setup-optimized.sh

#!/bin/bash

# Pentesting Lab Setup Script - Optimized for Pre-Downloaded Images

echo "================================"
echo "Pentesting Lab Setup (Optimized)"
echo "================================"
echo ""

# Create directory structure
echo "[*] Creating directory structure..."
mkdir -p {findings,payloads,tools,logs,reports,volumes}
mkdir -p logs/{controller,web-target-1,privesc-1,windows-target,dvwa,empire}
mkdir -p volumes/{web-target-1,privesc-1,windows-target,empire}
mkdir -p tools/{custom-scripts,reports}
mkdir -p payloads/{exploit,shellcode,wordlist}

echo "[✓] Directories created"
echo ""

# Create findings tracker
cat > findings/FINDINGS.md << 'EOF'
# Pentesting Lab Findings

## Lab Overview
- **Lab Name**: Docker Pentesting Lab (Pre-downloaded Images)
- **Setup Date**: $(date)
- **Attack Platform**: certainityoffsec/linwinpwn
- **Objective**: Practice pentesting techniques on vulnerable targets

## Network Map
```
172.20.0.0/16 - Pentest Lab Network
├── 172.20.0.x  - Controller (linwinpwn)
├── 172.20.0.20 - Web Target 1 (linwinpwn + services)
├── 172.20.0.21 - PrivEsc Target (linwinpwn)
├── 172.20.0.30 - Windows Target (linwinpwn SMB sim)
├── 172.20.0.40 - DVWA (web vulnerabilities)
└── 172.20.0.50 - Empire C2 (post-exploitation)
```

## Targets Inventory

### Target 1: Web Target 1 (172.20.0.20)
- **Status**: [ ] Not tested
- **Services**: SSH (22), HTTP (80/443), MySQL (3306)
- **Access**: ssh root@172.20.0.20 (port 2221 externally)
- **Findings**: TBD
- **Evidence**: See logs/web-target-1/

### Target 2: Privilege Escalation (172.20.0.21)
- **Status**: [ ] Not tested
- **Services**: SSH (22), HTTP (80)
- **Access**: ssh root@172.20.0.21 (port 2222 externally)
- **Findings**: TBD
- **Evidence**: See logs/privesc-1/

### Target 3: Windows Target (172.20.0.30)
- **Status**: [ ] Not tested
- **Services**: SMB (445), RDP (3389), WinRM (5985), HTTP (8080)
- **Findings**: TBD
- **Evidence**: See logs/windows-target/

### Target 4: DVWA (172.20.0.40)
- **Status**: [ ] Not tested
- **Services**: HTTP (80)
- **Access**: http://172.20.0.40 or http://localhost:8084
- **Credentials**: admin/password
- **Findings**: TBD
- **Evidence**: See logs/dvwa/

### Target 5: Empire C2 (172.20.0.50)
- **Status**: [ ] Not tested
- **Services**: Empire listener (1337)
- **Purpose**: Post-exploitation command & control
- **Evidence**: See logs/empire/

## Exploitation Timeline

| Date | Target | Vulnerability | Status | Notes |
|------|--------|----------------|--------|-------|
| | | | | |

## Successful Exploits

### [Target] - [Vulnerability]
- **Severity**: High/Medium/Low
- **Type**: RCE/Privesc/Lateral Movement/etc
- **Proof of Concept**: 
  - Command: 
  - Output: 
- **Impact**: 
- **Payload Location**: /root/payloads/exploit/

## Credentials Discovered

| Target | Username | Password | Use Case |
|--------|----------|----------|----------|
| | | | |

## Tools Used

- [ ] nmap
- [ ] metasploit
- [ ] sqlmap
- [ ] burp
- [ ] john
- [ ] hashcat
- [ ] linpeas
- [ ] Custom scripts

## Post-Exploitation

### Lateral Movement
- TBD

### Privilege Escalation
- TBD

### Data Exfiltration
- TBD

## Recommendations

### Immediate Fixes
1. TBD

### Long-term Hardening
1. TBD

## Lessons Learned

1. TBD

---

**Lab Duration**: Start: [date] | End: [date] | Total Time: [hours]

EOF

echo "[✓] Findings template created"
echo ""

