Dockerfile.runtime

###############################################################################
# ADscan runtime image (single source of truth)
#
# Build targets:
# - runtime-pro: uses compiled binary from dist/adscan (PyArmor/PyInstaller flow)
# - runtime-lite: uses open-source Python sources (no PyArmor/PyInstaller)
#
# This file centralizes all shared runtime dependencies/tools so LITE and PRO
# never drift when adding system packages or tooling.
###############################################################################

###############################################################################
# John the Ripper build stage (generic john binary + official converters)
###############################################################################
FROM debian:trixie-slim AS john_builder

ARG DEBIAN_FRONTEND=noninteractive
ARG JOHN_BLEEDING_JUMBO_COMMIT=d8f5b0138e6f9fe24ab453f886dcaa2abb2e5407
SHELL ["/bin/bash", "-euo", "pipefail", "-c"]

RUN apt-get update -y && apt-get install -y --no-install-recommends \
      ca-certificates \
      git \
      build-essential \
      automake \
      autoconf \
      libtool \
      pkg-config \
      zlib1g-dev \
      libbz2-dev \
      libpcap-dev \
      libssl-dev \
      libgmp-dev \
    && rm -rf /var/lib/apt/lists/*

RUN set -eux; \
  mkdir -p /opt/adscan/tools/john; \
  git -C /opt/adscan/tools/john init -q; \
  git -C /opt/adscan/tools/john remote add origin https://github.com/openwall/john.git; \
  for attempt in 1 2 3 4 5; do \
    if git -C /opt/adscan/tools/john -c protocol.version=2 fetch \
         --depth=1 --no-tags \
         origin "${JOHN_BLEEDING_JUMBO_COMMIT}"; then \
      break; \
    fi; \
    echo "[john_builder] fetch attempt ${attempt} failed, retrying in $((attempt * 5))s..." >&2; \
    sleep "$((attempt * 5))"; \
    if [ "${attempt}" = "5" ]; then \
      echo "[john_builder] giving up after 5 attempts" >&2; exit 1; \
    fi; \
  done; \
  git -C /opt/adscan/tools/john checkout -q FETCH_HEAD; \
  ( \
    cd /opt/adscan/tools/john/src && \
    make -s -f Makefile.legacy clean && \
    make -sj"$(nproc)" -f Makefile.legacy linux-x86-64 && \
    cp /opt/adscan/tools/john/run/john /tmp/john-generic && \
    ./configure --disable-native-tests --enable-simd=sse2 >/dev/null && \
    make -s clean && \
    make -sj"$(nproc)" && \
    cp /tmp/john-generic /opt/adscan/tools/john/run/john-generic && \
    ln -sf /opt/adscan/tools/john/run/john-generic /opt/adscan/tools/john/run/john \
  ); \
  chmod +x /opt/adscan/tools/john/run/john /opt/adscan/tools/john/run/john-generic

###############################################################################
# Shared runtime base for both PRO and LITE images
###############################################################################
FROM debian:trixie-slim AS runtime-common

ARG DEBIAN_FRONTEND=noninteractive
ARG JOHN_BLEEDING_JUMBO_COMMIT=d8f5b0138e6f9fe24ab453f886dcaa2abb2e5407
ARG CREDSWEEPER_VERSION=1.15.1
ARG HASHCAT_VERSION=7.1.2
ARG LIGOLO_NG_VERSION=0.8.3
ARG FREERDP_VERSION=3.24.1
ARG FREERDP_COMMIT=b6e770ccba87c58ffd0a55366fef33361798e39c
ARG ADSCAN_RUNTIME_CONTRACT_VERSION="1"
SHELL ["/bin/bash", "-euo", "pipefail", "-c"]

ENV ADSCAN_HOME=/opt/adscan \
    HOME=/opt/adscan \
    ADSCAN_RUNTIME_CONTRACT_VERSION=${ADSCAN_RUNTIME_CONTRACT_VERSION} \
    XDG_CONFIG_HOME=/opt/adscan/.config \
    NPM_CONFIG_UPDATE_NOTIFIER=false \
    PLAYWRIGHT_BROWSERS_PATH=/opt/adscan/ms-playwright \
    PATH="/opt/adscan/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

RUN mkdir -p /opt/adscan

RUN apt-get update -y && apt-get install -y --no-install-recommends \
      ca-certificates \
      curl \
      git \
      ripgrep \
      asciinema \
      jq \
      bat \
      gosu \
      sudo \
      libcap2-bin \
      net-tools \
      iputils-ping \
      iproute2 \
      procps \
      unzip \
      p7zip-full \
      wget \
      rclone \
      xz-utils \
      bzip2 \
      python3 \
      python3-pip \
      python3-venv \
      python3-dev \
      chromium \
      chromium-driver \
      nodejs \
      npm \
      build-essential \
      automake \
      autoconf \
      libtool \
      pkg-config \
      make \
      cmake \
      ninja-build \
      clang \
      llvm \
      libclang-dev \
      libffi-dev \
      libssl-dev \
      zlib1g-dev \
      libbz2-dev \
      libreadline-dev \
      libsqlite3-dev \
      libncurses-dev \
      libncursesw5-dev \
      tk-dev \
      liblzma-dev \
      libgmp-dev \
      libkrb5-dev \
      libgssapi-krb5-2 \
      libsasl2-2 \
      libsasl2-modules-gssapi-mit \
      krb5-user \
      libssl3t64 \
      libldap2 \
      libldns-dev \
      nmap \
      hydra \
      pocl-opencl-icd \
      samba \
      samba-common-bin \
      mono-devel \
      mingw-w64 \
      gcc-mingw-w64-x86-64 \
      musl-tools \
      tesseract-ocr \
      antiword \
      moreutils \
      libreoffice \
      graphviz \
      fontconfig \
      fonts-crosextra-carlito \
      fonts-crosextra-caladea \
      fonts-liberation \
      libx11-dev \
      libxext-dev \
      libxinerama-dev \
      libxcursor-dev \
      libxkbcommon-dev \
      libxkbfile-dev \
      libxrandr-dev \
      libxi-dev \
      libxrender-dev \
      libxv-dev \
      libxfixes-dev \
      libxdamage-dev \
      libxtst-dev \
      libfuse3-dev \
      libpam0g-dev \
      libasound2-dev \
      libcups2-dev \
      libpulse-dev \
      libjpeg-dev \
      libpng-dev \
      libavutil-dev \
      libavcodec-dev \
      libswscale-dev \
      libusb-1.0-0-dev \
      libpcsclite-dev \
      libsystemd-dev \
      libwayland-dev \
      wayland-protocols \
      libepoxy-dev \
      libicu-dev \
      libmagic1 \
      rustc \
      cargo \
      ntpsec-ntpdate \
      unbound \
      unbound-anchor \
      dns-root-data \
      libpango-1.0-0 \
      libcairo2 \
      libglib2.0-0 \
      libpangocairo-1.0-0 \
      libharfbuzz0b \
      libfontconfig1 \
    && mkdir -p /etc/OpenCL/vendors \
    && printf '%s\n' 'libnvidia-opencl.so.1' > /etc/OpenCL/vendors/nvidia.icd \
    && rm -rf /var/lib/apt/lists/*

