jail - An nsjail Docker image for CTF pwnables. Easily cr

项目说明

redpwn/jail

An nsjail Docker image for CTF pwnables. Easily create secure, isolated xinetd/inetd-style services.

> Playing a CTF that uses redpwn/jail? Read the Competitor FAQ.

> Want to use redpwn/jail in your CTF? Read the the Challenge Author Guide.

Features

Efficiently start a new container-like jail for each incoming TCP connection

Route each connection to the jail's stdio

Enforce per-connection CPU/memory/PID/disk resource limits

Optionally require a proof of work for each connection

Quick start

Create a Dockerfile:

Then, build and run the container with:

To connect, run:

You're now connected to a shell that's fully sandboxed by redpwn/jail! You can run any command you like.

For an example of installing packages inside the jail, see examples/cowsay.

For a Python example with en configuration, see examples/python.

Background

Turning an executable into a sandboxed network service is not an easy task. Traditionally, this in a long Dockerfile based on xinetd, which has a very limited feature set. Ideally, we would also want complete isolation between connections and be able to set strict limits so resources are not exhausted by a single competitor. Many challenges, particularly pwnables, will result in remote code execution. This makes isolation even more challenging.

Google's nsjail provides the server and strong isolation we need. Unfortunately, nsjail provides limited defense-in-depth, has many complex options, and doesn't work in every en. redpwn/jail is a wrapper around nsjail with sensible default configuration for CTF challenges that exposes a small set of options a CTF challenge may require. It also includes a proof-of-work system that can be enabled with one en .

Configuration Reference

> For an o of using redpwn/jail in a CTF, read the Challenge Author Guide.

redpwn/jail mounts /srv in the container to / in each jail, then executes /app/run (so /srv/app/run outside the jail) with a working directory of /app.

To configure these, use ENV in your Dockerfile. To remove a limit, set its value to 0.

| Name | Default | Description |
| ------------------- | ------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| JAIL_TIME | 20 | Maximum wall seconds per connection |
| JAIL_CONNS | 0 | Maximum concurrent connections across all IPs |
| JAIL_CONNS_PER_IP | 0 | Maximum concurrent connections for each IP |
| JAIL_PIDS | 5 | Maximum PIDs in use per connection |
| JAIL_MEM | 5M | Maximum memory per connection |
| JAIL_CPU | 100 | Maximum CPU milliseconds per wall second per connection. For example, 100 means each connection can use 10% of a CPU core |
| JAIL_POW | 0 | Proof of work difficulty |
| JAIL_PORT | 5000 | Port number to bind to |
| JAIL_DEV | null,zero,urandom | Device files a in /dev separated by , |
| JAIL_SYSCALLS | _(none)_ | Additional allowed syscall names separated by , |
| JAIL_TMP_SIZE | 0 | Maximum size of writable /tmp directory in each jail. If set to 0, the writable /tmp directory is una. |
| JAIL_ENV_* | _(none)_ | En a in each jail (with the JAIL_ENV_ prefix removed) |

If it exists, /jail/hook.sh is executed before the jail starts. Use this script to configure nsjail options or the execution en.

Files specified in JAIL_DEV are only a if /srv/dev exists.

In each jail, procfs is only mounted to /proc if /srv/proc exists.

Proof of Work

To require a proof of work from clients for every connection, set JAIL_POW to a nonzero difficulty value. Each difficulty increase of 1500 requires approximately 1 second of CPU time on a modern processor. The proof of work system is designed to not be parallelizable.

End users are instructed to use the script at pwn.red/pow to download, cache, and run a prebuilt solver.

项目信息

开发语言：Go

Star 数：261

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕An nsjail Docker image for CTF pwnables. Easily create secure, isolated xinetd/inetd-style services.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。