docker-compose.lab.yml

# Exploit Lab - Contained environment for real tool execution
#
# All services run on an isolated Docker network with NO external gateway.
# Nothing can reach the internet. All C2 traffic stays within this network.
#
# Usage:
#   make lab-up      # Start the lab
#   make lab-down    # Destroy everything
#   make lab-status  # Show running services
#   make lab-logs    # Tail all logs
#
# Or directly:
#   docker compose -f docker-compose.lab.yml up -d
#   docker compose -f docker-compose.lab.yml down -v

services:

  # ── C2 Server ──────────────────────────────────────────────────────────
  # Flask-based C2 with analytics-style protocol.
  # Operator API on port 8443 (mapped to host localhost:8443).
  c2-server:
    build:
      context: .
      dockerfile: infra/docker/Dockerfile.c2-server
    container_name: lab-c2-server
    hostname: c2-server
    environment:
      - EXPLOIT_LAB_ACTIVE=1
    ports:
      - "127.0.0.1:8443:8443"   # Operator API - loopback only
    networks:
      - lab-internal
      - lab-bridge
    restart: unless-stopped

  # ── Mock OAuth Server ──────────────────────────────────────────────────
  # Simulates Azure AD OAuth endpoints for the OBO token exchange demo.
  mock-oauth:
    build:
      context: .
      dockerfile: infra/docker/Dockerfile.mock-oauth
    container_name: lab-mock-oauth
    hostname: login.microsoftonline.com
    ports:
      - "127.0.0.1:8090:8090"   # OAuth mock - loopback only
    networks:
      - lab-internal
      - lab-bridge
    restart: unless-stopped

  # ── Mock Graph API ─────────────────────────────────────────────────────
  # Simulates Microsoft Graph API for the graph channel beacon.
  # Beacons configured with --channel graph use this as their C2 transport.
  mock-graph:
    build:
      context: .
      dockerfile: infra/docker/Dockerfile.mock-graph
    container_name: lab-mock-graph
    hostname: graph.microsoft.com
    environment:
      - C2_URL=http://c2-server:8443
    ports:
      - "127.0.0.1:8080:8080"   # Graph API mock - loopback only
    depends_on:
      - c2-server
    networks:
      - lab-internal
      - lab-bridge
    restart: unless-stopped

  # ── Mock Slack API ─────────────────────────────────────────────────────
  # Simulates Slack API for the webhook channel beacon.
  # Beacons configured with --channel webhook use this as their C2 transport.
  mock-slack:
    build:
      context: .
      dockerfile: infra/docker/Dockerfile.mock-slack
    container_name: lab-mock-slack
    hostname: slack.com
    environment:
      - C2_URL=http://c2-server:8443
    ports:
      - "127.0.0.1:8082:8081"   # Slack API mock - loopback only
    depends_on:
      - c2-server
    networks:
      - lab-internal
      - lab-bridge
    restart: unless-stopped

  # ── Beacon 1 ───────────────────────────────────────────────────────────
  # Beacon client with gaussian jitter, registering with C2.
  beacon-1:
    build:
      context: .
      dockerfile: infra/docker/Dockerfile.beacon
    container_name: lab-beacon-1
    hostname: workstation-1
    environment:
      - EXPLOIT_LAB_ACTIVE=1
      - USER=analyst.jones
    depends_on:
      - c2-server
    networks:
      - lab-internal
    restart: unless-stopped

  # ── Beacon 2 ───────────────────────────────────────────────────────────
  # Second beacon with different jitter profile for comparison.
  beacon-2:
    build:
      context: .
      dockerfile: infra/docker/Dockerfile.beacon
    container_name: lab-beacon-2
    hostname: workstation-2
    environment:
      - EXPLOIT_LAB_ACTIVE=1
      - USER=admin.smith
    command: >
      python3 tools/c2/beacon/beacon_client.py
      --server http://c2-server:8443
      --interval 8 --jitter exponential --jitter-factor 0.3
    depends_on:
      - c2-server
    networks:
      - lab-internal
    restart: unless-stopped

  # ── Exploit Server ─────────────────────────────────────────────────
  # Serves CVE exploit HTML files to target browsers.
  # Provides callback endpoint and integrates with C2 for sessions.
  exploit-server:
    build:
      context: .
      dockerfile: infra/docker/Dockerfile.exploit-server
    container_name: lab-exploit-server
    hostname: exploit-server
    environment:
      - EXPLOIT_LAB_ACTIVE=1
    command: >
      python3 tools/framework/exploit_server.py
      --host 0.0.0.0 --port 9090
      --c2 http://c2-server:8443
    ports:
      - "127.0.0.1:9090:9090"   # Exploit server - loopback only
    depends_on:
      - c2-server
    networks:
      - lab-internal
      - lab-bridge
    restart: unless-stopped

