Skip to content

Commit 385e701

Browse files
intrudirintrudir
authored
Update base image, work with latest burp, and a few other improvements (#14)
* Update README to explain NS record requirement a bit better * add gitignore to ignore burp jars * Improve init.sh Docker needs sudo privs unless you add your user to the docker group. - Added a func to check if docker perms are good. - Asks user if they wanna add user to docker group - improved script by using funcs instead of repeating code * Copy the certs dir over recursively. the original cp command was failing with ZSH. This shoudl do the same thing and work in all shells * Update certificaterenewal.sh Moved chown cmd from run.sh to here to be able to use $DOMAIN var * Update run.sh Move chown command to cert renewal script * Update Dockerfile Use latest Debian and the compatible Java for latest burp as of july 12 2024 * Update init.sh After MANY MANY hours of troubleshooting.... the symlinks to the cert fies are wrong when they come from certbot container. This fixes them, applies the permissions so that only the burp user on the container can read the privkey file, and finally, FINALLY, burp collab runs docker logs burp + 2024-07-12 23:33:29.092 : Using configuration file /opt/burp/conf/burp.config 2024-07-12 23:33:29.311 : Listening for SMTP on 0.0.0.0:8025 2024-07-12 23:33:29.312 : Listening for SMTP on 0.0.0.0:8587 2024-07-12 23:33:29.312 : Listening for HTTP on 0.0.0.0:9090 2024-07-12 23:33:29.312 : Listening for HTTP on 0.0.0.0:8080 2024-07-12 23:33:29.318 : Listening for DNS on 0.0.0.0:8053 2024-07-12 23:33:29.426 : Listening for SMTPS on 0.0.0.0:8465 2024-07-12 23:33:29.427 : Listening for HTTPS on 0.0.0.0:8443 2024-07-12 23:33:29.427 : Listening for HTTPS on 0.0.0.0:9443 * Update README.md Add UFW docker fix
1 parent 565d10f commit 385e701

File tree

6 files changed

+185
-54
lines changed

6 files changed

+185
-54
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
/burp/pkg/*

‎README.md‎

Lines changed: 80 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,39 @@ This repository includes a set of scripts to install a Burp Collaborator Server
44
The objective is to simplify as much as possible the process of setting up and maintaining the server.
55

66
## Setup your domain
7+
Delegate a domain or subdomain to your soon-to-be burp collaborator server IP address. At the minimum you'll need an NS record for the domain/subdomain to be used.
78

8-
Delegate a subdomain to your soon to be burp collaborator server IP address. At the minimum you'll need a NS record for the subdomain to be used (e.g. burp.example.com) pointing to your new server's A record:
9+
For example, if your collaborator domain is `burpserver.example`, you need to make NS records pointing with an A record to the public IP of the server: `1.2.3.4`
910

10-
```burp.example.com IN NS burpserver.example.com```
11+
Here as an example `dig` command to confirm:
12+
```bash
13+
dig NS burpserver.example
1114

