ancypwn - 使用 Docker 设置 CTF pwn 环境的脚本

项目说明

ancypwn

Ancypwn is your one-key-to-all CTF pwnable challenges en helper.

It uses docker to manage the tools you might need, so you ha en, and you do all the debugging with the shared folder.

(all official pips have been uploaded, enjoy.)

Provided tools

* pwndbg
* pwntools
* keystone assmebler
* capstone disassembler
* glibc source and debug glibc(so we can debug libc with source)
* Ropper
* ROPGadgets
* one_gadget
* seccomp-tools

Installation

Ancypwn is now plugin based, choose your own plugin or write a new plugin if you need more flexible config/en support.

O

You will need at least 4 parts to have a working en (apart from docker).

0. A ancypwn docker image, and is properly tagged as ancypwn:, is one of "16.04", "18.04" or "18.10", each represent a corresponding ubuntu .
1. ancypwn launcher (pip install ancypwn)
2. a backend: backend provides ability to listen incoming request to pop up a terminal window, then asks terminal plugin to do it and does different docker container launching strategy (like remote support).
3. a terminal plugin: this one handles terminal poping up

Backends have the name pattern: ancypwn-backend-*, while terminal plugin has the pattern ancypwn-terminal-*.

So you need:

Choose your backend

Current official backends:

Choose your terminal

Current official terminals:

Usage

ancypwn is just a docker launcher, and support one instance at a time.

You can do:

* ancypwn run: runs the docker, and mount current directory by default to /pwn, then you will be passed to the docker shell, do your debugging here
* ancypwn end: stops the docker
* ancypwn attach: ancypwn run may already be done, without ending, you can attach to the pre run instance, then you will be passed to the docker shell.

Internally, ancypwn command can be seen as just a docker commandline runner, so you don't need to remember the sophisticated docker arguments.
You can also run your own docker image, by using ancypwn run --image YOUR_IMAGE --tag YOUR_TAG.

To use pwntools gdb.attach function

What the best of ancypwn is its supporting of popping up terminal window and runs command inside. This allows the fluent experience of using pwntools' gdb.attach function to debug target.

To use this, you need to set up your terminal like this:

This is a little bit , let me explain:

Configuration

Config is handled by appdirs, under author = Anciety, appname = ancypwn setting. Different OS may ha directory, please refer to appdirs for more information.

When you launch ancypwn the first time, a default configuration will be written to CONFIG_DIR/config.json.

Some of the configurations are:

Common Problems

Mac OSX "objc[1895]: +[NSString initialize] may have been in progress in another thread when fork() was called."

Reported by one of the users, I haven't met this situation, thus I have no idea why this is happening.

Solution is set this en :

Examples

During CTF games, we usually need a dynamic analysis en to do all the dynamic stuff, but
some challenges may contain extra stuff that may taint your current linux machine.

So, we just use the ancypwn, and do something like this:

In general, this simple script only provides you a direct way of using docker. All things are done
by docker itself. The script just makes the docker act like a real " machine".

Since many challenges use different libcs, this can also be achieved. By default, "17.10" and
"16.04" of ubuntu is provided, if you need others, commit an issue, please. And they can be used
use --ubuntu 17.10. 16.04 is used by default.

Status

Current supported ubuntu :

* 18.10
* 18.04
* 16.04

项目信息

开发语言：Python

Star 数：155

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Script to setup pwn environment for CTF with Docker展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。