# Create payload README
cat > payloads/README.md << 'EOF'
# Payloads Directory

## Structure
- **exploit/** - Successful exploit code and scripts
- **shellcode/** - Reverse shells and shellcode
- **wordlist/** - Custom wordlists for brute forcing

## Usage
Place your payloads here for easy access from the controller container.

All payloads are mounted at: /root/payloads

## Example Organization:
```
/root/payloads/exploit/web-rce-exploit.py
/root/payloads/exploit/privilege-escalation.sh
/root/payloads/shellcode/reverse-bash.sh
/root/payloads/wordlist/custom-users.txt
/root/payloads/wordlist/custom-passwords.txt
```

## Sharing Between Containers
All containers can access payloads via the shared volume.

Copy from host to payloads:
```bash
cp my_exploit.py payloads/exploit/
```

Access from any container:
```bash
/root/payloads/exploit/my_exploit.py
```

EOF

echo "[✓] Payloads structure created"
echo ""

# Create tools README
cat > tools/README.md << 'EOF'
# Tools Directory

Custom pentesting tools and scripts for this lab.

## Structure
- **custom-scripts/** - Your custom Python/Bash scripts
- **reports/** - Report generation templates

## Creating Custom Tools

Create a script and save it here:
```bash
echo '#!/bin/bash' > tools/custom-scripts/my-scanner.sh
chmod +x tools/custom-scripts/my-scanner.sh
```

Access from controller:
```bash
/root/tools/custom-scripts/my-scanner.sh
```

## Report Templates

Use for documenting findings:
```
tools/reports/pentest-report-template.md
tools/reports/vulnerability-template.md
```

EOF

echo "[✓] Tools structure created"
echo ""

# Create quick reference
cat > QUICK-REFERENCE.md << 'EOF'
# Quick Reference - Pre-Downloaded Images Setup

## Start the Lab

```bash
# Use optimized compose file (no building needed)
docker-compose -f docker-compose-optimized.yml up -d

# Or rename it first
cp docker-compose-optimized.yml docker-compose.yml
docker-compose up -d

# Verify it's running
docker-compose ps
```

## Access Services

```bash
# Attack controller (all pentesting tools)
docker-compose exec controller bash

# Web target 1
docker-compose exec web-target-1 bash

# Privilege escalation target
docker-compose exec privilege-escalation-1 bash

# Windows target simulation
docker-compose exec windows-target bash

# DVWA web app
docker-compose exec dvwa bash

# Empire C2
docker-compose exec empire-c2 bash
```

## Quick Scans

```bash
# From controller
nmap -sV -p- 172.20.0.0/24          # Full network scan
nmap -sV 172.20.0.20                 # Web target scan
nmap -sV 172.20.0.21                 # PrivEsc target scan
nmap -sV 172.20.0.30                 # Windows target scan
```

## Access Targets via SSH

```bash
# From controller (or host machine)
ssh root@172.20.0.20 -p 22           # Web target (internal)
ssh root@172.20.0.20 -p 2221         # Web target (external)
ssh root@172.20.0.21 -p 2222         # PrivEsc target
```

## Web Application Testing

```bash
# DVWA
curl http://172.20.0.40/
# Login: admin/password

# Or from host (port mapped)
http://localhost:8084
```

## Empire C2 Server

```bash
# Access Empire
docker-compose exec empire-c2 bash

# Start Empire
cd /empire
python empire.py

# Or use the web interface if available
https://localhost:1337
```

## Metasploit in Controller

```bash
docker-compose exec controller bash
msfconsole

# Example: Eternal Blue exploit
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 172.20.0.30
set LHOST 172.20.0.x
exploit
```

## Documentation

- **README-OPTIMIZED.md** - Full guide for this setup
- **ATTACK-GUIDE.md** - Target-specific exploitation techniques
- **INDEX.md** - Navigation guide