12-
```burpserver.example.com IN A 1.2.3.4```
15+
Output:
16+
; <<>> DiG 9.10.6 <<>> NS burpserver.example
17+
;; global options: +cmd
18+
;; Got answer:
19+
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49449
20+
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 3
21+
22+
;; OPT PSEUDOSECTION:
23+
; EDNS: version: 0, flags:; udp: 4000
24+
;; QUESTION SECTION:
25+
;burpserver.example. IN NS
26+
27+
;; ANSWER SECTION:
28+
burpserver.example. 308 IN NS ns2.burpserver.example.
29+
burpserver.example. 308 IN NS ns1.burpserver.example.
30+
31+
;; ADDITIONAL SECTION:
32+
ns2.burpserver.example. 308 IN A 1.2.3.4
33+
ns1.burpserver.example. 308 IN A 1.2.3.4
34+
35+
;; Query time: 52 msec
36+
;; SERVER: 8.8.8.8#53(8.8.8.8)
37+
;; WHEN: Fri Jul 12 11:20:29 EDT 2024
38+
;; MSG SIZE rcvd: 104
39+
```
1340
1441
Check https://portswigger.net/burp/documentation/collaborator/deploying#dns-configuration for further info.
1542
@@ -53,7 +80,56 @@ The init.sh script will be renamed and disabled, so no accidents may happen.
5380
## Updating Burp Suite
5481
5582
* Download it and make sure you put it in ```./burp/pkg/burp.jar```
56-
* Restart the container with ```docker restart burp```
83+
* Restart the container with ```docker restart burp```
84+
85+
## Docker and UFW
86+
If you use UFW/IPTables as your firewall on the host, both UFW and docker modify the same [iptables](https://en.wikipedia.org/wiki/Iptables "iptables") configurations. Whatever UFW rules you have set, running a docker container completely ignores them and allows traffic, regardless of whether you explicitly block access. In order to fix the issue and be able to use UFW properly with docker, read this:
87+
88+
https://blog.jarrousse.org/2023/03/18/how-to-use-ufw-firewall-with-docker-containers/
89+
90+
These instructions assume you have the default docker set up and didn't try to fix the problem yourself yet.
91+
**Download `ufw-docker` script**
92+
```bash
93+
sudo wget -O /usr/local/bin/ufw-docker https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker
94+
sudo chmod +x /usr/local/bin/ufw-docker
95+
```
96+
97+
Then using the following command to modify the `after.rules` file of `ufw`
98+
```bash
99+
ufw-docker install
100+
```
101+
102+
reboot the host and check if you can access the ports of your container.
103+
104+
Now allow the traffic to the ports on the containers
105+
- Use the actual port thats open on the container, not the one its binded to on the host
106+
- `burp` is the container name, so thats what we use with below command
107+
```bash
108+
docker ps -a
109+
sudo ufw-docker allow burp 8443
110+
```
111+
<img width="1718" alt="Pasted image 20240713201717" src="https://github.com/user-attachments/assets/be02f47e-5088-4d55-a5fa-ae3e9b137430">
112+
113+
I have provided the commands conventiently for you here:
114+
```bash
115+
sudo ufw-docker allow burp 8053
116+
sudo ufw-docker allow burp 8053/udp
117+
sudo ufw-docker allow burp 8080
118+
sudo ufw-docker allow burp 8443
119+
sudo ufw-docker allow burp 8465
120+
sudo ufw-docker allow burp 8587
121+
sudo ufw-docker allow burp 8080
122+
```
123+
124+
I HIGHLY recommend restricting access to your polling port from an IP address or network. Don't allow the general internet to use your burp collab server for free!
125+
- `your_whitelisted_ip` is your public IP to allow access from
126+
- `your_containers_local_ip` is 172.x.x.x
127+
128+
```bash
129+
ufw route allow proto tcp from your_whitelisted_ip to your_containers_local_ip port 9443
130+
```
131+
132+
You should be good to go and have your UFW locked down!
57133
58134
---
59135
**Author:** [Bruno Morisson](https://twitter.com/morisson)

‎burp/Dockerfile‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,25 @@ FROM debian:bullseye-slim
22

33
RUN apt-get update && \
44
apt-get -yqq dist-upgrade
5-
RUN apt-get -yqq install openjdk-17-jdk && \
5+
6+
# Install wget to download JDK
7+
RUN apt-get -yqq install wget && \
68
apt-get autoremove -yqq && \
79
apt-get clean && \
810
/bin/rm -rf /var/lib/apt/lists/*
911

12+
# Download and install Oracle JDK 21
13+
RUN wget https://download.oracle.com/java/21/latest/jdk-21_linux-x64_bin.deb && \
14+
dpkg -i jdk-21_linux-x64_bin.deb && \
15+
rm jdk-21_linux-x64_bin.deb
16+
17+
# Create a user and group for Burp
1018
RUN groupadd -g 999 burp && \
1119
useradd -r -u 999 -g burp -d /opt/burp burp
12-
20+
21+
# Switch to the burp user
1322
USER burp
23+
1424
ADD entrypoint.sh /opt/burp/entrypoint.sh
1525
WORKDIR /opt/burp
1626
ENTRYPOINT ["/opt/burp/entrypoint.sh"]

‎burp/run.sh‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
#!/bin/bash
22
echo Starting burp... && \
3-
chown 999:999 $PWD/burp/keys/privkey.pem && \
43
docker run -d --restart=always --name burp --hostname burp -p 53:8053 -p 53:8053/udp -p 80:8080 -p 443:8443 -p 25:8025 -p 587:8587 -p 465:8465 -p 9090:9090 -p 9443:9443 -v $PWD/burp/keys:/opt/burp/keys:ro -v $PWD/burp/conf:/opt/burp/conf:ro -v $PWD/burp/pkg:/opt/burp/pkg:ro burp && \
54
echo Done.

