centos7 installs docker and docker-compose and builds vulhub and vulfoucs

Foreword;

My centos7 only has yum but no apt-get. At first, I used yum to download the docker stuff and found that it couldn’t be downloaded. I didn’t know why, so I gave up and planned to build docker on kali. However, the vulfocus built on 2021 kali couldn’t start for some reason. I also gave it 4g. The running memory still cannot be moved, and then I really don’t want to build vulhub on Kali of my local computer and there is really no space, so I still build the shooting range on centos7.

Note that this article uses centos7 virtual machine to build

Note that it is best to read this article first and then follow the construction. Some of my steps did not follow the steps given first, but I encountered problems and solved them.

Install docker and docker-compose

Before starting, allocate enough memory and disk space to the virtual machine, otherwise problems or lag may occur.

First update the yum source

Reference article: How to replace yum source in CentOS – Python Technology Station

sudo su
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
yum clean all
yum makecache
yum update (change the source quickly)
#huaweiyuan
# wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.huaweicloud.com/repository/conf/CentOS-7-extras.repo

#neteasesource
# wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.163.com/.help/CentOS7-Base-163.repo

I originally wanted to install apt-get, but then I found out that centos does not allow the installation of apt-get. I asked why I couldn’t install it and kept getting errors (there is a full version of GPT below with a more complete and better writing process)

Installing Docker on CentOS can be done through the yum package manager. Here are the steps to install Docker on CentOS:

1. Open a terminal or SSH to connect to the CentOS server.

2. Log in to the system as the root user.

3. Run the following command to install the necessary tools and dependencies:

   ```
   yum install -y yum-utils device-mapper-persistent-data lvm2
   ```

4. Configure Docker’s stable repository. Run the following command:

   ```
   yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
   ```

5. Update the yum package index:

   ```
   yum makecache fast
   ```

6. Install Docker:

   ```
   yum install -y docker-ce
   ```

7. Start the Docker service:

   ```
   systemctl start docker
   ```

8. Verify that Docker is successfully installed and running:

   ```
   docker version
   ```

   If the installation is successful, the version information of Docker will be displayed.

9. To enable non-root users to run Docker commands, you can add them to the docker user group. Run the following command to add the user to the docker group. Replace `username` with your actual username:

   ```
   usermod -aG docker username
   ```

10. Exit the current session and log in again for the user group changes to take effect.

Now, you have successfully installed and configured Docker on CentOS. You can use the `docker` command to manage and run containers.

I have to say that artificial intelligence is indeed a lot of tricks (basic docker and docker-compose can be installed and built with vulhub using the following commands, but it is recommended not to follow it directly first to read the questions I encountered before starting to build it, such as Modifying the source later will speed up the downloading of some shooting ranges)

Full version:

To download and install Docker and Docker Compose on CentOS, and to use Docker Compose to build a Vulhub shooting range, follow the steps below:

1. First, update your system and install the necessary packages:
```
sudo yum update
sudo yum install -y yum-utils device-mapper-persistent-data lvm2
```

2. Add Docker’s official GPG key:
```
sudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
```

3. Install Docker engine:
```
sudo yum install docker-ce docker-ce-cli containerd.io
```

4. Start Docker and set it to start automatically at boot:
```
sudo systemctl start docker
sudo systemctl enable docker
```

5. Check whether Docker is installed successfully:
```
docker --version
```

6. Install Docker Compose:
```
sudo curl -L "https://github.com/docker/compose/releases/download/1.27.4/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/ bin/docker-compose
```

7. Add execution permissions:
```
sudo chmod +x /usr/local/bin/docker-compose
```

8. Check whether Docker Compose is installed successfully:
```
docker-compose --version (The failure here may be because you did not add the environment variable to use ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose)
```

9. Get the Vulhub project source code:
```
git clone https://github.com/vulhub/vulhub.git (if git is not available, go to the official website and download the compressed package and drag it in)
```

10. Enter the vulhub directory:
```
cd vulhub
```

11. Build and start the Vulhub range using Docker Compose:
```
sudo docker-compose up -d
```

The above command will download the images required by the Vulhub range and start the related containers.

You can now access the Vulhub Range via your browser.

Please note that the entire process may take some time to download and install the required packages and images. During the execution of the command, please ensure that your network connection is normal and wait patiently.

Hope these steps help you! If you have any questions, please feel free to ask.

If you can’t git to the vulhub package, just go directly to the official website to download it to circumvent the firewall.

