monkeygold
571a7743ae
Stage ProjectDiscovery binaries before installing them into /usr/local/bin, run the tools image as the existing Kali operator identity, preserve runtime access to Foundry tools, and cover the non-root Dockerfile and smoke-test contracts.
95 lines
5.5 KiB
Docker
95 lines
5.5 KiB
Docker
# T3MP3ST Kali Linux+ arsenal image → cybench-tools:latest (linux/amd64)
|
|
#
|
|
# NORTH STAR: a 1337 hacker group of specialist experts wielding a real Kali Linux+ arsenal.
|
|
# This is the reproducible loadout — the hunter mounts it via --tools-image for RE/crypto/pwn
|
|
# challenges (host has no linux/amd64 tooling), and it is the portable home of the FULL arsenal.
|
|
#
|
|
# "+" over stock Kali = the AI-native / frontier tooling Kali doesn't ship (the ProjectDiscovery
|
|
# Go suite, smart-contract analyzers, semgrep). It also satisfies scripts/check-tools-image.sh:
|
|
# radare2/gdb/objdump/upx + python {z3,sympy,pwn,fpylll,Crypto} + pip-audit.
|
|
#
|
|
# Build: npm run tools:build (== bash tools/build.sh)
|
|
# Verify: npm run tools:check (== scripts/check-tools-image.sh)
|
|
# Heavy (~minutes, multi-GB). Built on demand, not in CI.
|
|
FROM kalilinux/kali-rolling
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive \
|
|
PIP_BREAK_SYSTEM_PACKAGES=1
|
|
|
|
# ── apt: reverse/crypto/pwn + web/recon + osint, plus build deps for the pip layer ──
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates curl wget git unzip ruby-full build-essential pkg-config \
|
|
python3 python3-pip python3-venv golang-go \
|
|
# reverse / forensics / pwn (check-tools-image.sh: radare2 gdb objdump upx)
|
|
radare2 gdb binutils upx-ucl file binwalk foremost exiftool yara steghide xxd \
|
|
# crypto
|
|
john hashcat openssl \
|
|
# web exploitation / recon (the ones Kali ships in apt)
|
|
nmap nikto sqlmap gobuster ffuf feroxbuster hydra whois dnsutils \
|
|
# fpylll/pwntools native build deps
|
|
libgmp-dev libmpfr-dev libmpc-dev libfplll-dev libssl-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# ── pip: the RE/crypto/pwn python stack (check-tools-image.sh validates these) + SAST ──
|
|
# fpylll needs cysignals (+ cython) present at BUILD time, or `import fpylll` fails at runtime
|
|
# with ModuleNotFoundError: cysignals. Install them as a prior layer so fpylll links correctly.
|
|
RUN pip3 install --no-cache-dir cython cysignals
|
|
# Core stack MUST succeed — it backs the presence smoke test.
|
|
RUN pip3 install --no-cache-dir \
|
|
z3-solver sympy pwntools fpylll pycryptodome requests \
|
|
pip-audit semgrep
|
|
# Smart-contract analyzers share conflicting deps (web3/eth-* + a shared z3 pin) — a single
|
|
# `pip install slither-analyzer mythril` FAILS the resolver, and the old `|| echo WARN` swallowed it
|
|
# silently → both ended up MISSING. Fix: pipx gives each its OWN isolated venv (no cross-conflict),
|
|
# with binaries on PATH via PIPX_BIN_DIR. Install INDEPENDENTLY so slither (reliable) lands even if
|
|
# mythril (notoriously version-pinned) fails — and the layer stays tolerant (never aborts the image).
|
|
RUN pip3 install --no-cache-dir pipx \
|
|
&& export PIPX_HOME=/opt/pipx PIPX_BIN_DIR=/usr/local/bin \
|
|
&& (pipx install slither-analyzer || echo "WARN: slither pipx install failed") \
|
|
&& (pipx install mythril || echo "WARN: mythril pipx install failed")
|
|
|
|
# ── go: the "+" — ProjectDiscovery suite + dalfox (not in stock Kali apt) ──
|
|
# Stage first: the Python dependency layer already creates /usr/local/bin/httpx,
|
|
# and `go install` refuses to overwrite a non-Go executable at GOBIN. `install`
|
|
# deliberately replaces that console script with ProjectDiscovery httpx.
|
|
RUN export GOBIN=/tmp/projectdiscovery-bin && \
|
|
go install github.com/projectdiscovery/httpx/cmd/httpx@latest && \
|
|
go install github.com/projectdiscovery/katana/cmd/katana@latest && \
|
|
go install github.com/projectdiscovery/naabu/v2/cmd/naabu@latest && \
|
|
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest && \
|
|
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest && \
|
|
go install github.com/hahwul/dalfox/v2@latest && \
|
|
install -m 0755 "$GOBIN"/* /usr/local/bin/ && \
|
|
rm -rf "$GOBIN" /root/go/pkg /root/.cache/go-build
|
|
|
|
# ── npm + foundry: smart-contract "+" (solhint, forge/cast) ──
|
|
RUN apt-get update && apt-get install -y --no-install-recommends nodejs npm && \
|
|
npm install -g solhint && \
|
|
rm -rf /var/lib/apt/lists/* /root/.npm
|
|
RUN curl -L https://foundry.paradigm.xyz | bash && /root/.foundry/bin/foundryup && \
|
|
cp /root/.foundry/bin/forge /root/.foundry/bin/cast /root/.foundry/bin/anvil /usr/local/bin/ 2>/dev/null || \
|
|
echo "foundry install skipped (offline build) — re-run foundryup later"
|
|
|
|
# nuclei templates (best-effort; the scan still runs without a fresh pull)
|
|
RUN nuclei -update-templates -silent || true
|
|
|
|
# ── SageMath (the crypto powerhouse: lattices/LLL, CRT, elliptic curves, poly rings) ──
|
|
# Kali apt has NO sagemath candidate; conda-forge does. Heavy (~2-3GB) but NO host/perms issue
|
|
# (fresh container, not /opt/homebrew). Best-effort: a resolver/emulation failure must NOT abort
|
|
# the image — the rest of the crypto stack (z3/sympy/fpylll) stays usable.
|
|
RUN curl -fsSL https://github.com/conda-forge/miniforge/releases/latest/download/Miniforge3-Linux-x86_64.sh -o /tmp/mf.sh \
|
|
&& bash /tmp/mf.sh -b -p /opt/conda && rm -f /tmp/mf.sh \
|
|
&& /opt/conda/bin/conda install -y -c conda-forge sage \
|
|
&& ln -sf /opt/conda/bin/sage /usr/local/bin/sage \
|
|
&& /opt/conda/bin/conda clean -afy \
|
|
|| echo "WARN: sage (conda-forge) install failed/skipped — crypto falls back to z3/sympy/fpylll"
|
|
|
|
# Kali already defines the operator group; attach the runtime user to it.
|
|
RUN useradd --gid operator --create-home --shell /bin/bash operator \
|
|
&& mkdir -p /work \
|
|
&& chown operator:operator /work
|
|
|
|
USER operator
|
|
WORKDIR /work
|
|
CMD ["bash"]
|