‎certbot/certificaterenewal.sh‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@ docker stop burp
2626
docker rm burp
2727
cd $BASEDIR && \
2828
./certbot/renew.sh $DOMAIN && \
29-
/bin/cp -f $BASEDIR/certbot/letsencrypt/live/$DOMAIN/*.pem $BASEDIR/burp/keys && \
29+
/bin/cp -r -f $BASEDIR/certbot/letsencrypt/live/$DOMAIN/ $BASEDIR/burp/keys && \
30+
chown 999:999 $PWD/burp/keys/$DOMAIN/privkey.pem && \
3031
./burp/run.sh && \
3132
echo Certificate renewed
3233

‎init.sh‎

Lines changed: 90 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -1,61 +1,105 @@
1-
#!/bin/sh
1+
#!/bin/bash
22

3-
if [ -e ./init.sh_has_been_run ]; then
4-
echo Script has already been run. Bailing out.
5-
exit 0
6-
fi
3+
set -e
74

8-
if [ ! -e ./burp/pkg/burp.jar ]; then
9-
echo ERROR: no burp.jar found. Make sure it is in ./burp/pkg/burp.jar
10-
exit 0
11-
fi
5+
# Check if a file exists
6+
check_file() {
7+
if [ "$1" == "burp.jar" ]; then
8+
local file_path="./burp/pkg/$1"
9+
else
10+
local file_path="$1"
11+
fi
1212

13-
which docker > /dev/null 2>&1
13+
if [ ! -e "$file_path" ]; then
14+
echo "ERROR: $file_path not found. Make sure it is in the correct location."
15+
exit 0
16+
fi
17+
}
1418

15-
if [ $? -eq 1 ]; then
16-
echo ERROR: docker is missing. Please install first
17-
exit 0
18-
fi
19+
# Check if a command exists
20+
check_command() {
21+
which "$1" > /dev/null 2>&1
22+
if [ $? -eq 1 ]; then
23+
echo "ERROR: $1 is missing. Please install first."
24+
exit 0
25+
fi
26+
}
1927

20-
which bc > /dev/null 2>&1
28+
handle_docker_permission_error() {
29+
echo "ERROR: Permission denied while trying to connect to the Docker daemon. Your user likely needs to use 'sudo' with docker, but we can add your user to the docker group and it should fix this."
30+
read -p "Would you like to add your user to the Docker group to fix this? (y/n): " choice
31+
if [ "$choice" == "y" ]; then
32+
sudo usermod -aG docker $USER
33+
echo "User added to the Docker group. Please log out and back in for the changes to take effect, then try the init script again."
34+
else
35+
echo "Exiting script. Please fix the Docker permissions manually."
36+
fi
37+
exit 1
38+
}
2139

22-
if [ $? -eq 1 ]; then
23-
echo ERROR: bc is missing. Please install first
24-
exit 0
40+
if [ -e ./init.sh_has_been_run ]; then
41+
echo "Script has already been run. Bailing out."
42+
exit 0
2543
fi
2644

27-
which openssl > /dev/null 2>&1
28-
if [ $? -eq 1 ]; then
29-
echo ERROR: openssl is missing. Please install first
30-
exit 0
31-
fi
45+
check_file "burp.jar"
46+
check_command "docker"
47+
check_command "bc"
48+
check_command "openssl"
3249

3350
if [ $# -ne 2 ]; then
34-
echo usage: ./init.sh \<domain\> \<ip\>
35-
exit 0
51+
echo "Usage: ./init.sh <domain> <ip>"
52+
exit 0
3653
fi
3754

