## Exploit Lab — README

Overview
- Lightweight Docker Compose lab for binary analysis/exploitation built on Kali.
- Provides common tools (gcc, gdb, pwntools, radare2, binwalk, strace, ltrace, etc.) in a non-privileged container with challenge files mounted read-only.

Requirements
- Docker Engine and Docker Compose (v2) installed.
- Enough disk space for image build (several hundred MB+).
- Optional: adjust UID/GID if your host user isn't 1000.

Repository layout (example)
- docker-compose.yml
- kali/Dockerfile
- challenge/         ← drop your challenge ZIP/files here (mounted read-only)
- README.md

Quick start
1. Place challenge files in ./challenge
2. Build and start the lab (background):
   docker compose up --build -d
3. Enter an interactive shell inside the running container:
   docker compose exec exploit-lab /bin/bash
   (or as mapped host user)
   docker compose exec --user 1000:1000 exploit-lab /bin/bash
4. Stop and remove containers:
   docker compose down

Notes about safety & file locations
- Mounted challenge directory is read-only inside the container at /home/kali/challenge.
- Writable workspace: the named volume /home/kali/work and /tmp inside the container.
- The runtime image is non-privileged and has restricted capabilities (per docker-compose.yml), but it shares the host kernel — for maximal isolation use a disposable VM and document that in your report.

Typical workflow inside container
- Inspect files without executing:
  file /home/kali/challenge/app
  sha256sum /home/kali/challenge/*
  strings /home/kali/challenge/app | less
  ldd /home/kali/challenge/app
- Create workspace and copy extracted files you need writable:
  cp -r /home/kali/challenge /home/kali/work/challenge1
- Run debugging/reversing tools from the venv-provided PATH (pwntools, etc.) — venv is at /opt/venv and is on PATH in the image.

Rebuilding or updating tools
- After editing the Dockerfile, rebuild:
  docker compose build --no-cache
  docker compose up -d

Networking
- By default runtime network is disabled (network_mode: "none") to reduce risk. If you need network, edit docker-compose.yml and remove or change network_mode, then rebuild.

Common commands
- Start foreground (logs): docker compose up --build
- Start background: docker compose up -d
- Exec shell: docker compose exec exploit-lab /bin/bash
- Run one-off shell: docker compose run --rm exploit-lab /bin/bash
- Get logs: docker compose logs -f
- Rebuild image: docker compose build --no-cache
- Stop and remove: docker compose down

Troubleshooting
- Build errors about pip/PEP 668: the Dockerfile uses a Python virtualenv (/opt/venv). If you change Python steps, prefer venv over system pip.
- Malformed Docker config warnings: fix or move ~/.docker/config.json.
- Missing Dockerfile during build: ensure dockerfile is at the path referenced by docker-compose.yml (build.context and build.dockerfile).

Customization tips
- Change host UID mapping: edit Dockerfile USER_UID/USER_GID or the compose user field to match your host user.
- Add/remove tools in kali/Dockerfile apt install list.
- If you need angr, add its build deps and install inside the venv (longer build).

License
- MIT.