RUN printf '%s\n' \
  '#!/usr/bin/env bash' \
  'set -euo pipefail' \
  'if curl "$@"; then' \
  '  exit 0' \
  'else' \
  '  status=$?' \
  'fi' \
  'if [[ "$status" -ne 60 ]]; then' \
  '  exit "$status"' \
  'fi' \
  'echo "warning: curl TLS verification failed; retrying with insecure fallback (-k)" >&2' \
  'exec curl -k "$@"' \
  > /usr/local/bin/adscan-curl \
  && chmod +x /usr/local/bin/adscan-curl

# Install the browser revision expected by the Python Playwright package bundled
# into the PRO binary. The Debian chromium package remains installed as a
# fallback and for workflows that call Chromium directly.
RUN set -eux; \
  python3 -m venv /tmp/playwright-installer; \
  /tmp/playwright-installer/bin/python -m pip install --no-cache-dir --upgrade pip; \
  /tmp/playwright-installer/bin/python -m pip install --no-cache-dir playwright==1.57.0; \
  PLAYWRIGHT_BROWSERS_PATH=/opt/adscan/ms-playwright \
    /tmp/playwright-installer/bin/python -m playwright install chromium; \
  rm -rf /tmp/playwright-installer

# Codex CLI (official ChatGPT plan sign-in path for Plus/Pro subscriptions).
# Installed globally so `ask login codex` and `ask` can use `codex` directly.
RUN set -eux; \
  npm install --global @openai/codex; \
  codex --version

# Base runtime layout
RUN mkdir -p /opt/adscan/{bin,tools,tool_venvs,wordlists,logs,fonts} /workspaces \
  && fc-cache -f \
  && chmod -R 0777 /opt/adscan /workspaces

COPY wordlists/ /opt/adscan/wordlists/
# C# sources for Windows tool compilation (pss-dumper, rtlcp-dumper)
COPY src/windows_tools/ /workspace_build/src/windows_tools/

COPY --from=john_builder /opt/adscan/tools/john/run /opt/adscan/tools/john/run

# Install Python tool environments (mirrors `PipToolsConfig` from adscan.py)
RUN set -eux; \
  pip_retry() { \
    local python_bin="$1"; shift; \
    local attempt=1; \
    local max_attempts=4; \
    until "$python_bin" -m pip install --no-cache-dir --retries 8 --timeout 120 "$@"; do \
      if [ "$attempt" -ge "$max_attempts" ]; then \
        echo "pip install failed after ${max_attempts} attempts: $*" >&2; \
        return 1; \
      fi; \
      echo "pip install failed (attempt ${attempt}/${max_attempts}) for: $*" >&2; \
      sleep $((attempt * 5)); \
      attempt=$((attempt + 1)); \
    done; \
  }; \
  python3 -m venv /opt/adscan/tool_venvs/impacket/venv; \
  pip_retry /opt/adscan/tool_venvs/impacket/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/impacket/venv/bin/python "impacket==0.13.0" "pycryptodome==3.23.0"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/netexec/venv; \
  pip_retry /opt/adscan/tool_venvs/netexec/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/netexec/venv/bin/python "git+https://github.com/Pennyw0rth/NetExec.git@73ccf0d"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/certipy/venv; \
  pip_retry /opt/adscan/tool_venvs/certipy/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/certipy/venv/bin/python "certipy-ad==5.0.4"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/bloodyad/venv; \
  pip_retry /opt/adscan/tool_venvs/bloodyad/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/bloodyad/venv/bin/python "bloodyAD==2.5.4"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/enum-trusts/venv; \
  pip_retry /opt/adscan/tool_venvs/enum-trusts/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/enum-trusts/venv/bin/python "git+https://github.com/ADScanPro/enum-trusts.git@f7eae14"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/manspider/venv; \
  pip_retry /opt/adscan/tool_venvs/manspider/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/manspider/venv/bin/python "git+https://github.com/ADScanPro/MANSPIDER@cedb138"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/credsweeper/venv; \
  pip_retry /opt/adscan/tool_venvs/credsweeper/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/credsweeper/venv/bin/python "credsweeper==${CREDSWEEPER_VERSION}"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/pypykatz/venv; \
  pip_retry /opt/adscan/tool_venvs/pypykatz/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/pypykatz/venv/bin/python "pypykatz==0.6.13"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/lsassy/venv; \
  pip_retry /opt/adscan/tool_venvs/lsassy/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/lsassy/venv/bin/python "lsassy==3.1.16"; \
  \
  chmod -R 0777 /opt/adscan/tool_venvs

