Docker: Parrot OS Security
In an effort to make Parrot OS Security more portable the creators have been experimenting with Docker. They have successfully ported an enormous amount of functionality into a Parrot OS Security Docker image. This will make running Parrot OS Security anywhere possible. Because this is running in a Linux container the graphical user tools will not be available. Currently, the security image only contains basic penetration testing tools but thus so far this is more than impressive.
Let’s Pull Some Docker Images
Just to show off how portable this is now, I’ll be using Docker on Windows with a PowerShell terminal to do all of this.
https://hub.docker.com/r/parrotsec/security
|
1 2 |
# pull main parrot os image docker pull parrotsec/security |
Accessing the ParrotSec Container
Before I access the terminal I created a folder on my root hard drive for the Docker container’s files.
|
1 2 3 |
# create parrotos folder cd c:/ mkdir parrotos |
Just WOW! I’m beyond impressed at this point. Things are starting to look familiar. Accessing the Docker container is very easy. I used the command below and was given a ParrotSec OS prompt.
|
1 2 |
# docker docker run --rm -it --network host -v $PWD/work:/work parrotsec/security |
Trying out the functionality
At this point, I’m dying to see what is packed into this container. Everything will obviously be accessed through shell prompt. Let’s try out some functionality!
Parrot OS Metasploit Framework in Docker
First things first! One of the most powerful tools in Parrot OS is the Metasploit framework.
|
1 2 |
# start metasploit framework msfconsole |
Hydra, password dictionaries, rockyou.txt
Oh no! This is missing! However, it makes a lot of sense because that password dictionary is 15 GB!
I also notice hydra was not installed…
This was expected… this is a light Docker image of ParrotOS and is still incredibly powerful. Below I will show you how to install it.
Installing Wordlists and Hydra is Easy
|
1 2 3 4 5 6 7 8 9 10 |
# install wordlists apt-get update apt install wordlists # extract wordlists cd /usr/share/wordlists/ gunzip rockyou.txt.gz # install hydra apt-get install -y hydra-gtk |
Reverse Shell in Docker
Yes, it is possible to catch a reverse shell and here’s how I did it locally.
|
1 2 3 4 5 |
# in power shell start a container and map in port 443 to 444 docker run --rm -it --name parrot -p 443:4444 -v $PWD/work:/work parrotsec/security # in the parrotos container start a netcat listener on 4444 nc -nvlp 4444 |
I tried this out and it definitely works…
Apps & Penetration Testing Tools
These are some of the apps I noticed that were available.
- netcat
- nmap
- sqlmap
- metasploit
- dirb
- nikto
- wireshark CLI
- tcpdump
- webacoo
- websploit
- zuluCrypt
- macchanger
- weevly
- BeEF
- bettercap
- dirbuster
- dnsmap
- dnsenum
- ettercap
- fierce
- hashcat
- john
- htshells
- sslstrip
- gcc
- git
- geany
- emacs
- lua
- vim
- nano
- perl
- python
- rsync
