# Exploit Lab

## Overview
- Lightweight Docker Compose lab for binary analysis/exploitation built on Kali.
- Provides common tools (gcc, gdb, pwntools, radare2, binwalk, strace, ltrace, etc.) in a non-privileged container with challenge files mounted read-only.

## Requirements
- Docker Engine and Docker Compose (v2) installed.
- Enough disk space for image build (several hundred MB+).
- Optional: adjust UID/GID if your host user isn't 1000.

## Repository layout (example)
- docker-compose.yml
- kali/Dockerfile
- challenge/         `← drop your challenge ZIP/files here (mounted read-only)`
- README.md

## Quick start
1. Place challenge files in ./challenge
2. Build and start the lab (background):
   ```
   docker compose up --build -d
   ```
3. Enter an interactive shell inside the running container:
   ```
   docker compose exec exploit-lab /bin/bash
   ```
   (or as mapped host user)
   ```
   docker compose exec --user 1000:1000 exploit-lab /bin/bash
   ```
4. Stop and remove containers:
   ```
   docker compose down
   ```

### Notes about safety & file locations
- Mounted challenge directory is read-only inside the container at /home/kali/challenge.
- Writable workspace: the named volume /home/kali/work and /tmp inside the container.
- The runtime image is non-privileged and has restricted capabilities (per docker-compose.yml), but it shares the host kernel — for maximal isolation use a disposable VM and document that in your report.

### Typical workflow inside container
- Inspect files without executing:
  file /home/kali/challenge/app
  sha256sum /home/kali/challenge/*
  strings /home/kali/challenge/app | less
  ldd /home/kali/challenge/app
- Create workspace and copy extracted files you need writable:
  cp -r /home/kali/challenge /home/kali/work/challenge1
- Run debugging/reversing tools from the venv-provided PATH (pwntools, etc.) — venv is at /opt/venv and is on PATH in the image.

### Rebuilding or updating tools
- After editing the Dockerfile, rebuild:
  `docker compose build --no-cache`
  `docker compose up -d`

### Networking
- By default runtime network is disabled (network_mode: "none") to reduce risk. If you need network, edit docker-compose.yml and remove or change network_mode, then rebuild.

## Common commands
- Start foreground (logs): `docker compose up --build`
- Start background: `docker compose up -d`
- Exec shell: `docker compose exec exploit-lab /bin/bash`
- Run one-off shell: `docker compose run --rm exploit-lab /bin/bash`
- Get logs: `docker compose logs -f`
- Rebuild image: `docker compose build --no-cache`
- Stop and remove: `docker compose down`

## Troubleshooting
- Build errors about pip/PEP 668: the Dockerfile uses a Python virtualenv (/opt/venv). If you change Python steps, prefer venv over system pip.
- Malformed Docker config warnings: fix or move ~/.docker/config.json.
- Missing Dockerfile during build: ensure dockerfile is at the path referenced by docker-compose.yml (build.context and build.dockerfile).

## Customization tips
- Change host UID mapping: edit Dockerfile USER_UID/USER_GID or the compose user field to match your host user.
- Add/remove tools in kali/Dockerfile apt install list.
- If you need angr, add its build deps and install inside the venv (longer build).

## License
- MIT