Exploit Lab

Overview

• Lightweight Docker Compose lab for binary analysis/exploitation built on Kali.
• Provides common tools (gcc, gdb, pwntools, radare2, binwalk, strace, ltrace, etc.) in a non-privileged container with challenge files mounted read-only.

Requirements

• Docker Engine and Docker Compose (v2) installed.
• Enough disk space for image build (several hundred MB+).
• Optional: adjust UID/GID if your host user isn't 1000.

Repository layout (example)

• docker-compose.yml
• kali/Dockerfile
• challenge/ ← drop your challenge ZIP/files here (mounted read-only)
• README.md

Quick start

1. Place challenge files in ./challenge
2. Build and start the lab (background):

    docker compose up --build -d
   

3. Enter an interactive shell inside the running container:

    docker compose exec exploit-lab /bin/bash
   

   (or as mapped host user)

    docker compose exec --user 1000:1000 exploit-lab /bin/bash
   

4. Stop and remove containers:

    docker compose down
   

Notes about safety & file locations

• Mounted challenge directory is read-only inside the container at /home/kali/challenge.
• Writable workspace: the named volume /home/kali/work and /tmp inside the container.
• The runtime image is non-privileged and has restricted capabilities (per docker-compose.yml), but it shares the host kernel — for maximal isolation use a disposable VM and document that in your report.

Typical workflow inside container

• Inspect files without executing: file /home/kali/challenge/app sha256sum /home/kali/challenge/* strings /home/kali/challenge/app | less ldd /home/kali/challenge/app
• Create workspace and copy extracted files you need writable: cp -r /home/kali/challenge /home/kali/work/challenge1
• Run debugging/reversing tools from the venv-provided PATH (pwntools, etc.) — venv is at /opt/venv and is on PATH in the image.

Rebuilding or updating tools

• After editing the Dockerfile, rebuild: docker compose build --no-cache docker compose up -d

Networking

• By default runtime network is disabled (network_mode: "none") to reduce risk. If you need network, edit docker-compose.yml and remove or change network_mode, then rebuild.

Common commands

• Start foreground (logs): docker compose up --build
• Start background: docker compose up -d
• Exec shell: docker compose exec exploit-lab /bin/bash
• Run one-off shell: docker compose run --rm exploit-lab /bin/bash
• Get logs: docker compose logs -f
• Rebuild image: docker compose build --no-cache
• Stop and remove: docker compose down

Troubleshooting

• Build errors about pip/PEP 668: the Dockerfile uses a Python virtualenv (/opt/venv). If you change Python steps, prefer venv over system pip.
• Malformed Docker config warnings: fix or move ~/.docker/config.json.
• Missing Dockerfile during build: ensure dockerfile is at the path referenced by docker-compose.yml (build.context and build.dockerfile).

Customization tips

• Change host UID mapping: edit Dockerfile USER_UID/USER_GID or the compose user field to match your host user.
• Add/remove tools in kali/Dockerfile apt install list.
• If you need angr, add its build deps and install inside the venv (longer build).

License

• MIT