hexcowboy / saloon

A pentest environment for the wild west

Saloon

Saloon is a hacking environment that is rapidly available in the Docker cloud. Compared to the estimated 30 minute setup with Kali or Parrot, Saloon takes roughly 5 minutes to install.

🚀 Installation

Install from PyPI

pipx install saloon

🧨 Running Saloon

Once the container image is built, you can attach to Saloon with Docker

# Get a shell
saloon

# Run a command and then exit
saloon -- nmap -p80 -sC -sV scanme.nmap.org

Saving files between runs

Persistence is not available yet.

Networking

Networking is not available, but soon you will be able to do things like set up a netcat listener an accept incoming connections or set up a Burp Suite proxy.

Running GUI applications

The Docker container is compatible with X11. You just need to set your local XServer to listen on 127.0.0.1.

⚠️ All of the following setups disable access control on your X Server. Disabling access control allows outside connections to connect to your X Server. This is insecure if you allow network connections from the internet or from an untrusted network. Make sure your are on a secure network, like your home network, if you decide to use these instructions.

macOS Setup

1. Install XQuartz

brew install --cask xquartz

2. Enable XQuartz > Preferences > Security > Allow connections from network clients
3. Add your local IP as an xhost

xhost + 127.0.0.1

4. Test a GUI application

saloon -- wireshark

Windows Setup

1. Install VcSrv

choco install -y vcxsrv

2. Launch XLaunch from the start menu
3. Accept all default settings, checking "Disable access control"
4. If prompted, only allow access on Private networks
5. Test a GUI application

saloon -- wireshark

Linux Setup

Linux desktops usually already come with an X Server installed.

1. Disable access control

xhost +

2. Test a GUI application

saloon -- wireshark

saloon's Issues

simplify the download progress bar

it does not need to show all of the layers, just one bar for the total amount of progress would be sufficient

automatic mounts

When running a container in tty mode, it would be nice to have a folder automatically mounted that could store persistent things. This should probably be a folder in the home directory but will need to be looked into.

Also, for running in single-command mode, this could save the files from certain processes like ftp which downloads files to the docker machine but not to the host machine. A mount would in turn save it to the host machine as well.

Install Ghidra

add owasp zap

https://software.opensuse.org/download.html?project=home%3Acabelo&package=owasp-zap

Error: You don't have enough free space in /var/cache/apt/archives/.

This issue has nothing to do with Jackbox itself.

The issue is because your Docker has a large number of unused containers that have to be cleared, the following fixes it:

docker system prune -a
# If you want to remove volumes too, run:
docker volume prune

Documentation: https://docs.docker.com/engine/reference/commandline/system_prune/

migrate to dockerfile-plus to use Dockerfile imports

This would benefit the project in various ways:

1. Keep Docker container philosophy
2. Separate build stages to make rebuilding faster
3. Reduce clutter caused by bash scripts

https://github.com/edrevo/dockerfile-plus

allow automatic vpn connections

A VPN file could be passed as an argument and automatically connect to it via openvpn

use dockerfile+ to compartmentalize image build

https://github.com/edrevo/dockerfile-plus

burp proxy certificate not working

setting a port map like so

docker run -v 8080:8080 -it jackbox

allows traffic through (maybe?) but it's not functioning, most likely because a certificate needs to be installed.

also the built in browser does not work because the program is run with root, chrome does not allow running in root, and even when it's configured to run, the browser is super unstable. this needs to be fixed, probably by running burp as a user account.

add wordlists (seclists, etc)

Should be stored in /opt

Remove hard coded go version

In this install scripts, Go has a hard coded URL. It would be nice to always fetch the latest version.

Requests Megathread

In Progress packages

Checked means the package is installed on the dev branch and will be available in the next release

• axiom - https://github.com/pry0cc/axiom
• sshuttle - https://github.com/sshuttle/sshuttle
• chisel - https://github.com/jpillora/chisel
• proxychains - https://github.com/rofl0r/proxychains-ng

In Progress Tools

Static Binaries

• ripgrep - https://github.com/BurntSushi/ripgrep
• traitor - https://github.com/liamg/traitor

Finished

All package requests that have been added to the main branch (this list does not include all software on main branch, just software that was requested)

• sqlmap - https://github.com/sqlmapproject/sqlmap
• linpeas & winpeas - https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite
• bettercap - https://github.com/bettercap/bettercap
• cewl - https://github.com/digininja/CeWL/
• kali webshells - https://gitlab.com/kalilinux/packages/webshells
• hashid - https://github.com/psypanda/hashID
• apktool - https://github.com/iBotPeaches/Apktool
• nuclei - https://github.com/projectdiscovery/nuclei
• powershell empire - https://github.com/BC-SECURITY/Empire

create a minimizing script

the image is already almost 20gb, it would be nice to have a script that cleans up excessive things like apt caches and temporary files

disallow installation on windows without WSL2

The dependency fcntl for the package dockerpty (which is a dependency for saloon) is not available on Windows. When installing through pip, the installer should make sure that it cannot be installed directly onto Windows. Instead, an error message should display directing the user to install WSL2 and install saloon there.

ref: d11wtq/dockerpty#7

create x server for gui applications

let container interface with host network on linux

Right now this isn't supported by default on linux.

If you are using Docker-for-mac or Docker-for-Windows 18.03+, just connect to your mysql service using the host host.docker.internal (instead of the 127.0.0.1 in your connection string).

If you are using Docker-for-Linux 20.10.0+, you can also use the host host.docker.internal if you started your Docker container with the --add-host host.docker.internal:host-gateway option.

• https://stackoverflow.com/a/24326540/16245971

create a github action to sort manifests

automatically save terminal output to a file

This can be accomplished with script

update bloodhound to latest release

Right now there's a bug in Bloodhound (BloodHoundAD/BloodHound#465) that causes a segfault for anything higher than version 3.0.3. If anyone can find a workaround or solution, a PR would be appreciated.

create a binary that runs saloon

Saloon can be run with Docker but many users will likely not be familiar with the syntax. To make it easier for users to run Saloon, it would be easiest to just create a python wrapper that will handle all the docker arguments.

This python wrapper could also include things like

• Automatic VPN connections
• Automatic mounts
• X Server configuration

make the base image kali

this could reduce build times as most of the packages installed are coming from kali. it will need to be looked into

change default shell to zsh

When spawning new TTYs like with tmux, it defaults to using bash. This should be changed to zsh.

add update message when docker image is > 2 weeks old

create a graphical environment with a vnc server that can be accessed from a browser

the x server may not be suitable for most people, so it would be good to have an easy solution for graphical applications

add metasploit

https://github.com/rapid7/metasploit-framework/wiki/Nightly-Installers

install jumbo john

https://github.com/openwall/john/blob/bleeding-jumbo/doc/INSTALL-UBUNTU

add documentation for using all programs

add SMBMap

https://github.com/ShawnDEvans/smbmap

fix networking issues

There are limitations to opening arbitrary ports on Docker Desktop for Mac and Windows:
docker/roadmap#238

A possible workaround may be listed here:
https://blog.oddbit.com/post/2014-08-11-four-ways-to-connect-a-docker/

add bloodhound