# External tools (git/curl)
RUN set -eux; \
  mkdir -p /opt/adscan/tools; \
  if ! adscan-curl -fsSL "https://hashcat.net/files/hashcat-${HASHCAT_VERSION}.7z" -o /tmp/hashcat.7z; then \
    echo "warning: official hashcat download failed; falling back to SourceForge mirror" >&2; \
    wget --max-redirect=10 --no-check-certificate -O /tmp/hashcat.7z \
      "https://sourceforge.net/projects/hashcat.mirror/files/v${HASHCAT_VERSION}/hashcat-${HASHCAT_VERSION}.7z/download"; \
  fi; \
  7z x /tmp/hashcat.7z -o/opt/adscan/tools >/dev/null; \
  test -x "/opt/adscan/tools/hashcat-${HASHCAT_VERSION}/hashcat.bin"; \
  ln -sf "/opt/adscan/tools/hashcat-${HASHCAT_VERSION}/hashcat.bin" /opt/adscan/bin/hashcat; \
  /opt/adscan/bin/hashcat --version | grep -F "v${HASHCAT_VERSION}"; \
  rm -f /tmp/hashcat.7z; \
  \
  git clone --depth 1 https://github.com/Greenwolf/ntlm_theft.git /opt/adscan/tools/ntlm_theft; \
  mkdir -p /opt/adscan/tools/firepwd; \
  adscan-curl -fsSL https://raw.githubusercontent.com/lclevy/firepwd/refs/heads/master/firepwd.py -o /opt/adscan/tools/firepwd/firepwd.py; \
  adscan-curl -fsSL https://raw.githubusercontent.com/lclevy/firepwd/refs/heads/master/requirements.txt -o /opt/adscan/tools/firepwd/requirements.txt; \
  python3 -m venv /opt/adscan/tool_venvs/firepwd/venv; \
  /opt/adscan/tool_venvs/firepwd/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/firepwd/venv/bin/python -m pip install --no-cache-dir -r /opt/adscan/tools/firepwd/requirements.txt; \
  \
  git clone --depth 1 https://github.com/spextat0r/LSA-Reaper.git /opt/adscan/tools/LSA-Reaper; \
  python3 -m venv --system-site-packages /opt/adscan/tool_venvs/LSA-Reaper/venv; \
  /opt/adscan/tool_venvs/LSA-Reaper/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/LSA-Reaper/venv/bin/python -m pip install --no-cache-dir -r /opt/adscan/tools/LSA-Reaper/requirements.txt impacket; \
  \
  mkdir -p /opt/adscan/tools/PKINITtools; \
  adscan-curl -fsSL https://raw.githubusercontent.com/dirkjanm/PKINITtools/refs/heads/master/gettgtpkinit.py -o /opt/adscan/tools/PKINITtools/gettgtpkinit.py; \
  adscan-curl -fsSL https://raw.githubusercontent.com/dirkjanm/PKINITtools/refs/heads/master/getnthash.py -o /opt/adscan/tools/PKINITtools/getnthash.py; \
  adscan-curl -fsSL https://raw.githubusercontent.com/dirkjanm/PKINITtools/refs/heads/master/requirements.txt -o /opt/adscan/tools/PKINITtools/requirements.txt; \
  python3 -m venv /opt/adscan/tool_venvs/PKINITtools/venv; \
  /opt/adscan/tool_venvs/PKINITtools/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/PKINITtools/venv/bin/python -m pip install --no-cache-dir -r /opt/adscan/tools/PKINITtools/requirements.txt; \
  \
  mkdir -p /opt/adscan/tools/kerbrute; \
  adscan-curl -fsSL https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64 -o /opt/adscan/tools/kerbrute/kerbrute; \
  chmod +x /opt/adscan/tools/kerbrute/kerbrute; \
  \
  mkdir -p /opt/adscan/tools/ligolo-ng/proxy/linux-amd64; \
  adscan-curl -fsSL \
    "https://github.com/nicocha30/ligolo-ng/releases/download/v${LIGOLO_NG_VERSION}/ligolo-ng_proxy_${LIGOLO_NG_VERSION}_linux_amd64.tar.gz" \
    -o /tmp/ligolo_proxy.tar.gz; \
  tar -xzf /tmp/ligolo_proxy.tar.gz -C /opt/adscan/tools/ligolo-ng/proxy/linux-amd64 proxy; \
  chmod +x /opt/adscan/tools/ligolo-ng/proxy/linux-amd64/proxy; \
  setcap cap_net_admin,cap_net_bind_service+ep /opt/adscan/tools/ligolo-ng/proxy/linux-amd64/proxy; \
  ln -sf /opt/adscan/tools/ligolo-ng/proxy/linux-amd64/proxy /opt/adscan/bin/ligolo-proxy; \
  rm -f /tmp/ligolo_proxy.tar.gz; \
  \
  mkdir -p /opt/adscan/tools/ligolo-ng/agent/windows-amd64; \
  adscan-curl -fsSL \
    "https://github.com/nicocha30/ligolo-ng/releases/download/v${LIGOLO_NG_VERSION}/ligolo-ng_agent_${LIGOLO_NG_VERSION}_windows_amd64.zip" \
    -o /tmp/ligolo_agent_windows_amd64.zip; \
  unzip -q /tmp/ligolo_agent_windows_amd64.zip agent.exe -d /opt/adscan/tools/ligolo-ng/agent/windows-amd64; \
  rm -f /tmp/ligolo_agent_windows_amd64.zip; \
  \
  git clone --depth 1 https://github.com/p0dalirius/Coercer.git /opt/adscan/tools/coercer; \
  python3 -m venv /opt/adscan/tool_venvs/coercer/venv; \
  /opt/adscan/tool_venvs/coercer/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/coercer/venv/bin/python -m pip install --no-cache-dir -r /opt/adscan/tools/coercer/requirements.txt; \
  \
  git clone --branch "${FREERDP_VERSION}" --depth 1 https://github.com/FreeRDP/FreeRDP.git /opt/adscan/tools/freerdp; \
  test "$(git -C /opt/adscan/tools/freerdp rev-parse HEAD)" = "${FREERDP_COMMIT}"; \
  cmake -S /opt/adscan/tools/freerdp -B /opt/adscan/tools/freerdp/build -G Ninja \
    -DCMAKE_BUILD_TYPE=Release \
    -DCMAKE_INSTALL_PREFIX=/opt/adscan/tools/freerdp/install \
    -DBUILD_TESTING=OFF \
    -DWITH_SERVER=OFF \
    -DWITH_X11=ON \
    -DWITH_WAYLAND=ON; \
  cmake --build /opt/adscan/tools/freerdp/build --parallel "$(nproc)"; \
  cmake --install /opt/adscan/tools/freerdp/build; \
  ln -sf /opt/adscan/tools/freerdp/install/bin/xfreerdp /opt/adscan/bin/xfreerdp; \
  ln -sf /opt/adscan/tools/freerdp/install/bin/xfreerdp /opt/adscan/bin/xfreerdp3; \
  printf '%s\n' '/opt/adscan/tools/freerdp/install/lib' '/opt/adscan/tools/freerdp/install/lib64' \
    > /etc/ld.so.conf.d/adscan-freerdp.conf; \
  ldconfig; \
  /opt/adscan/bin/xfreerdp --version; \
  \
  chmod +x /opt/adscan/tools/john/run/john /opt/adscan/tools/john/run/john-generic; \
  for tool in john keepass2john keepass2john.py zip2john zip2john.py pfx2john pfx2john.py ansible2john ansible2john.py; do \
    if [ -e "/opt/adscan/tools/john/run/${tool}" ]; then \
      chmod +x "/opt/adscan/tools/john/run/${tool}" || true; \
      ln -sf "/opt/adscan/tools/john/run/${tool}" "/opt/adscan/bin/${tool}"; \
    fi; \
  done; \
  if [ -e "/opt/adscan/tools/john/run/john.conf" ]; then \
    ln -sf "/opt/adscan/tools/john/run/john.conf" "/opt/adscan/bin/john.conf"; \
  fi; \
  \
  git clone --depth 1 https://github.com/blechschmidt/massdns.git /opt/adscan/tools/massdns; \
  make -C /opt/adscan/tools/massdns; \
  chmod +x /opt/adscan/tools/massdns/bin/massdns; \
  ln -sf /opt/adscan/tools/massdns/bin/massdns /opt/adscan/bin/massdns; \
  \
  chmod -R 0777 /opt/adscan/tools /opt/adscan/tool_venvs