  # ── Target App 1 ──────────────────────────────────────────────────────
  # Simulated Databricks Streamlit app.
  target-app-1:
    build:
      context: .
      dockerfile: infra/docker/Dockerfile.target-app
    container_name: lab-target-app-1
    hostname: databricks-app-1
    environment:
      - EXPLOIT_LAB_ACTIVE=1
      - USER=app-owner
    ports:
      - "127.0.0.1:8501:8501"   # Streamlit UI - loopback only
    networks:
      - lab-internal
      - lab-bridge
    restart: unless-stopped

  # ── Target App 2 ──────────────────────────────────────────────────────
  # Second Streamlit app for lateral movement demonstration.
  target-app-2:
    build:
      context: .
      dockerfile: infra/docker/Dockerfile.target-app
    container_name: lab-target-app-2
    hostname: databricks-app-2
    environment:
      - EXPLOIT_LAB_ACTIVE=1
      - USER=data-engineer
    ports:
      - "127.0.0.1:8502:8501"   # Mapped to different host port
    networks:
      - lab-internal
      - lab-bridge
    restart: unless-stopped

  # ── Mock Entra IdP ────────────────────────────────────────────────────────
  # RFC 8628 device-code flow, PRT SSO, Conditional Access enforcement.
  # Used by tools/entra-abuse/ — lab tenant gated; production aliases blocked.
  mock-entra:
    build:
      context: .
      dockerfile: infra/docker/Dockerfile.mock-entra
    container_name: lab-mock-entra
    hostname: login.microsoftonline.lab
    environment:
      - EXPLOIT_LAB_ACTIVE=1
      - MOCK_ENTRA_SECRET=${MOCK_ENTRA_SECRET:-lab-secret-change-me}
      - ENTRA_LAB_TENANT_ID=${ENTRA_LAB_TENANT_ID:-00000000-lab-tenant-id0-000000000000}
      - REQUIRE_DEVICE_COMPLIANCE=${REQUIRE_DEVICE_COMPLIANCE:-0}
      - FIXTURE_DIR=/app/fixtures
    ports:
      - "127.0.0.1:9100:9100"   # Entra IdP mock - loopback only
    networks:
      - lab-internal
      - lab-bridge
    restart: unless-stopped

  # ── Mock IMDS ─────────────────────────────────────────────────────────────
  # Responds to AWS/GCP/Azure metadata paths with fixture credentials.
  # K8s post-ex module calls assert_imds_is_mock() before every request.
  mock-imds:
    build:
      context: .
      dockerfile: infra/docker/Dockerfile.mock-imds
    container_name: lab-mock-imds
    hostname: mock-imds
    environment:
      - IMDS_ROLE=lab-instance-role
      - IMDS_ACCOUNT_ID=123456789012
      - IMDS_INSTANCE_ID=i-0abc123def456789a
      - IMDS_GCP_PROJECT=lab-project-123456
      - IMDS_AZURE_SUBSCRIPTION=00000000-0000-0000-0000-000000000001
      - IMDS_AZURE_RG=lab-resource-group
    ports:
      - "127.0.0.1:9200:9200"   # IMDS mock - loopback only
    networks:
      - lab-internal
      - lab-bridge
    restart: unless-stopped

  # ── Mock SCCM ─────────────────────────────────────────────────────────────────
  # Simulates SCCM/MECM site server for MisconfigurationManager-style attacks.
  # Used by tools/lateral-movement/sccm-abuse/ — lab domain gated.
  mock-sccm:
    build:
      context: infra/lab/mock-sccm
      dockerfile: Dockerfile
    container_name: lab-mock-sccm
    hostname: sccm.corp.lab.local
    environment:
      - EXPLOIT_LAB_ACTIVE=1
    ports:
      - "127.0.0.1:9600:9600"   # Mock SCCM API - loopback only
    networks:
      - lab-internal
      - lab-bridge
    restart: unless-stopped

  # ── Vulnerable Lab App (XSS delivery demo) ────────────────────────────────
  # Intentionally vulnerable Flask app for WASM/XSS delivery vector demo.
  # Used by tools/browser-native-postex/delivery/via_xss/
  vulnerable-lab-app:
    build:
      context: .
      dockerfile: infra/lab/vulnerable-lab-app/Dockerfile
    container_name: lab-vulnerable-app
    hostname: vulnerable-app
    environment:
      - EXPLOIT_LAB_ACTIVE=1
    ports:
      - "127.0.0.1:8503:8503"   # Vulnerable app - loopback only
    networks:
      - lab-internal
      - lab-bridge
    restart: unless-stopped

networks:
  # Internal-only network — no external gateway. Inter-service traffic only.
  # Beacons attach to this only so they cannot egress.
  lab-internal:
    driver: bridge
    internal: true

  # Bridge network for services that publish host ports (operator API, mocks,
  # target apps). `internal: false` is required for docker port publication
  # to work. ContainmentGuard still enforces RFC1918/loopback at the tool
  # layer, so reachable-from-host does not mean reachable-from-internet for
  # the tools themselves.
  lab-bridge:
    driver: bridge