GitHub – vulhub/vulhub: Pre-Built Vulnerable Environments Based on Docker-Compose

Directly download the compressed package (I can’t drag it into the virtual machine here. Later I used finalshell to give 777 permissions to my /home/vanihs folder and then uploaded it. I guess there is no permission) (the one I uploaded with finalshell before is missing. I did something to get it done, and this time I did give permission to drag it in directly)

Some commonly used docker commands

View docker information:

# Check docker version
docker version
# Display docker system information
docker info
# Log information
docker logs
# Troubleshooting
service docker status
# Start and shut down docker
sudo service docker start|stop

View container information:

# View currently running containers
docker ps
# View all containers
docker ps -a
# View the IDs and information of all containers
docker ps -a -q
# View the space occupied by all containers
docker ps -as
# View a running container process, supports ps command parameters
docker top
# View the sample id of the container
sudo docker inspect -f '{<!-- -->{.Id}}' [id]
# Check the parameters of the image or container, and return JSON format by default
docker inspect
# Return the docker version of the ubuntu:14.04 image
docker inspect --format '{<!-- -->{.DockerVersion}}' ubuntu:14.04
docker inspect --format='{<!-- -->{range .NetworkSettings.Networks}}{<!-- -->{.IPAddress}}{<!-- -->{end}}' ubuntu :14.04

Container operation command (it should be noted here that image and container have two different meanings. We usually download the image online and use docker create to create a container based on the downloaded image. Like our virtual machine, we use the same image file. You can create multiple virtual machines, so we can also use image to create multiple containers distinguished by different IDs)

Create a delete container:

# Create a container named test and use the image daocloud.io/library/ubuntu
docker create -it --name test daocloud.io/library/ubuntu
# Create and start a container named test using the image daocloud.io/library/ubuntu
docker run --name test daocloud.io/library/ubuntu
# Delete a container
docker rm [container id]
# Delete all containers
docker rm `docker ps -a -q`
#Build based on Dockerfile
docker build -t [image_name] [Dockerfile_path]

Start and stop containers and other operations:

docker start|stop|restart [id]
# Pause|Resume all processes of a container
docker pause|unpause [id]
# Kill one or more specified container processes
docker kill -s KILL [id]
# Stop all running containers
docker stop `docker ps -q`
# Kill all running containers
docker kill -s KILL `docker ps -q`

Local mirror:

# List all local images
docker images
# All images with local image name ubuntu
docker images ubuntu
# View the creation history of the specified image
docker history [id]
# Remove one or more specified images locally
docker rmi
# Remove all local images
docker rmi `docker images -a -q`
# Save the specified image as a tar archive file, the reverse operation of docker load
docker save
# Save the image ubuntu:14.04 as ubuntu14.04.tar file
docker save -o ubuntu14.04.tar ubuntu:14.04
# Load the image from the tar image archive, the reverse operation of docker save
docker load
# The above command means to load the ubuntu14.04.tar file into the image
docker load -i ubuntu14.04.tar
docker load < /home/save.tar
# Build your own image
docker build -t <image name> <Dockerfile path>
docker build -t xx/gitlab .

Being familiar with some operations will make the process of setting up a shooting range much easier.

Only some common commands are listed above

For more commands, please refer to this article

Docker common commands and operations – Jianshu

Testing to reproduce hadoop vulnerabilities (there is also a shooting range construction process below to test whether the construction is successful)

#It’s a bit long to download. Please wait.

Some may need to be compiled first (vulnerability range to compile (this step is optional)

docker-compose build

Run a vulnerability range

docker-compose up -d (d means hanging in the background)

After we execute docker-compose up -d, do not leave the current directory. After the vulnerability test is completed, execute the following command to remove the environment:

docker-compose down

OK, the shooting range was successfully started. However, I used the host to add the port through IP and could not access it. However, the browser on the shooting range was successful, indicating that there was no problem with the shooting range.

I feel that if the virtual machine has a good card, I can allocate more memory to the virtual machine.

I suspect the problem is the firewall. We are installing it on a local shooting range. We can turn off the firewall directly without worrying about security (I am using centos7 here).

The method to turn off CentOS7’s firewall is as follows:

Enter the command "systemctl status firewalld.service" on the command line interface and press Enter to check the status of the firewall.
If "active (running)" appears below, it means the firewall has been turned on.
Enter the "systemctl stop firewalld.service" command on the command line to turn off the firewall.
Then use the command "systemctl status firewalld.service" and "inactive (dead)" appears below, indicating that the firewall has been turned off.
Finally, enter the "systemctl disable firewalld.service" command on the command line to permanently turn off the firewall.

It really worked

It’s better to modify the docker source, otherwise the download will be really slow.

Modify the source of docker and the source of docker-compose

To switch the sources of Docker and Docker Compose to Chinese domestic images, you can follow the steps below:

  1. Log in to the CentOS 7 server and open a terminal.
  2. First, back up your existing Docker and Docker Compose configuration files so you can restore the default settings if something goes wrong. 
    sudo cp /etc/docker/daemon.json /etc/docker/daemon.json.bak (I don’t have this file, so I can create it myself)
sudo cp /usr/local/bin/docker-compose /usr/local/bin/docker-compose.bak
  3. Modify the Docker configuration file vi daemon.json
sudo vi /etc/docker/daemon.json
  1. Add the following content to the file:
#This is to add this file if it already exists
{
  "registry-mirrors": ["https://dockerhub.azk8s.cn"]
}

If you don’t have this, add the following
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  },
  "registry-mirrors": [
    "https://registry.docker-cn.com",
    "https://docker.mirrors.ustc.edu.cn"
  ]
}
#log-driver: Specify the log output driver of the Docker container as json-file.
#log-opts: Specify log driver options and set the maximum size and number of log files.
#registry-mirrors: Specifies the mirror warehouse address used for mirror acceleration. This example uses two mirror warehouse addresses commonly used in China, namely https://registry.docker-cn.com and https://docker.mirrors.ustc.edu.cn.