# SysWhispers4 – direct-syscall stub generator for evasion-compiled Windows binaries.
# mingw-w64 (already installed above) provides the x86_64-w64-mingw32-g++ cross-compiler
# required by the binary_ops Tier-2 pipeline.
RUN set -eux; \
  git clone --depth 1 https://github.com/JoasASantos/SysWhispers4.git /opt/adscan/tools/syswhispers4; \
  python3 -m venv /opt/adscan/tool_venvs/syswhispers4/venv; \
  /opt/adscan/tool_venvs/syswhispers4/venv/bin/python -m pip install --no-cache-dir -U pip; \
  if [ -f /opt/adscan/tools/syswhispers4/requirements.txt ]; then \
    /opt/adscan/tool_venvs/syswhispers4/venv/bin/python -m pip install --no-cache-dir \
      -r /opt/adscan/tools/syswhispers4/requirements.txt; \
  fi; \
  python3 /opt/adscan/tools/syswhispers4/syswhispers.py --help >/dev/null 2>&1 || true; \
  chmod -R 0777 /opt/adscan/tools/syswhispers4 /opt/adscan/tool_venvs/syswhispers4

# Donut – PE-to-shellcode converter for the Tier-3 in-memory loader pipeline.
# Installed to /opt/adscan/bin/ which is on PATH (see ENV above).
# CFLAGS=-w suppresses deprecation warnings that would fail on GCC 13+ with -Werror.
RUN set -eux; \
  git clone --depth 1 https://github.com/TheWover/donut.git /tmp/donut_build; \
  make -C /tmp/donut_build CFLAGS="-w -O2"; \
  cp /tmp/donut_build/donut /opt/adscan/bin/donut; \
  chmod 0755 /opt/adscan/bin/donut; \
  rm -rf /tmp/donut_build

