Then how do ‘I’ create my own?
Wait, wait buddy! not so fast!
I think the best way to learn it is from me - while explaining how my Dockerfile is structured. So let’s begin, because we have a lot of stuff to process :)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
| FROM archlinux:latest
ENV USER_ID 1000
ENV GROUP_ID 1000
COPY ./pacman.conf /etc/pacman.conf
RUN pacman --sync --refresh --sysupgrade --noconfirm core/filesystem core/sudo && \
find / -type f '(' -name '*.pacnew' -or -name '*.pacsave' ')' -delete 2> /dev/null
COPY ./sudoers /etc/sudoers
RUN chmod 440 /etc/sudoers && \
groupadd --gid $GROUP_ID penelope && \
useradd --uid $USER_ID --gid $GROUP_ID --groups wheel --create-home penelope
RUN export TERM=xterm && curl --silent --show-error https://blackarch.org/strap.sh | bash
COPY ./entrypoint.sh /
WORKDIR /home/penelope
RUN pacman --needed --noconfirm -Syu curl \
wget \
git \
go \
python \
python-pip \
iputils \
ruby \
zsh \
gcc \
openvpn \
tmux \
man-db \
sudo \
man-pages \
nodejs \
base-devel \
yarn \
vim \
vi \
npm \
postgresql \
ruby-bundler \
zsh-syntax-highlighting
#Setting up password for penelope
USER root
RUN echo "penelope:penelope" | chpasswd
USER penelope
# Setting up zsh and getting Luke Smith's .zshrc and installing oh-my-zsh
RUN sh -c "$(wget https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh -O -)" && \
rm ~/.zshrc && \
wget https://raw.githubusercontent.com/Cloufish/voidrice/master/.config/zsh/.zshrc -O ~/.zshrc && \
echo 'penelope' > chsh -s /usr/bin/zsh
# DOING THE SAME FOR ROOT USER
USER root
RUN sh -c "$(wget https://raw.github.com/robbyrussell/oh-my-zsh/master/tools/install.sh -O -)" && \
rm ~/.zshrc && \
wget https://raw.githubusercontent.com/Cloufish/voidrice/master/.config/zsh/.zshrc -O ~/.zshrc && \
chsh -s /usr/bin/zsh
# Setting up tmux
USER penelope
RUN mkdir ~/.config/ && \
cd ~/.config/ && \
git clone https://github.com/gpakosz/.tmux.git && \
echo "set -g default-command /usr/sbin/zsh" >> ~/.config/.tmux/.tmux.conf.local && \
ln -s -f ~/.config/.tmux/.tmux.conf ~/.tmux.conf && \
cp ~/.config/.tmux/.tmux.conf.local ~/.tmux.conf.local
RUN wget https://raw.githubusercontent.com/LukeSmithxyz/voidrice/master/.config/nvim/init.vim && \
mkdir ~/.config/nvim && \
mv init.vim ~/.config/nvim && \
cp ~/.config/nvim/init.vim ~/ &&\
mv init.vim .vimrc && \
# Setting up man and bat
export MANPAGER="sh -c 'col -bx | bat -l man -p'" # Setting up environment for non-blackarch-tools and other tools, probably the most important part
RUN mkdir /home/penelope/PATH && \
mkdir -p /home/penelope/.gem/ruby/2.7.0/bin && \
mkdir -p /home/penelope/.local/bin && \
git clone https://github.com/Cloufish/non_blackarch_tools.git && \
cp /home/penelope/non_blackarch_tools/exploit_databases_init.sh /home/penelope
USER root
RUN chmod +x /home/penelope/non_blackarch_tools/install.sh
RUN pacman -Syyu --noconfirm
RUN sed -i 's/^# Server/Server/' "/etc/pacman.d/blackarch-mirrorlist"
RUN pacman --needed --noconfirm --overwrite='*' -Syu tmux gcc git vim wget tzdata curl iputils make nmap whois openvpn go python python3 perl jq hq yq nikto subbrute net-tools nano sqlmap cpanminus python-pycurl python-dnspython libxml2 python hydra powerline bat exploitdb beef
RUN pacman --needed --noconfirm --overwrite='*' -Syu gobuster metabigor joomlascan sublist3r wfuzz beef corsy gdb adb exploitpack radare2
RUN pacman --needed --noconfirm --overwrite='*, usr/lib/python3.8/site-packages/termcolor-1.1.0-py3.8.egg-info/*' -Syu amass aquatone metabigor gospider subfinder subover webanalyze man parallel unzip dex2jar jadx assetfinder
RUN pacman --needed --noconfirm --overwrite='*' -Syu httprobe unfurl openssh waybackurls whatweb smbclient openldap metasploit msf-mpc gnu-netcat
RUN pacman --needed --noconfirm --overwrite='*' -Syu ffuf nuclei corsy smuggler jq subscraper hakrawler brutespray interlace chromium msfdb jdk8-openjdk binwalk smbclient wordlistctl haiti
#RUN sed -i 's/^Server/# Server/' "/etc/pacman.d/blackarch-mirrorlist"
RUN cd /home/penelope/non_blackarch_tools && \
./install.sh && \
rm -rf /home/penelope/non_blackarch_tools
ENTRYPOINT ["sh","/entrypoint.sh"]
CMD ["zsh", "-ic", "tmux"]
|
Let’s examine it piece by piece…
- This is telling us that we’re using archlinux:latest container as a base to our image.