3855
DOMAIN=$1
3956
IP=$2
40-
METRICS=`LC_CTYPE=C tr -dc A-Za-z0-9 < /dev/urandom | fold -w 10 | head -1`
41-
42-
echo Initialization to be done with domain *.$1 and public ip $2 && \
43-
read -p "Press any key to continue, or CTRL-C to bail out" var_p && \
44-
45-
docker build -t certbot-burp certbot/certbot-dns-burp && \
46-
docker build -t burp burp && \
47-
./certbot/new.sh $DOMAIN && \
48-
/bin/cp -f ./certbot/letsencrypt/live/$DOMAIN/*.pem ./burp/keys && \
49-
/bin/sed -i "s/DOMAIN/$DOMAIN/g" ./burp/conf/burp.config && \
50-
/bin/sed -i "s/IP/$IP/g" ./burp/conf/burp.config && \
51-
/bin/sed -i "s/jnaicmez8/$METRICS/g" ./burp/conf/burp.config && \
52-
./burp/run.sh && \
53-
/bin/mv ./init.sh ./init.sh_has_been_run && \
54-
/bin/chmod 000 ./init.sh_has_been_run && \
55-
/bin/sed -i "s/__DOMAIN__/$DOMAIN/g" ./certbot/certificaterenewal.sh && \
56-
/bin/sed -i "s#__BASEDIR__#$PWD#g" ./certbot/certificaterenewal.sh && \
57-
58-
echo
59-
echo SUCCESS! Burp is now running with the letsencrypt certificate for domain *.$DOMAIN
57+
METRICS=$(LC_CTYPE=C tr -dc A-Za-z0-9 < /dev/urandom | fold -w 10 | head -1)
58+
59+
echo "Initialization to be done with domain *.$1 and public IP $2"
60+
read -p "Press any key to continue, or CTRL-C to bail out" var_p
61+
62+
{
63+
# check if docker works
64+
docker container ls || handle_docker_permission_error
65+
66+
# build the containers
67+
docker build -t certbot-burp certbot/certbot-dns-burp
68+
docker build -t burp burp
69+
70+
# Get certs for the first time. The certbot container will be removed automatically afterwards.
71+
./certbot/new.sh $DOMAIN
72+
73+
# The symlinks from certbot will be wrong.
74+
# Copy the actual certificate files from the archive directory to burp/keys
75+
sudo cp ./certbot/letsencrypt/archive/$DOMAIN/cert1.pem ./burp/keys/cert.pem
76+
sudo cp ./certbot/letsencrypt/archive/$DOMAIN/chain1.pem ./burp/keys/chain.pem
77+
sudo cp ./certbot/letsencrypt/archive/$DOMAIN/fullchain1.pem ./burp/keys/fullchain.pem
78+
sudo cp ./certbot/letsencrypt/archive/$DOMAIN/privkey1.pem ./burp/keys/privkey.pem
79+
80+
# Change ownership of the privkey.pem file to UID 999 and GID 999
81+
sudo chown 999:999 ./burp/keys/privkey.pem
82+
83+
# Replace placeholders in burp config
84+
sudo /bin/sed -i "s/DOMAIN/$DOMAIN/g" ./burp/conf/burp.config
85+
sudo /bin/sed -i "s/IP/$IP/g" ./burp/conf/burp.config
86+
sudo /bin/sed -i "s/jnaicmez8/$METRICS/g" ./burp/conf/burp.config
87+
88+
# run the burp container
89+
./burp/run.sh
90+
sudo /bin/mv ./init.sh ./init.sh_has_been_run
91+
sudo /bin/chmod 000 ./init.sh_has_been_run
92+
93+
# replace placeholders in renewal script
94+
sudo /bin/sed -i "s/__DOMAIN__/$DOMAIN/g" ./certbot/certificaterenewal.sh
95+
sudo /bin/sed -i "s#__BASEDIR__#$PWD#g" ./certbot/certificaterenewal.sh
96+
} || {
97+
echo "An error occurred during the execution of the script. Please check the output for details."
98+
exit 1
99+
}
100+
101+
echo
102+
echo "SUCCESS! Burp is now running with the letsencrypt certificate for domain *.$DOMAIN"
60103
echo
61-
echo Your metrics path was set to $METRICS. Change addressWhitelist to access it remotely.
104+
echo "Your metrics path was set to $METRICS. Change addressWhitelist to access it remotely."
105+
echo "Initialization script has completed."

0 commit comments

Comments
 (0)