# Windows attack binaries (binary_ops catalog – Tier 1 prebuilt cache).
# Stored at /opt/adscan/tools/windows-tools/<name>/<filename> to match
# get_adscan_home() / "tools" / "windows-tools" with ADSCAN_HOME=/opt/adscan.
ARG MIMIKATZ_VERSION=2.2.0-20220919
ARG RUBEUS_COMMIT=e37fa53
ARG WHISKER_COMMIT=9a236c063e37f2d59c1637bdefcae6b4371bf466
ARG KRBRELAYUP_URL=https://kb.offsec.nl/tools/techniques/krbrelayup/files/KrbRelayUp.exe
ARG RUNASCS_VERSION=1.5
ARG NANODUMP_COMMIT=main
RUN set -eux; \
  mkdir -p \
    /opt/adscan/tools/windows-tools/mimikatz \
    /opt/adscan/tools/windows-tools/rubeus \
    /opt/adscan/tools/windows-tools/certify \
    /opt/adscan/tools/windows-tools/whisker \
    /opt/adscan/tools/windows-tools/seatbelt \
    /opt/adscan/tools/windows-tools/krbrelayup \
    /opt/adscan/tools/windows-tools/runascs \
    /opt/adscan/tools/windows-tools/procdump \
    /opt/adscan/tools/windows-tools/nanodump; \
  \
  # mimikatz – credential extraction (official gentilkiwi release ZIP)
  adscan-curl -fsSL \
    "https://github.com/gentilkiwi/mimikatz/releases/download/${MIMIKATZ_VERSION}/mimikatz_trunk.zip" \
    -o /tmp/mimikatz.zip; \
  unzip -p /tmp/mimikatz.zip x64/mimikatz.exe \
    > /opt/adscan/tools/windows-tools/mimikatz/mimikatz.exe; \
  rm /tmp/mimikatz.zip; \
  \
  # Rubeus – Kerberos attacks (Ghostpack compiled binaries mirror)
  adscan-curl -fsSL \
    "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/Rubeus.exe" \
    -o /opt/adscan/tools/windows-tools/rubeus/Rubeus.exe; \
  \
  # Certify – ADCS exploitation (Ghostpack compiled binaries mirror)
  adscan-curl -fsSL \
    "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/Certify.exe" \
    -o /opt/adscan/tools/windows-tools/certify/Certify.exe; \
  \
  # Whisker – Shadow credentials.
  # The old Ghostpack-CompiledBinaries mirror stopped shipping Whisker.exe,
  # so build it from the official source to keep the image reproducible.
  git clone --depth 1 https://github.com/eladshamir/Whisker.git /tmp/Whisker; \
  git -C /tmp/Whisker checkout "${WHISKER_COMMIT}"; \
  perl -0pi -e 's#<Reference Include="System.DirectoryServices" />#<Reference Include="System.DirectoryServices" />\n    <Reference Include="System.Numerics" />#' \
    /tmp/Whisker/Whisker/Whisker.csproj; \
  build_tool=""; \
  if command -v msbuild >/dev/null 2>&1; then \
    build_tool="msbuild"; \
  elif command -v xbuild >/dev/null 2>&1; then \
    build_tool="xbuild"; \
  else \
    echo "Neither msbuild nor xbuild is available for Whisker build" >&2; \
    exit 1; \
  fi; \
  "${build_tool}" /tmp/Whisker/Whisker.sln /p:Configuration=Release /verbosity:minimal; \
  test -f /tmp/Whisker/Whisker/bin/Release/Whisker.exe; \
  cp /tmp/Whisker/Whisker/bin/Release/Whisker.exe /opt/adscan/tools/windows-tools/whisker/Whisker.exe; \
  rm -rf /tmp/Whisker; \
  \
  # Seatbelt – host security enumeration (Ghostpack compiled binaries mirror)
  adscan-curl -fsSL \
    "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/Seatbelt.exe" \
    -o /opt/adscan/tools/windows-tools/seatbelt/Seatbelt.exe; \
  \
  # KrbRelayUp – local privilege escalation via Kerberos relay.
  # The historical GitHub release URL now returns 404 and the source tree
  # requires a larger Mono/xbuild compatibility patch set than we want inside
  # the runtime image, so use the maintained OffSec knowledge-base binary.
  adscan-curl -fsSL "${KRBRELAYUP_URL}" \
    -o /opt/adscan/tools/windows-tools/krbrelayup/KrbRelayUp.exe; \
  \
  # RunasCs – run as different user (official GitHub release ZIP)
  # Also symlinked to the legacy path so runascs_manager.py finds it.
  adscan-curl -fsSL \
    "https://github.com/antonioCoco/RunasCs/releases/download/v${RUNASCS_VERSION}/RunasCs.zip" \
    -o /tmp/runascs.zip; \
  unzip -p /tmp/runascs.zip RunasCs.exe \
    > /opt/adscan/tools/windows-tools/runascs/RunasCs.exe; \
  rm /tmp/runascs.zip; \
  mkdir -p /opt/adscan/tools/runascs/windows-amd64; \
  ln -sf \
    /opt/adscan/tools/windows-tools/runascs/RunasCs.exe \
    /opt/adscan/tools/runascs/windows-amd64/RunasCs.exe; \
  \
  # procdump – Sysinternals LSASS dumper (official Microsoft/Sysinternals ZIP)
  adscan-curl -fsSL \
    "https://download.sysinternals.com/files/Procdump.zip" \
    -o /tmp/procdump.zip; \
  unzip -p /tmp/procdump.zip procdump64.exe \
    > /opt/adscan/tools/windows-tools/procdump/procdump64.exe; \
  rm /tmp/procdump.zip; \
  \
  # nanodump – LSASS dumper with PPL bypass (no public release; cross-compile from source)
  # mingw-w64 is already installed above. nanodump uses direct syscalls so no
  # MSVC dependency — the provided Makefile works with the MinGW cross-compiler.
  git clone --depth 1 https://github.com/fortra/nanodump.git /tmp/nanodump_build; \
  if [ "${NANODUMP_COMMIT}" != "main" ]; then \
    git -C /tmp/nanodump_build checkout "${NANODUMP_COMMIT}"; \
  fi; \
  make -C /tmp/nanodump_build \
    CC=x86_64-w64-mingw32-gcc \
    CXX=x86_64-w64-mingw32-g++ \
    2>&1 || true; \
  if [ -f /tmp/nanodump_build/dist/nanodump.x64.exe ]; then \
    cp /tmp/nanodump_build/dist/nanodump.x64.exe \
       /opt/adscan/tools/windows-tools/nanodump/nanodump.x64.exe; \
    echo "nanodump compiled OK"; \
  else \
    echo "warning: nanodump build did not produce dist/nanodump.x64.exe — binary will need manual placement" >&2; \
  fi; \
  rm -rf /tmp/nanodump_build; \
  \
  # GodPotatoCLR – SeImpersonate→SYSTEM via MSSQL CLR assembly (bypasses Defender write-time scan).
  # Compiled from GodPotato source (src/windows_tools/godpotato/) as a .NET library.
  # Loaded into SQL Server via CREATE ASSEMBLY FROM 0x<hex> — never touches target disk as a PE.
  # Requires: mssql sysadmin + SeImpersonatePrivilege + clr enabled + clr strict security = 0.
  mkdir -p /opt/adscan/tools/windows-tools/godpotato-clr; \
  mcs -target:library -platform:x64 -sdk:4 \
    /workspace_build/src/windows_tools/godpotato/Program.cs \
    /workspace_build/src/windows_tools/godpotato/ArgsParse.cs \
    /workspace_build/src/windows_tools/godpotato/SharpToken.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/NativeMethods.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/GodPotatoContext.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/GodPotatoUnmarshalTrigger.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/UnmarshalDCOM.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/ObjRef.cs \
    /workspace_build/src/windows_tools/godpotato/NativeAPI/IStreamImpl.cs \
    /workspace_build/src/windows_tools/godpotato/SqlGodPotato.cs \
    -out:/opt/adscan/tools/windows-tools/godpotato-clr/GodPotatoCLR.dll 2>&1 \
    && echo "GodPotatoCLR.dll compiled OK" \
    || echo "warning: GodPotatoCLR compilation failed — binary will need manual placement" >&2; \
  \
  # SweetPotatoCLR – SeImpersonate→SYSTEM fallback for WS2016 where GodPotato's RPCSS hook
  # does not fire (build 14393). Uses DCOM NTLM relay via BITS CLSID to obtain SYSTEM token.
  # Activated automatically by MssqlSeImpersonateService when GodPotato fails in < 2s.
  mkdir -p /opt/adscan/tools/windows-tools/sweetpotato-clr; \
  mcs -target:library -platform:x64 -sdk:4 \
    /workspace_build/src/windows_tools/sweetpotato/LocalNegotiator.cs \
    /workspace_build/src/windows_tools/sweetpotato/ObjRef.cs \
    /workspace_build/src/windows_tools/sweetpotato/StorageTrigger.cs \
    /workspace_build/src/windows_tools/sweetpotato/PotatoAPI.cs \
    /workspace_build/src/windows_tools/sweetpotato/Com/IEnumSTATSTG.cs \
    /workspace_build/src/windows_tools/sweetpotato/Com/ILockBytes.cs \
    /workspace_build/src/windows_tools/sweetpotato/Com/IMarshal.cs \
    /workspace_build/src/windows_tools/sweetpotato/Com/IStorage.cs \
    /workspace_build/src/windows_tools/sweetpotato/Com/IStream.cs \
    /workspace_build/src/windows_tools/sweetpotato/Com/Ole32.cs \
    /workspace_build/src/windows_tools/sweetpotato/Security/Privilege.cs \
    /workspace_build/src/windows_tools/sweetpotato/Security/SSPIHelper.cs \
    /workspace_build/src/windows_tools/sweetpotato/Stubs.cs \
    /workspace_build/src/windows_tools/sweetpotato/SqlSweetPotato.cs \
    -out:/opt/adscan/tools/windows-tools/sweetpotato-clr/SweetPotatoCLR.dll 2>&1 \
    && echo "SweetPotatoCLR.dll compiled OK" \
    || echo "warning: SweetPotatoCLR compilation failed — binary will need manual placement" >&2; \
  \
  # pss-dumper + rtlcp-dumper – AV-evasion LSASS dumpers (Mono C# → Windows .NET exe)
  # PssCaptureSnapshot: snapshots lsass into a VA clone, MiniDumpWriteDump targets the
  # snapshot handle (not lsass PID) — bypasses AV hooks on MiniDumpWriteDump(lsass).
  # RtlCreateProcessReflection: clones lsass into a reflection process, dumps the clone.
  # Both require admin, neither bypasses PPL. mono-complete (mcs) is installed above.
  mkdir -p /opt/adscan/tools/windows-tools/pss-dumper \
           /opt/adscan/tools/windows-tools/rtlcp-dumper \
           /opt/adscan/tools/windows-tools/wsass-dumper \
           /opt/adscan/tools/windows-tools/ppldump; \
  mcs -target:exe -unsafe -out:/opt/adscan/tools/windows-tools/pss-dumper/pss-dumper.exe \
    /workspace_build/src/windows_tools/pss_dumper.cs 2>&1 && echo "pss-dumper compiled OK" \
    || echo "warning: pss-dumper compilation failed — binary will need manual placement" >&2; \
  mcs -target:exe -out:/opt/adscan/tools/windows-tools/rtlcp-dumper/rtlcp-dumper.exe \
    /workspace_build/src/windows_tools/rtlcp_dumper.cs 2>&1 && echo "rtlcp-dumper compiled OK" \
    || echo "warning: rtlcp-dumper compilation failed — binary will need manual placement" >&2; \
  \
  # wsass-dumper – PPL bypass via WerFaultSecure.exe (Win8.1, signed Microsoft WinTcb)
  # WSASS.exe: official TwoSevenOneT source + two ADscan patches (MinGW build):
  #   1. lpDesktop=WinSta0\Default in PPLHelp.cpp → works from Session-0 services
  #   2. explicit output path arg + auto-find lsass PID → no CWD dependency
  # WerFaultSecure.exe runs at PPL WinTcb and can open lsass even with RunAsPPL=1.
  # Syntax: WSASS.exe <WerFaultSecure.exe path> <OutputDumpPath>
  mkdir -p /opt/adscan/tools/windows-tools/wsass-dumper; \
  cp /workspace_build/src/windows_tools/WSASS.exe \
     /opt/adscan/tools/windows-tools/wsass-dumper/WSASS.exe \
     && echo "WSASS.exe (patched) copied OK" \
     || echo "warning: WSASS.exe copy failed" >&2; \
  cp /workspace_build/src/windows_tools/WerFaultSecure.exe \
     /opt/adscan/tools/windows-tools/wsass-dumper/WerFaultSecure.exe \
     && echo "WerFaultSecure.exe copied OK" \
     || echo "warning: WerFaultSecure.exe copy failed" >&2; \
  \
  # ppldump – PPL bypass via KnownDlls/DefineDosDevice userland exploit (itm4n/PPLMedic).
  # Binary extracted from lsassy ppldump_embedded and stored in src/windows_tools/.
  # Works on Windows without the July 2022 PPL patch (pre-19044.1826).
  cp /workspace_build/src/windows_tools/PPLdump.exe \
     /opt/adscan/tools/windows-tools/ppldump/PPLdump.exe \
     && echo "PPLdump.exe copied OK" \
     || echo "warning: PPLdump.exe copy failed" >&2; \
  \
  chmod -R 0777 /opt/adscan/tools/windows-tools

