Bash Lab

The Black Hat Bash lab is a Docker-based practice environment from the No Starch Press book Black Hat Bash. It simulates a corporate network with eight machines across two subnets, giving you a realistic target for the penetration testing techniques covered in the book.

Prerequisites

Before setting up the lab, verify that your system meets these requirements:

• Operating system: Kali Linux (tested on Kali Linux 2023.4)
• RAM: 4 GB minimum (setup warns you if your system has less and lets you continue)
• Disk space: 40 GB free minimum (setup warns you if space is low and lets you continue)
• Internet access: Required to pull Docker images and download tools
• Permissions: sudo access required for all setup steps

If Burpsuite is not available, install it before starting:

sudo apt-get install burpsuite -y

Clone the repository

Clone the Black Hat Bash repository to your local machine:

git clone https://github.com/dolevf/Black-Hat-Bash.git
cd Black-Hat-Bash

Set up the lab

You can set up the lab two ways: the automated path runs a single command that installs Docker, deploys all containers, and installs third-party tools. The manual path gives you control over each step.

Automated setup (recommended)

Run this command from the repository root:

sudo make init

The script performs these steps in order:

1. Checks prerequisites (OS, RAM, disk space, and internet connectivity).
2. Installs Docker if it is not already present.
3. Deploys all containers via make deploy.
4. Installs third-party hacking tools into ~/tools/.

Progress is logged to /var/log/lab-install.log. To watch progress in a second terminal:

tail -f /var/log/lab-install.log

When setup finishes, log out and log back in for shell changes to take effect. The script adds rustscan and gitjacker aliases to ~/.bashrc.

Manual Docker install

If you prefer to install Docker yourself before running make deploy, follow these steps.

1. Add the Docker apt source:

   printf '%s\n' "deb https://download.docker.com/linux/debian bullseye stable" \
     | sudo tee /etc/apt/sources.list.d/docker-ce.list
   

2. Import the Docker GPG key:

   curl -fsSL https://download.docker.com/linux/debian/gpg \
     | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/docker-ce-archive-keyring.gpg
   

3. Update apt and install Docker:

   sudo apt update -y
   sudo apt install docker-ce docker-ce-cli containerd.io -y
   

4. Start the Docker service:

   sudo service docker start
   

5. Change into the lab/ directory and deploy:

   cd lab
   sudo make deploy
   

Verify the lab

After deployment, confirm that all containers are running:

sudo make status

The command prints Lab is up. when all eight containers are running.

Network architecture

The lab creates two Docker bridge networks:

The eight lab machines are:

p-jumpbox-01 sits on both subnets and serves as the pivot point into the corporate network. p-web-02 runs WordPress backed by c-db-02.

Post-provisioning details

After the containers start, the deploy script waits 25 seconds and then runs two provisioning steps automatically:

1. Adds an iptables rule on p-web-01 that drops all inbound traffic from the corporate subnet (10.1.0.0/24).
2. Provisions WordPress on p-web-02 with these credentials:

Third-party tools

make init installs these tools:

The rustscan alias runs RustScan through Docker without a direct install:

rustscan

If RustScan fails due to architecture incompatibility on macOS, install it natively:

brew install rustscan

Manage the lab

Run all management commands from the lab/ directory with sudo.

Start the lab

If images are already built, bring the containers back up:

sudo make deploy

Stop the lab

Shut down all containers and remove volumes:

sudo make teardown

Rebuild the lab from scratch

Destroy the existing environment and redeploy:

sudo make rebuild

Destroy the lab completely

Remove all containers, images, and volumes, then prune the Docker system:

sudo make clean