Skip to content

Commit c620913

Browse files
teamssixteamssix
authored
Merge pull request #75 from teamssix/main
docs: update readme
2 parents adb6251 + 4bf28c0 commit c620913

File tree

7 files changed

+138
-36
lines changed

7 files changed

+138
-36
lines changed

‎README.md‎

Lines changed: 70 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -73,39 +73,91 @@ Currently supported cloud vendors include Alibaba Cloud, Tencent Cloud, Huawei C
7373

7474
## :dizzy: Install
7575

76-
TerraformGoat is built using Dockerfile, so you need to install the Docker environment first. For the Docker installation method, please refer to: [https://docs.docker.com/get-docker/](https://docs.docker.com/get-docker/)
76+
Depending on the cloud service provider you are using, choose the corresponding installation command.
7777

78-
```shell
79-
git clone https://github.com/HuoCorp/TerraformGoat.git --depth 1
80-
cd TerraformGoat
81-
docker build . -t terraformgoat:v0.0.3
78+
Alibaba Cloud
79+
80+
```bash
81+
docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_aliyun:0.0.4
82+
docker run -itd --name terraformgoat_aliyun_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_aliyun:0.0.4
83+
docker exec -it terraformgoat_aliyun_0.0.4 /bin/bash
8284
```
8385

84-
![img](./images/1653031694.png)
86+
Tencent Cloud
87+
88+
```bash
89+
docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_tencentcloud:0.0.4
90+
docker run -itd --name terraformgoat_tencentcloud_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_tencentcloud:0.0.4
91+
docker exec -it terraformgoat_tencentcloud.0.4 /bin/bash
92+
```
8593

86-
After docker build is complete, start and enter the container
94+
Huawei Cloud
8795

88-
```shell
89-
docker run -itd --name terraformgoat terraformgoat:v0.0.3
90-
docker exec -it terraformgoat /bin/bash
96+
```bash
97+
docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_huaweicloud:0.0.4
98+
docker run -itd --name terraformgoat_huaweicloud_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_huaweicloud:0.0.4
99+
docker exec -it terraformgoat_huaweicloud_0.0.4 /bin/bash
91100
```
92101

93-
When entering the container, you need to select the cloud service to run
102+
Amazon Web Services
94103

95-
![img](./images/1653035756.png)
104+
```bash
105+
docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_aws:0.0.4
106+
docker run -itd --name terraformgoat_aws_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_aws:0.0.4
107+
docker exec -it terraformgoat_aws_0.0.4 /bin/bash
108+
```
96109

97-
After selecting the cloud service you want to use, the relevant dependencies will be installed. After the relevant dependencies are installed, you can use TerraformGoat.
110+
Google Cloud Platform
111+
112+
```bash
113+
docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_gcp:0.0.4
114+
docker run -itd --name terraformgoat_gcp_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_gcp:0.0.4
115+
docker exec -it terraformgoat_gcp_0.0.4 /bin/bash
116+
```
117+
118+
Microsoft Azure
119+
120+
```bash
121+
docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_azure:0.0.4
122+
docker run -itd --name terraformgoat_azure_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_azure:0.0.4
123+
docker exec -it terraformgoat_azure_0.0.4 /bin/bash
124+
```
98125

99-
Using the build of the [Alibaba Cloud ECS SSRF](https://github.com/HuoCorp/TerraformGoat/tree/main/aliyun/ecs/ecs_ssrf) vulnerability scenario as a demo:
126+
## :page_facing_up: Demo
100127

101-
[![asciicast](https://asciinema.org/a/493554.svg)](https://asciinema.org/a/493554)
128+
After entering the container, cd to the corresponding scenario directory and you can start deploying the scenario.
129+
130+
Here is a demonstration of the [Alibaba Cloud Bucket Object Traversal](https://github.com/HuoCorp/TerraformGoat/tree/main/aliyun/oss/bucket_object_traversal) scenario build.
131+
132+
```bash
133+
docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_aliyun:0.0.4
134+
docker run -itd --name terraformgoat_aliyun_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_aliyun:0.0.4
135+
docker exec -it terraformgoat_aliyun_0.0.4 /bin/bash
136+
```
137+
138+
![img](/Volumes/HX相关/研究/Terraform/TerraformGoat/images/1655118629.png)
139+
140+
```bash
141+
cd /TerraformGoat/aliyun/oss/bucket_object_traversal/
142+
aliyun configure
143+
terraform init
144+
terraform apply
145+
```
146+
147+
![img](/Volumes/HX相关/研究/Terraform/TerraformGoat/images/1655118969.png)
148+
149+
The program prompts `Enter a value:`, type `yes` and enter, use curl to access the bucket, you can see the object traversed.
150+
151+
![img](/Volumes/HX相关/研究/Terraform/TerraformGoat/images/1655119171.png)
102152

103153
## :rocket: Uninstall
104154

155+
If you are in a container, first execute the `exit` command to exit the container, and then execute the following command under the host.
156+
105157
```shell
106-
docker stop terraformgoat
107-
docker rm terraformgoat
108-
docker rmi terraformgoat:v0.0.3
158+
docker stop $(docker ps -a -q -f "name=terraformgoat*")
159+
docker rm $(docker ps -a -q -f "name=terraformgoat*")
160+
docker rmi $(docker images -a -q -f "reference=registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat*")
109161
```
110162