# Wordlists
RUN set -eux; \
  download_wordlist() { \
    local url="$1"; \
    local dest="$2"; \
    if curl -fsSL "$url" -o "$dest"; then \
      return 0; \
    fi; \
    case "$url" in \
      https://weakpass.com/*) \
        echo "warning: TLS verification failed for $url; retrying with insecure fallback (-k)" >&2; \
        curl -kfsSL "$url" -o "$dest"; \
        ;; \
      *) \
        return 1; \
        ;; \
    esac; \
  }; \
  mkdir -p /opt/adscan/wordlists; \
  download_wordlist https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt /opt/adscan/wordlists/rockyou.txt; \
  download_wordlist https://gist.github.com/The-Viper-One/a1ee60d8b3607807cc387d794e809f0b/raw/b7d83af6a8bbb43013e04f78328687d19d0cf9a7/kerberoast_pws.xz /opt/adscan/wordlists/kerberoast_pws.xz; \
  xz -d -c /opt/adscan/wordlists/kerberoast_pws.xz > /opt/adscan/wordlists/kerberoast_pws; \
  mkdir -p /usr/share/wordlists; \
  git clone --depth 1 https://github.com/insidetrust/statistically-likely-usernames.git /usr/share/wordlists/statistically-likely-usernames; \
  rm -f /opt/adscan/wordlists/kerberoast_pws.xz; \
  chmod -R 0777 /opt/adscan/wordlists /usr/share/wordlists/statistically-likely-usernames

