# used for compile ubuntu 16.04 debugging pwn image
# author: roderick
# date: 2024-04-06

ARG BUILD_VERSION

FROM ubuntu:$BUILD_VERSION

ARG DEBIAN_FRONTEND=noninteractive
ARG HUB_DOMAIN=github.com
ARG NORMAL_USER_NAME=ctf

ENV TZ=Etc/UTC
ENV LANG=en_US.UTF-8
ENV LANGUAGE=en_US:en
ENV LC_ALL=en_US.UTF-8

WORKDIR /root

# install ruby 2.7
RUN apt-get update && apt-get -y dist-upgrade && apt-get install -y --fix-missing python3 python3-pip python3-dev lib32z1 \
xinetd curl gcc g++ gdbserver git libssl-dev libffi-dev build-essential tmux \
vim iputils-ping \
file net-tools socat locales autoconf automake libtool make wget && \
wget http://ftp.ruby-lang.org/pub/ruby/2.7/ruby-2.7.1.tar.gz && \
tar -xzvf ruby-2.7.1.tar.gz && \
cd ruby-2.7.1/ && \
./configure && \
make -j16 && \
make install -j16 && \
gem install one_gadget seccomp-tools && \
sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen && locale-gen

# install python 3.8
RUN apt-get install -y zlib1g-dev libbz2-dev libncurses5-dev libsqlite3-dev libreadline-dev tk-dev libgdbm-dev \
libdb-dev libpcap-dev xz-utils libexpat1-dev liblzma-dev libc6-dev && \
wget https://www.python.org/ftp/python/3.8.6/Python-3.8.6.tgz && \
tar -xzvf Python-3.8.6.tgz && \
cd Python-3.8.6 && \
./configure --enable-optimizations && \
make -j16 && make install -j16 && rm -rf /usr/bin/pip3 /usr/bin/python3 /usr/bin/python /usr/bin/pip && \
ln -s /usr/local/bin/python3.8 /usr/bin/python3 && \
ln -s /usr/local/bin/python3.8 /usr/bin/python && \
ln -s /usr/local/bin/pip3.8 /usr/bin/pip3 && \
ln -s /usr/local/bin/pip3.8 /usr/bin/pip

# install gdb manually
RUN apt-get install -y texinfo && \
wget https://ftp.gnu.org/gnu/gdb/gdb-10.2.tar.gz && \
tar -xzvf gdb-10.2.tar.gz && cd gdb-10.2 && ./configure --enable-targets=all && \
make -j16 && make install -j16


# 先执行容易失败的操作
RUN git clone https://${HUB_DOMAIN}/pwndbg/pwndbg && \
cd ./pwndbg && git checkout ubuntu18.04-final && \
./setup.sh && ./.venv/bin/pip3 install --upgrade --force-reinstall 'requests==2.6.0' urllib3 && \
pip3 install --upgrade --force-reinstall 'requests==2.6.0' urllib3

# install patchelf
RUN wget https://mirrors.tuna.tsinghua.edu.cn/ubuntu/pool/universe/p/patchelf/patchelf_0.9-1~ubuntu16.04.3_amd64.deb && \
dpkg -i patchelf_0.9-1~ubuntu16.04.3_amd64.deb

RUN git clone https://${HUB_DOMAIN}/hugsy/gef.git && \
git clone https://${HUB_DOMAIN}/RoderickChan/Pwngdb.git && \
git clone https://${HUB_DOMAIN}/Gallopsled/pwntools && \
pip3 install --upgrade --editable ./pwntools && \
git clone https://${HUB_DOMAIN}/RoderickChan/pwncli.git && \
pip3 install --upgrade --editable ./pwncli


COPY ./gdb-gef /bin
COPY ./gdb-pwndbg /bin
COPY ./update.sh /bin
COPY ./test-this-container.sh /bin
COPY ./heaptrace /bin
COPY ./.tmux.conf ./
COPY ./.gdbinit ./
COPY ./flag /
COPY ./flag /flag.txt

RUN chmod +x /bin/gdb-gef /bin/gdb-pwndbg /bin/update.sh /bin/test-this-container.sh /bin/heaptrace && \
echo "root:root" | chpasswd && \
pip3 install ropper capstone z3-solver qiling lief

# root user
RUN useradd ${NORMAL_USER_NAME} -d /home/${NORMAL_USER_NAME} -m -s /bin/bash -u 1001 && \
echo "${NORMAL_USER_NAME}:${NORMAL_USER_NAME}" | chpasswd && \
cp -r /root/pwndbg /home/${NORMAL_USER_NAME} && \
cp -r /root/gef /home/${NORMAL_USER_NAME} && \
cp -r /root/pwntools /home/${NORMAL_USER_NAME} && \
cp -r /root/Pwngdb /home/${NORMAL_USER_NAME} && \
cp -r /root/pwncli /home/${NORMAL_USER_NAME} && \
cp /root/.tmux.conf /home/${NORMAL_USER_NAME} && \
cp /root/.gdbinit /home/${NORMAL_USER_NAME} && \
cp /flag /home/${NORMAL_USER_NAME} && \
cp /flag.txt /home/${NORMAL_USER_NAME} && \
chown -R ${NORMAL_USER_NAME}:${NORMAL_USER_NAME} /home/${NORMAL_USER_NAME}

USER ${NORMAL_USER_NAME}:${NORMAL_USER_NAME}

WORKDIR /home/${NORMAL_USER_NAME}

RUN pip3 install --upgrade --editable ./pwntools && \
pip3 install --upgrade --editable ./pwncli && \
pip3 install --upgrade --force-reinstall 'requests==2.6.0' urllib3


# switch to root and install zsh
USER root:root
RUN apt-get install -y sudo zsh && usermod -s /bin/zsh ${NORMAL_USER_NAME} && \
echo "${NORMAL_USER_NAME} ALL=(ALL) NOPASSWD : ALL" | tee /etc/sudoers.d/${NORMAL_USER_NAME}sudo

# switch 2 normal user
USER ${NORMAL_USER_NAME}:${NORMAL_USER_NAME}
WORKDIR /home/${NORMAL_USER_NAME}


# install on-my-zsh
RUN curl -fsSL -O https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh && \
chmod +x ./install.sh && \
sed -i -e 's/read[[:space:]]*-r[[:space:]]*opt/opt=n/g' ./install.sh && \
./install.sh && \
git clone https://github.com/zsh-users/zsh-syntax-highlighting.git ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-syntax-highlighting && \
git clone https://github.com/zsh-users/zsh-autosuggestions ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-autosuggestions

COPY ./.zshrc ./

# expose some ports
EXPOSE 20 21 22 80 443 23946 10001 10002 10003 10004 10005

CMD ["/bin/update.sh"]

可以直接执行命令 sudo docker pull roderickchan/debug_pwn_env:16.04-2.23-0ubuntu11.3-20240412 下载镜像使用。

sudo docker run -it \
--name pwn16_env \
-v ~/Desktop/CTFshow_pwn:/CTFshow_pwn \
-p 23947:23947 \
--cap-add=SYS_PTRACE \
pwnenv_ubuntu16:16.04-2.23-0ubuntu11.3-20240412 \
/bin/zsh

user/password:

  1. root/root
  2. ctf/ctf

参考:在2024年如何成功搭建Ubuntu 16.04的pwn环境 | roderick - record and learn!