## Your Downloaded Images

```
certainityoffsec/linwinpwn:latest     # 7.07GB - Main attack & target image
bcsecurity/empire:latest              # 4.05GB - C2 server (optional)
linuxserver/webtop:debian-kde         # 6.04GB - Desktop GUI (optional)
```

## Advantages of Pre-Downloaded Images

✅ No Docker builds (instant startup)
✅ All tools pre-installed in linwinpwn
✅ Can use same image for attacker and targets
✅ Reduced disk footprint (shared layers)
✅ Ready-to-use professional tools

## Lab Ports

| Service | Internal | External | Type |
|---------|----------|----------|------|
| Controller | - | - | Shell |
| Web Target 1 SSH | 22 | 2221 | SSH |
| Web Target 1 HTTP | 80 | 8081 | HTTP |
| Web Target 1 HTTPS | 443 | 8082 | HTTPS |
| PrivEsc Target SSH | 22 | 2222 | SSH |
| DVWA | 80 | 8084 | HTTP |
| Empire | 1337 | 1337 | Service |

## Common Workflows

### Quick Attack
```bash
docker-compose up -d
docker-compose exec controller bash
nmap -sV 172.20.0.0/24
# (choose target and attack)
```

### Privilege Escalation Practice
```bash
ssh root@172.20.0.21 -p 2222
linpeas.sh
pspy64
# (practice local exploitation)
```

### Web Application Testing
```bash
curl http://172.20.0.40
sqlmap -u "http://172.20.0.40/vulnerabilities/sqli/?id=1" --dbs
# (test OWASP Top 10)
```

### Post-Exploitation
```bash
docker-compose exec controller bash
msfconsole
# (generate payloads, establish sessions)
```

## Stop & Cleanup

```bash
# Stop containers (keep data)
docker-compose down

# Remove containers and volumes (full reset)
docker-compose down -v

# View remaining images
docker images
```

## Troubleshooting

```bash
# Check container status
docker-compose ps

# View container logs
docker-compose logs web-target-1

# Access container terminal
docker-compose exec web-target-1 bash

# Restart service
docker-compose restart web-target-1

# Rebuild (won't rebuild images, just restart)
docker-compose up -d
```

---

**Ready? Start with:**
```bash
cp docker-compose-optimized.yml docker-compose.yml
docker-compose up -d
docker-compose exec controller bash
nmap -sV 172.20.0.0/24
```

EOF

echo "[✓] Quick reference created"
echo ""

# Create diagnostics shortcut
cat > RUN-DIAGNOSTICS.txt << 'EOF'
To check if the lab is healthy:

bash diagnostics.sh

This will verify:
- Container status
- Network connectivity
- Port availability
- Service reachability
EOF

echo "[✓] Setup complete!"
echo ""
echo "================================"
echo "Next Steps:"
echo "================================"
echo ""
echo "1. Use the optimized compose file:"
echo "   cp docker-compose-optimized.yml docker-compose.yml"
echo ""
echo "2. Start the lab:"
echo "   docker-compose up -d"
echo ""
echo "3. Verify it's running:"
echo "   docker-compose ps"
echo ""
echo "4. Access the controller:"
echo "   docker-compose exec controller bash"
echo ""
echo "5. Run a network scan:"
echo "   nmap -sV 172.20.0.0/24"
echo ""
echo "================================"
echo "Documentation:"
echo "================================"
echo "- README-OPTIMIZED.md      - Full guide"
echo "- QUICK-REFERENCE.md       - Common commands"
echo "- ATTACK-GUIDE.md          - Exploitation techniques"
echo "- INDEX.md                 - File navigation"
echo ""
echo "================================"
echo "Directories created:"
echo "================================"
echo "- findings/                - Track all discoveries"
echo "- payloads/                - Store successful exploits"
echo "- tools/                   - Custom scripts"
echo "- logs/                    - Container activity logs"
echo "- reports/                 - Final documentation"
echo "- volumes/                 - Persistent container data"
echo ""