[containers]sudo_required=truevolume_base_path="~/arsenal"The[containers]section contains parameters that apply to all available containers. Thesudo_requiredsetting determines whetherdocker commandshave to be prefixed withsudo, whereas thevolume_base_pathspecifies the default local directory wheredocker volumeswill be stored.Apart from global configuration options, thecar.tomlfile also contains container specific options.
The following snipped shows the configuration for thesambacontainer:[containers.samba]samba_folder="<@:BASE:@>/samba"public_folder="<@:BASE:@>/samba/public"private_folder="<@:BASE:@>/samba/private"smb_port="445"This configuration shows, that thesambacontainer runs with two volumes that will be mapped to~/arsenal/samba/publicand~/arsenal/samba/private. The top level folder~/arsenal/sambais also included in the configuration file, but will not be mapped into the container.AcknowledgementsWhen creating the containers for this project I searched many different repositories for usefulDockerfiles. Certain parts of theDockerfilesprovided inside this repository are probably very similar to others that can be found onGitHub. I did not wrote down all the references,
but if you think that your name should be listed here, feel free to contact me :)For all others: thank you for working on open source projects <3Copyright 2022, Tobias Neitzel and the container-arsenal contributors.