A comprehensive Docker-based penetration testing lab featuring vulnerable web applications, network services, and multiple exploitation paths across public and internal networks.

┌─────────────────────────────────────────────────────────────┐
│                      PUBLIC NETWORK                          │
│                     (172.20.0.0/24)                         │
│                                                              │
│  ┌──────────────────┐         ┌──────────────────┐         │
│  │   Web Server     │         │   FTP Server     │         │
│  │  Port: 8080      │         │   Port: 2121     │         │
│  │  - PHP App       │         │   - Anonymous    │         │
│  │  - 10+ Vulns     │         │   - Sensitive    │         │
│  │  - 3 RCE paths   │         │     Files        │         │
│  │  - Chisel        │         │                  │         │
│  │  - Nmap          │         │                  │         │
│  └────────┬─────────┘         └──────────────────┘         │
│           │                                                  │
└───────────┼──────────────────────────────────────────────────┘
            │ PIVOT REQUIRED
            │
┌───────────┼──────────────────────────────────────────────────┐
│           │         INTERNAL NETWORK                         │
│           │        (10.10.10.0/24)                          │
│           │                                                  │
│  ┌────────▼─────────┐  ┌──────────────┐  ┌──────────────┐ │
│  │  Internal-1      │  │ Internal-2   │  │ Internal-3   │ │
│  │  10.10.10.2      │  │ 10.10.10.3   │  │ 10.10.10.4   │ │
│  │  - Web (80)      │  │ - Web (80)   │  │ - Web (80)   │ │
│  │  - SSH (22)      │  │ - SMB (445)  │  │ - Tomcat     │ │
│  │  - SSH Key       │  │ - Weak Auth  │  │   (8080)     │ │
│  │    Exposed       │  │              │  │ - MySQL      │ │
│  │                  │  │              │  │ - ProFTPD    │ │
│  └──────────────────┘  └──────────────┘  └──────────────┘ │
│                                                              │
└──────────────────────────────────────────────────────────────┘

• Docker Engine 20.10+
• Docker Compose 1.29+
• At least 4GB RAM
• 10GB free disk space

cd /Users/user/Desktop/TechFlow

docker-compose up -d

docker-compose ps

You should see all 6 containers running:

• pentest-db - MySQL database
• pentest-web - Main vulnerable web server
• pentest-ftp - FTP server
• internal-web-ssh - Internal server 1
• internal-smb-web - Internal server 2
• internal-multi-service - Internal server 3

Public Web Server: http://localhost:8080
FTP Server: ftp localhost 2121 (anonymous access)

• Enumerate public services
• Identify vulnerabilities in the web application
• Gain initial access to the web server

• Exploit web vulnerabilities for RCE
• Extract sensitive information from FTP
• Establish persistence

• Use chisel or SSH tunneling to access internal network
• Scan internal network from compromised web server
• Map internal services

• Extract SSH key from internal-server-1
• Exploit SMB vulnerabilities on internal-server-2
• Exploit CVEs on internal-server-3
• Achieve root access on all internal servers

• Anonymous access enabled
• Sensitive files exposed
• Network information leaked

• SSH private key exposed in web application
• Root access via SSH key
• Network information disclosure

• SMB shares with weak authentication
• Null session enumeration
• Sensitive data in shares

• Tomcat 8.5.50 - CVE-2020-1938 (Ghostcat)
• ProFTPD 1.3.5 - CVE-2015-3306
• MySQL - Weak root password (toor)
• Tomcat Manager - Default credentials (admin:tomcat)

Access the web server container:

docker exec -it pentest-web /bin/bash

Available tools:

• chisel - Tunneling tool (/usr/local/bin/chisel)
• nmap - Network scanner
• ip - Network configuration
• netcat - Network utility
• curl/wget - HTTP clients
• python3 - Python interpreter for scripting and reverse shells

docker-compose up -d

docker-compose down

docker-compose down -v
docker-compose up -d

docker-compose logs -f [service-name]

docker exec -it [container-name] /bin/bash

docker exec -it pentest-web nmap -sn 10.10.10.0/24

• Web Server: 172.20.0.x
• FTP Server: 172.20.0.x
• Database: 172.20.0.x

• Internal Server 1: 10.10.10.2
• Internal Server 2: 10.10.10.3
• Internal Server 3: 10.10.10.4

1. SQL injection in login form
2. File upload vulnerability
3. FTP enumeration
4. Basic network scanning

1. Command injection
2. LFI to RCE via log poisoning
3. Chisel tunneling
4. SSH key extraction
5. SMB enumeration

1. SSRF exploitation
2. Multi-hop pivoting
3. CVE exploitation (Ghostcat, ProFTPD)
4. Custom exploit development
5. Full network compromise

CRITICAL: This lab contains intentionally vulnerable services.

• NEVER expose these containers to the internet
• ONLY run in isolated lab environments
• DO NOT use on production networks
• ALWAYS run behind a firewall
• FOR EDUCATIONAL PURPOSES ONLY

docker-compose down
docker-compose up -d --force-recreate

docker-compose restart db
docker-compose restart web-server

Edit docker-compose.yml and change the host ports:

ports:
  - "8080:80"  # Change 8080 to another port

Make sure you've compromised the web server first and are using it as a pivot point.

If you get "Permission denied" errors when uploading files:

1. Ensure you used ./start-lab.sh which pre-configures permissions.
2. Manually set permissions on the host:

   mkdir -p web-server/www/uploads
   chmod 777 web-server/www/uploads

3. Restart the containers: docker-compose restart web-server

• OWASP Top 10
• Chisel Documentation
• Metasploit Framework
• HackTricks

For progressive hints without spoilers, see HINTS.md

Throughout the lab, you'll find flags in the format: FLAG{description}

Collect all flags to complete the lab!

This lab is provided for educational purposes only. Use responsibly.

Found a bug or want to add more vulnerabilities? Feel free to contribute!

Happy Hacking! 🎉