111163
## ⚠️ Notice

‎README_CN.md‎

Lines changed: 68 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -72,39 +72,89 @@ Cloud Platform、Microsoft Azure 六个云厂商的云场景漏洞搭建。
7272

7373
## :dizzy: 安装
7474

75-
TerraformGoat 使用 Dockerfile 构建，因此需要先安装 Docker 环境，Docker 安装方法可以参考：[https://docs.docker.com/get-docker/](https://docs.docker.com/get-docker/)
75+
根据你使用到的云服务提供商，选择对应的安装命令。
7676

77-
```shell
78-
git clone https://github.com/HuoCorp/TerraformGoat.git --depth 1
79-
cd TerraformGoat
80-
docker build . -t terraformgoat:v0.0.3
77+
阿里云
78+
79+
```bash
80+
docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_aliyun:0.0.4
81+
docker run -itd --name terraformgoat_aliyun_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_aliyun:0.0.4
82+
docker exec -it terraformgoat_aliyun_0.0.4 /bin/bash
8183
```
8284

83-
![img](./images/1653031694.png)
85+
腾讯云
8486

85-
docker build 完成后，启动并进入容器
87+
```bash
88+
docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_tencentcloud:0.0.4
89+
docker run -itd --name terraformgoat_tencentcloud_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_tencentcloud:0.0.4
90+
docker exec -it terraformgoat_tencentcloud.0.4 /bin/bash
91+
```
8692

87-
```shell
88-
docker run -itd --name terraformgoat terraformgoat:v0.0.3
89-
docker exec -it terraformgoat /bin/bash
93+
华为云
94+
95+
```bash
96+
docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_huaweicloud:0.0.4
97+
docker run -itd --name terraformgoat_huaweicloud_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_huaweicloud:0.0.4
98+
docker exec -it terraformgoat_huaweicloud_0.0.4 /bin/bash
99+
```
100+
101+
Amazon Web Services
102+
103+
```bash
104+
docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_aws:0.0.4
105+
docker run -itd --name terraformgoat_aws_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_aws:0.0.4
106+
docker exec -it terraformgoat_aws_0.0.4 /bin/bash
107+
```
108+
109+
Google Cloud Platform
110+
111+
```bash
112+
docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_gcp:0.0.4
113+
docker run -itd --name terraformgoat_gcp_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_gcp:0.0.4
114+
docker exec -it terraformgoat_gcp_0.0.4 /bin/bash
115+
```
116+
117+
Microsoft Azure
118+
119+
```bash
120+
docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_azure:0.0.4
121+
docker run -itd --name terraformgoat_azure_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_azure:0.0.4
122+
docker exec -it terraformgoat_azure_0.0.4 /bin/bash
123+
```
124+
125+
## :page_facing_up: 演示
126+
127+
进入到容器后，cd 到对应的场景目录，就可以开始部署靶场了，这里以 [阿里云 Bucket 对象遍历](https://github.com/HuoCorp/TerraformGoat/tree/main/aliyun/oss/bucket_object_traversal) 漏洞场景的搭建进行演示：
128+
129+
```bash
130+
docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_aliyun:0.0.4
131+
docker run -itd --name terraformgoat_aliyun_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_aliyun:0.0.4
132+
docker exec -it terraformgoat_aliyun_0.0.4 /bin/bash
90133
```
91134

92-
在进入容器时需要选择要使用到的云服务
135+
![img](./images/1655118629.png)
93136

94-
![img](./images/1653035756.png)
137+
```bash
138+
cd /TerraformGoat/aliyun/oss/bucket_object_traversal/
139+
aliyun configure
140+
terraform init
141+
terraform apply
142+
```
95143

96-
选择你要用的云服务后会安装相关依赖，等相关依赖安装完后，就可以使用 TerraformGoat 了
144+
![img](./images/1655118969.png)
97145

98-
这里以[阿里云 ECS SSRF](https://github.com/HuoCorp/TerraformGoat/tree/main/aliyun/ecs/ecs_ssrf) 漏洞场景的搭建进行演示：
146+
提示`Enter a value:`，输入 `yes` 并回车，使用 curl 访问该 bucket，可以看到遍历到的对象。
99147

100-
[![asciicast](https://asciinema.org/a/493554.svg)](https://asciinema.org/a/493554)
148+
![img](./images/1655119171.png)
101149

102150
## :rocket: 卸载
103151

152+
如果在容器中，先执行 `exit` 命令退出容器，然后在宿主机下执行以下命令。
153+
104154
```shell
105-
docker stop terraformgoat
106-
docker rm terraformgoat
107-
docker rmi terraformgoat:v0.0.3
155+
docker stop $(docker ps -a -q -f "name=terraformgoat*")
156+
docker rm $(docker ps -a -q -f "name=terraformgoat*")
157+
docker rmi $(docker images -a -q -f "reference=registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat*")
108158
```
109159

110160
## ⚠️ 注意事项

‎images/1653031694.png‎

-122 KB
Binary file not shown.

‎images/1653035756.png‎

-102 KB
Binary file not shown.

‎images/1655118629.png‎

108 KB
Loading

‎images/1655118969.png‎

219 KB
Loading

‎images/1655119171.png‎

191 KB
Loading

0 commit comments

Comments
 (0)