COPY adscan_internal/assets/wordlists/kerberos-format-inference.txt /opt/adscan/wordlists/kerberos-format-inference.txt
COPY adscan_internal/assets/wordlists/kerberos-format-inference.json /opt/adscan/wordlists/kerberos-format-inference.json

# Unbound container configuration
COPY docker/unbound_container_base.conf /etc/unbound/unbound.conf
COPY docker/unbound_adscan_control.conf /etc/unbound/unbound.conf.d/00-adscan-control.conf

COPY docker/adscan_entrypoint.sh /usr/local/bin/adscan-entrypoint
RUN chmod +x /usr/local/bin/adscan-entrypoint

###############################################################################
# PRO target: compiled binary runtime
###############################################################################
FROM runtime-common AS runtime-pro

# NOTE: ADSCAN_RUNTIME_VERSION and ADSCAN_PARTNER_TAG are declared LATER
# in this stage (at the point of use), not here. BuildKit binds
# `--build-arg` values to ARG variables at their declaration line and
# hashes the bound value into the cache key of every layer in the ARG's
# scope — even when no upstream layer references the variable. Declaring
# ARG at the point of use narrows the scope so upstream layers stay
# cacheable across builds with different version timestamps / partner
# tags. (PRO's COPY dist/adscan invalidates downstream layers on every
# build anyway because PyArmor is non-deterministic, but keeping this
# pattern consistent with LITE makes the file easier to reason about.)

ENV ADSCAN_RUNTIME_LICENSE_MODE=PRO

COPY dist/adscan /usr/local/bin/adscan

# Partner tag baked at build time — identifies which partner this image was built for.
# Passed via: docker build --build-arg ADSCAN_PARTNER_TAG=glenn-mssp-beta1
# Empty in untagged builds (dev/CI). Used by telemetry for partner-level filtering.
ARG ADSCAN_PARTNER_TAG=""

# ADSCAN_RUNTIME_VERSION enters scope HERE — narrowest possible.
ARG ADSCAN_RUNTIME_VERSION=""
RUN set -eux; \
  chmod +x /usr/local/bin/adscan; \
  if [[ -n "${ADSCAN_RUNTIME_VERSION}" ]]; then \
    printf '%s\n' "${ADSCAN_RUNTIME_VERSION}" > /opt/adscan/version; \
  fi

# Bake build-time ARGs into the image ENV only at the end, after every
# expensive layer above. The running container still exposes both
# variables without contaminating upstream cache keys.
ENV ADSCAN_PARTNER_TAG=${ADSCAN_PARTNER_TAG}
ENV ADSCAN_RUNTIME_VERSION=${ADSCAN_RUNTIME_VERSION}

ENTRYPOINT ["/usr/local/bin/adscan-entrypoint"]

###############################################################################
# LITE target: source runtime (open-source)
###############################################################################
FROM runtime-common AS runtime-lite

# NOTE: ADSCAN_RUNTIME_VERSION is declared LATER in this stage (right before
# it's used), not here. BuildKit binds `--build-arg` values to ARG
# variables at their declaration line, and even when no upstream layer
# references the variable BuildKit hashes the bound value into the cache
# key of every layer in the ARG's scope. In CI the timestamped value
# (`9.0.0.dev<timestamp>`) would otherwise invalidate the heavy pip
# install layer on every build. Declaring ARG at the point of use
# narrows the scope so the expensive layers stay cacheable.

ENV ADSCAN_RUNTIME_LICENSE_MODE=LITE

# Runtime Python dependencies for source-mode ADscan CLI.
RUN set -eux; \
  python3 -m venv /opt/adscan/venv; \
  /opt/adscan/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/venv/bin/python -m pip install --no-cache-dir \
    prompt_toolkit==3.0.52 \
    psutil==7.2.2 \
    rich==13.9.4 \
    python-docx==1.2.0 \
    openpyxl==3.1.5 \
    netifaces==0.11.0 \
    posthog==7.9.3 \
    certifi==2026.1.4 \
    ipaddress==1.0.23 \
    python-dotenv==1.2.1 \
    sentry-sdk==2.52.0 \
    packaging==25.0 \
    questionary==2.1.1 \
    pypsrp[kerberos]==0.9.0 \
    pydantic-settings==2.13.1 \
    pydantic-ai==1.62.0 \
    gssapi==1.10.1 \
    krb5==0.9.0 \
    python-magic==0.4.27 \
    markitdown==0.1.5 \
    credsweeper==${CREDSWEEPER_VERSION} \
    pykeepass==4.1.1.post1 \
    impacket==0.13.0 \
    pycryptodome==3.23.0 \
    pycryptodomex==3.23.0 \
    gpp-decrypt==2.0.0 \
    requests==2.32.5 \
    matplotlib==3.10.8 \
    graphviz==0.21 \
    pyarrow==21.0.0 \
    rustworkx==0.15.1 \
    selenium==4.31.0 \
    textual==0.80.1 \
    "redis>=5.0.0,<5.3.0" \
    weasyprint>=60.0 \
    playwright==1.57.0 \
    jinja2>=3.0 \
    "scapy>=2.5.0,<3.0"

