# Ubuntu 16.04 — glibc 2.23 (no tcache, no top-chunk validation)
# This is the classic environment for House of Force, fastbin dup,
# unsorted bin attack, etc.
#
# Build:  docker build -t mini_httpd_ctf .
# Run:    docker run --rm -it -p 8080:8080 mini_httpd_ctf
#
# For debugging inside the container:
#   docker run --rm -it -p 8080:8080 --cap-add=SYS_PTRACE \
#              --security-opt seccomp=unconfined mini_httpd_ctf bash
#
# Then inside:
#   echo 0 > /proc/sys/kernel/randomize_va_space
#   ./mini_httpd &
#   gdb -p $(pidof mini_httpd)

FROM ubuntu:16.04

RUN apt-get update && apt-get install -y \
    gcc \
    gdb \
    gdbserver \
    make \
    python3 \
    python3-pip \
    net-tools \
    strace \
    ltrace \
    curl \
    && rm -rf /var/lib/apt/lists/*

# pwntools for exploit development
RUN pip3 install pwntools 2>/dev/null || true


RUN curl --proto '=https' --tlsv1.2 -LsSf 'https://install.pwndbg.re' | sh -s -- -t pwndbg-gdb

WORKDIR /ctf
COPY mini_httpd.c Makefile ./

RUN make router

# Disable ASLR inside the container (requires --privileged or SYS_PTRACE)
# If running without privileges, disable on the host instead.
CMD echo 0 > /proc/sys/kernel/randomize_va_space 2>/dev/null; \
    echo "[*] glibc version:"; ldd --version | head -1; \
    echo "[*] checksec:"; readelf -l mini_httpd | grep -E "GNU_STACK|GNU_RELRO" || true; \
    echo ""; \
    exec ./mini_httpd