1
2
| ENV USER_ID 1000
ENV GROUP_ID 1000
|
- This sets a variable (we can call it even environment variable) that’ll be used when building the image
1
2
3
| COPY ./pacman.conf /etc/pacman.conf
RUN pacman --sync --refresh --sysupgrade --noconfirm core/filesystem core/sudo && \
find / -type f '(' -name '*.pacnew' -or -name '*.pacsave' ')' -delete 2> /dev/null
|
- This is a setup for pacman.conf (this is not that much necesseary)
- Then it’s running pacman to do basic initialization after copying a pacman.conf, but it also installes sudo and filesystem packages from core
- Finally the find command is ran deleting all .pacnew and .pacsave files from the filesystem
.pacnew and .pacsave are files that store .config files of deleted packages
1
2
3
4
| COPY ./sudoers /etc/sudoers
RUN chmod 440 /etc/sudoers && \
groupadd --gid $GROUP_ID penelope && \
useradd --uid $USER_ID --gid $GROUP_ID --groups wheel --create-home penelope
|
- Here we copy sudoers file to /etc/sudoers on our future container
- Then running chmod to so that nobody will have write access to this file (because we access it with
visudo command) - Then we’re adding a group called penelope (Notice that we’re using $GROUP_ID variable that we’ve declared before) and a user that is being assing to two groupd - wheel and penelope
1
| RUN export TERM=xterm && curl --silent --show-error https://blackarch.org/strap.sh | bash
|
- Finally we’re using curl to download script that’ll initialize and add blackarch repository to our… well package repositories, initialize keyring etc.
- This file is pretty important, lets see CONTENTS OF ENTRYPOINT.SH
1
2
3
| #!/usr/bin/env bash
[[ "$USER_ID" == "$(id -u penelope)" && "$GROUP_ID" == "$(id -g penelope)" ]] || usermod --uid "$USER_ID" --gid "$GROUP_ID" penelope
exec sudo --user penelope -- "$@"
|
- Okaaay, what is it?! (You might ask ;p). The ‘[[’ characters signalize that this is a
if statement - Yeah I know, if statement without if keyword, but in bash it’s somehow possible. - So this stamenent checks if we’ve done everything right with creating a user penelope and assigning it to the appropriate groups OR if the command
usermod --uid "$USER_ID" --gid "$GROUP_ID" penelope was successful, which will in the end do the same result. - After this ‘if statement’ we’re logging as penelope.
- BUT! We’re only copying this file and we’re not executing it, so what’s going on here?! We’ll see in the future, don’t worry :)
- This is important step too, because now every action that we’re going to perform that results in downloading a file, creating another directory etc. will be in that file
This option is not frequently used in my Dockerfile, only this once, because I often see it more comfortable to just use ‘cd ', but it's probably a bad practice.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
| RUN pacman --needed --noconfirm -Syu curl \
wget \
git \
go \
python \
python-pip \
iputils \
ruby \
zsh \
gcc \
openvpn \
tmux \
man-db \
sudo \
man-pages \
nodejs \
base-devel \
yarn \
vim \
vi \
npm \
postgresql \
ruby-bundler \
zsh-syntax-highlighting
|
- This installed basic utils that should be preinstalled before installing any blackarch tools or git cloning.
- This is super useful, the same goes to
USER root, It is an extra easy way of switching between root user and non-root user without having to input any password, perfect!
1
2
3
4
5
6
7
| # Setting up zsh and getting Luke Smith's .zshrc and installing oh-my-zsh
RUN sh -c "$(wget https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh -O -)" && \
rm ~/.zshrc && \
wget https://raw.githubusercontent.com/Cloufish/voidrice/master/.config/zsh/.zshrc -O ~/.zshrc && \
echo 'penelope' > chsh -s /usr/bin/zsh
|
- From this point there’s a lot of my personal customization, it’s getting time and many failed attempts in finding a particular solution to a problem, and you’ll probably find many obstacles yourself when building a Docker container, remember that Stack Overflow is your friend
- But are those Stack Overflow answers always secure? In this case we’re just echo’ing password for the non-root user so it’s not something that bad ~ Words said before a disaster! :D
1
| RUN pacman --needed --noconfirm --overwrite='*' -Syu tmux gcc git vim wget tzdata curl iputils make nmap whois openvpn go
|
- Let’s jump into installing tools from blackarch repository database. The switched are:
--needed - so that I won’t reinstall packages unneceseary (because why should I, If a package is installed? ;P)--noconfirm - Is a way of telling the pacman ‘I want this without any prompts!’ basically--overwrite='*' Here is the one of the issues for installing packages with blackarch database. Lot of times there’ll be errors that ‘A package already exists’, but not in a way –needed checks it (I don’t understand it perfectly to be honest), but we’re using this switch to overwrite every package. Is it then neglecting --needed switch/flag? Tell me in the comments :p
Now read again the whole Dockerfile that I’ve provided to you in the beginning and figure out what you don’t understand, then come back here again. It’s to remember it more efficient
So how do you create ‘Your own’?
Modifying FROM argument:
- You can use argument
FROM cloufish/blackarch-zsh-minimal:latest keywoard if you like adventures and if you’re risky player. - Or you can just copy the Dockerfile from blackarch-zsh-minimal and then modifying it
I’ve in someway tricked you, because the best way of doing this is through practice
I’m also not an expert, the knowledge that I’ve gained and this project took me 3 months to make it stable and in some way ‘worth it to publish’. And I would never imagine that it would be that cool after first weeks of struggling with user creation
