Pentesting Lab - Docker Stack for Offensive Operations

This project provides a flexible Docker-based environment primarily focused on deploying offensive security tools and exploring attack surfaces. It has been streamlined to remove default vulnerable target machines, allowing you to integrate your own targets or focus solely on attack infrastructure.

Features

✅ Pentesting Tools

• Kali Linux container with full toolset (controller)
• Pre-configured for network-wide access
• Direct container shell access

✅ Network Isolation

• Dedicated pentest-lab bridge network (172.20.0.0/16)
• All services on same network
• Internal DNS resolution
• Port forwarding for external access

✅ Data Persistence

• Persistent volumes for all services (findings, payloads, logs, reports)
• Centralized findings repository
• Full logging and evidence collection
• Payload storage

✅ Easy Management

• Simplified docker-compose.yml for attack infrastructure
• One-command startup (via lab.sh)
• Shared volume between containers
• Documented credentials and access points

Enhanced Lab Management (New Features)

We've significantly upgraded the lab management experience:

1. Host System Setup (setup-host.sh)

Before running the lab, it's recommended to ensure your host system has all necessary dependencies.

• Function: Checks for git, docker, docker-compose, and pandoc (for reporting). Provides installation commands if dependencies are missing.
• Usage:

  ./setup-host.sh

  Remember to set executable permissions for setup-host.sh in your Unix-like environment: chmod +x setup-host.sh

2. Interactive Lab Manager (lab.sh)

The lab.sh script is now your central hub for managing the pentesting lab. It supports scenario-based deployment and an interactive menu.

Interactive Menu Mode

• Function: Run lab.sh without any arguments to launch a user-friendly interactive menu for all lab operations.
• Usage:

  ./lab.sh

Command-Line Mode

• Function: All previous lab.sh commands are still available, now supporting scenario-based deployment.
• Usage:

  # Start a specific lab scenario (e.g., metasploit)
  ./lab.sh up metasploit
  
  # Stop the currently active lab
  ./lab.sh down
  
  # Check status of the active lab
  ./lab.sh status
  
  # View logs for a service in the active lab
  ./lab.sh logs metasploit-db
  
  # Access a shell in a service (e.g., controller)
  ./lab.sh shell controller

  Remember to set executable permissions for lab.sh in your Unix-like environment: chmod +x lab.sh

3. Covenant C2 Integration

The Covenant C2 framework can now be easily deployed as a lab scenario.

• Function: The first time you start the Covenant lab, it will automatically clone its repository and build the Docker image. Subsequent runs will be much faster.
• Usage:

  ./lab.sh up covenant

  Access the Covenant web interface at https://localhost:7443. Note: Building Covenant requires a working internet connection within the Docker build environment. Remember to set executable permissions for setup-covenant.sh in your Unix-like environment: chmod +x setup-covenant.sh

4. Markdown-based Reporting

A lightweight and flexible reporting solution using Markdown and pandoc has been integrated.

• Function: Convert Markdown report files into professional-looking PDF documents.
• Usage:
  1. Copy the template:

     cp reports/template.md reports/my_project_report.md

  2. Edit your report: Fill in your findings in reports/my_project_report.md.
  3. Generate PDF:

     ./generate-report.sh reports/my_project_report.md

     This will create reports/my_project_report.pdf. Dependencies: This feature requires pandoc and a LaTeX distribution (e.g., TeX Live) installed on your host system. setup-host.sh will check for pandoc. For best results, it's recommended to install the Eisvogel pandoc template. Remember to set executable permissions for generate-report.sh in your Unix-like environment: chmod +x generate-report.sh

One-Liner Deployment

For a quick setup and deployment of a default lab, you can use the following one-liner from your Unix-like terminal:

./setup-host.sh && ./lab.sh up metasploit

This command will:

1. Check and prompt you to install host dependencies like Docker and pandoc.
2. Start the metasploit lab scenario.

Services (Attack Infrastructure) & Credentials

Service	IP	Port	Username	Password	Notes
Controller	172.20.0.x	-	root	-	Kali Linux with tools
Evil-WinRM Controller	172.23.0.x	-	root	-	Controller for Evil-WinRM operations
Findings Storage	(Internal)	-	-	-	Centralized storage for findings, payloads, logs, reports

Architecture

pentest-lab Network (172.20.0.0/16) - Placeholder for your custom target network
│
└── [172.20.0.x] Controller (Kali Linux)
    └── Access to your custom targets
└── [172.23.0.x] Evil-WinRM Controller (LinWinPwn)
    └── Connects to your custom Windows targets via WinRM

Volume Structure

pentest-lab/
├── findings/           # Documentation of findings
│   └── FINDINGS.md    # Main findings tracker
├── payloads/          # Exploits and wordlists
│   ├── exploit/       # Exploit code
│   ├── shellcode/     # Reverse shells
│   └── wordlist/      # Custom wordlists
├── tools/             # Custom scripts (including cloned Covenant repo)
├── reports/           # Report generation
├── logs/              # Container logs
│   ├── controller/    # Controller activity
│   └── evil-winrm-controller/ # Evil-WinRM Controller activity
├── volumes/           # Persistent container data
└── docker/            # Custom Dockerfiles (e.g., for custom attack tools)

Customization

Modify Credentials

Edit environment variables in docker-compose.yml:

environment:
  - ROOT_PASSWORD=your_password
  - ADMIN_PASSWORD=your_password

Cleanup

# Stop all services
docker-compose down

# Remove volumes (data reset)
docker-compose down -v

# Remove all custom images
docker-compose down --rmi all

Troubleshooting

Services not starting

docker-compose logs controller
docker-compose logs evil-winrm-controller

Can't ping between containers

docker network ls
docker network inspect pentest-lab

Security Notes

⚠️ This lab contains offensive tools. Do NOT expose to the internet.

• Use with VPN or air-gapped network for safety

Next Steps

1. Review the new docker-compose.yml to understand the current attack infrastructure.
2. Integrate your own custom target machines into the network for practice.
3. Customize Dockerfiles for specific practice scenarios.
4. Document all findings in findings/FINDINGS.md.

Support

For issues or questions:

• Check Docker logs: docker-compose logs <service>
• Review Dockerfiles in docker/ directory

---

Ready to practice? Start with:

1. Run the host setup script (from your Unix-like terminal)

./setup-host.sh

2. Start the lab using the interactive menu or command-line (from your Unix-like terminal)

./lab.sh # for interactive menu

OR

./lab.sh up <scenario_name> # e.g., ./lab.sh up metasploit

3. Access pentesting controller

./lab.sh shell controller