# Vendored skelsec native AD stack — installed from local source at vendor/.
# This is the SAME source the developer reads under vendor/<lib>/, so what
# you read is exactly what runs. Bumping a vendored library is a single
# scripts/refresh_vendor.sh + uv lock + commit; never depend on PyPI for
# these. See CLAUDE.md § Native Library Source Code.
#
# NOTE: setcap is intentionally deferred to AFTER all pip installs.
# Applying file capabilities to the venv python binary before any subsequent
# RUN step that invokes it causes Docker buildkit to reject execution with
# exit code 126 ("Operation not permitted") — the kernel blocks execution of
# capability-bearing binaries in the builder's restricted namespace.
COPY vendor /opt/adscan-src/vendor
RUN set -eux; \
  /opt/adscan/venv/bin/python -m pip install --no-cache-dir \
    /opt/adscan-src/vendor/asysocks \
    /opt/adscan-src/vendor/badauth \
    /opt/adscan-src/vendor/kerbad \
    /opt/adscan-src/vendor/badldap \
    /opt/adscan-src/vendor/winacl \
    /opt/adscan-src/vendor/aiosmb \
    /opt/adscan-src/vendor/pypykatz \
    /opt/adscan-src/vendor/aardwolf; \
  /opt/adscan/venv/bin/python -c "\
import aiosmb, kerbad, badldap, winacl, pypykatz, asysocks, badauth, aardwolf, os; \
print('vendor ok:', aiosmb.__file__);"; \
  runtime_python="$(readlink -f /opt/adscan/venv/bin/python)"; \
  setcap cap_net_bind_service,cap_net_raw,cap_net_admin+ep "${runtime_python}"

COPY adscan.py /opt/adscan-src/adscan.py
COPY adscan_core /opt/adscan-src/adscan_core
COPY adscan_internal /opt/adscan-src/adscan_internal
COPY adscan_launcher /opt/adscan-src/adscan_launcher
COPY custom_config.yaml /opt/adscan-src/custom_config.yaml
COPY pyproject.toml /opt/adscan-src/pyproject.toml

# Pre-baked LITE cheatsheet PDF. The LITE runtime cannot render the
# cheatsheet on demand (the PRO reporting templates/engines under
# ``adscan_internal/pro/`` are stripped from this image), so the build
# pipeline pre-renders the PDF in the PRO image and seeds it into the
# build context at ``adscan_internal/assets/cheatsheet/``. The runtime
# ``adscan cheatsheet`` falls back to this static path when the PRO
# renderer module is not importable. See scripts/bake_cheatsheet.sh.
RUN mkdir -p /opt/adscan/static/cheatsheet
COPY adscan_internal/assets/cheatsheet/Quick_Start_Cheatsheet.pdf \
     /opt/adscan/static/cheatsheet/Quick_Start_Cheatsheet.pdf

# Strip PRO-only Client Deliverable Kit modules from the LITE source tree.
# Pass C: ensure deliver.py (the PRO deliverable orchestrator from Pass B)
# is never present in LITE. ``rm -f`` is idempotent — it is a no-op when
# Pass B has not landed yet, and a real strip when it has.
RUN rm -f /opt/adscan-src/adscan_internal/cli/deliver.py
# Note: cheatsheet stays in LITE (operator-facing desk reference). The
# bonuses.py module imports its PRO renderer lazily, so the import
# succeeds in LITE; PRO-only verbs (playbook/checklist/coverage-matrix)
# are gated by the exit-42 protocol in adscan.py before any PRO import
# is attempted.

# Normalize source permissions to avoid host-side restrictive modes leaking into
# the image (e.g. 0700 dirs), which can break imports when running as the
# non-root `adscan` user.
RUN chmod -R a+rX /opt/adscan-src

# Safety assertions: LITE image must not contain private modules.
RUN test ! -d /opt/adscan-src/adscan_internal/pro
RUN test ! -d /opt/adscan-src/adscan_internal/reporting
RUN test ! -f /opt/adscan-src/adscan_internal/services/report_service.py
RUN test ! -f /opt/adscan-src/adscan_internal/report_generator.py
RUN test ! -f /opt/adscan-src/adscan_internal/cli/deliver.py

ENV PYTHONPATH=/opt/adscan-src

RUN printf '%s\n' \
  '#!/usr/bin/env bash' \
  'set -euo pipefail' \
  'exec /opt/adscan/venv/bin/python /opt/adscan-src/adscan.py "$@"' \
  > /usr/local/bin/adscan \
  && chmod +x /usr/local/bin/adscan

# ADSCAN_RUNTIME_VERSION enters scope HERE — narrowest scope possible.
# Every layer above this point is independent of the version timestamp
# and stays cacheable across builds with different versions.
ARG ADSCAN_RUNTIME_VERSION=""
RUN set -eux; \
  if [[ -n "${ADSCAN_RUNTIME_VERSION}" ]]; then \
    printf '%s\n' "${ADSCAN_RUNTIME_VERSION}" > /opt/adscan/version; \
  fi

# Bake the version into the image ENV only at the end, after every
# expensive layer above. The running container still exposes
# ADSCAN_RUNTIME_VERSION without contaminating upstream cache keys.
ENV ADSCAN_RUNTIME_VERSION=${ADSCAN_RUNTIME_VERSION}

ENTRYPOINT ["/usr/local/bin/adscan-entrypoint"]