Save and close the file.

  1. Restart the Docker service to make the new configuration take effect. (No need to restart if docker is not enabled)
sudo systemctl restart docker
  1. Modify the source of Docker Compose and replace the default foreign source with the domestic source in China.
sudo sed -i 's/https:\/\/github.com/https:\/\/hub.fastgit.org/g' /usr/local/bin/docker-compose
  1. Modify the source of Docker Compose and replace the default foreign source with the domestic source in China.
sudo sed -i 's/https:\/\/github.com/https:\/\/hub.fastgit.org/g' /usr/local/bin/docker-compose
  1. Verify that the changes have taken effect. Run the following command to check whether the Docker image source is correct:
docker info

In the output shown, there should be a section called Registry Mirrors, which lists mirror sources within China.

The above is a way to change the configuration file of the Docker daemon.

There is another way to use the domestic Docker image accelerator (I will use this later, see below)

Same as before in deamon edit file
registry-mirrors
#You have to register on the website yourself
Alibaba Cloud Accelerator:
https://[Alibaba Cloud Accelerator Address]
DaoCloud accelerator:
https://[DaoCloud accelerator address]
NetEase Hive Accelerator:
https://[NetEase Hive Accelerator Address]
Please replace it accordingly according to the address provided by the accelerator you choose. You can choose one of these accelerators, or use multiple accelerators to increase download speed and stability.

OK, done. An error was reported in the last step. It turned out that the network card was not activated. It scared me to death.

It’s also much faster than before, okay, it’s great

Continue installing vulfocus from yesterday

The first problem I encountered was that I couldn’t use git clone to clone the source file. After all, the target machine didn’t have a ladder. I could only download the zip file and drag it in. As a result, the file I dragged in directly was incomplete. I uploaded it using finxshell and it worked. Then I started it. docker (service docker start), but I seem to have clearly set it to start automatically at boot, and then use docker-compose up -d in the vulfocus directory (master comes down). You can also download it at this time, but it is a bit slow. Finally, directly The download failed due to poor network quality. . . . . . I’m thinking about getting some kind of accelerator.

What I use here is Alibaba Cloud’s accelerator, and there are several other accelerators.

To obtain the Alibaba Cloud Image Accelerator address, you can follow the following steps:

1. Open the official website of Alibaba Cloud Container Image Service: https://cr.console.aliyun.com.

2. Log in with your Alibaba Cloud account or register a new account.

3. In the Alibaba Cloud Container Image Service console, select "Image Accelerator" in the left menu.

4. In the Image Accelerator page, you will find a list of accelerator addresses. Choose the accelerator address closest to your area.

5. Copy the selected accelerator address. You can execute the following command in the terminal to configure the Docker image accelerator:
   ```
   echo '{"registry-mirrors": ["https://<accelerator address>"]}' | sudo tee /etc/docker/daemon.json
   sudo systemctl restart docker
   ```

The URL or interface layout in the above steps may change as the Alibaba Cloud service interface is updated. If you have any questions, it is recommended to consult the documentation of Alibaba Cloud Image Service or seek official support from Alibaba Cloud.

OK, you can also get my address directly (it should be different for everyone, it will be based on your physical address)

Then modify vi /etc/docker/daemon.json

add in

Sure enough, it took off so fast, hahahaha, it took off in just a few seconds.

Then directly access the IP address and port of the virtual machine. In my case, it is 192.168.1.197:80. Because I modified the firewall before, I can also access it using the host browser, as long as it is in the same LAN (the default login account and password are admin admin)

. . . I am really convinced that some shooting ranges do not use docker-compose to download the image to start. . . . . But most of them are still ok, but it doesn’t matter. The resources on vulhub and vulfocus are similar. There is no use here, and vulfocus has an online shooting range. . . . .

You can also see the downloaded image here (the newly downloaded cve_2020_13925, and the 3g one was downloaded not long after)

Launching the shooting range on the website is also successful and accessing the port of the target drone is successful, so you can attack.

In addition, when closing the shooting range environment, the vulfocus website is closed. Using docker-compose down in this directory will not close the open shooting range. You still need to check it with ps -a and then stop it.

Summarize:

Directly using docker to build this vulfocus is also a method. I have tried it before, which is to refer to the article [Network Security—vulfocus] on my kali2021 to install vulfocus tutorial_vulfocus installation_network security_Aini’s blog-CSDN blog final result I don’t know why the shooting range can’t start up. I’ve allocated all the memory and disks but it can’t start up. I’m so pissed off. . . . . .

Everything is done now. I haven’t used these shooting ranges for actual combat yet, so I don’t know if anything will go wrong. I will write it down below when I encounter any problems. It also took me a few days to build this shooting range. This is my first time building related knowledge, and I have learned a lot. OK, I can start shooting at the shooting range tomorrow. Good, what I have been putting off for a long time is finally solved, hahaha (Finally, thank you to chatgpt. Without it, it would be very troublesome to complete this task)