Dockerfile.runtime

###############################################################################
# ADscan runtime image (single source of truth)
#
# Build targets:
# - runtime-pro: uses compiled binary from dist/adscan (PyArmor/PyInstaller flow)
# - runtime-lite: uses open-source Python sources (no PyArmor/PyInstaller)
#
# This file centralizes all shared runtime dependencies/tools so LITE and PRO
# never drift when adding system packages or tooling.
###############################################################################

###############################################################################
# RustHound-CE build stage (Kerberos/GSSAPI enabled)
###############################################################################
FROM rust:1-bookworm AS rusthound_builder

ARG DEBIAN_FRONTEND=noninteractive
SHELL ["/bin/bash", "-euo", "pipefail", "-c"]

RUN apt-get update -y && apt-get install -y --no-install-recommends \
      ca-certificates \
      clang \
      pkg-config \
      libsasl2-dev \
      libkrb5-dev \
      libssl-dev \
      libldap2-dev \
    && rm -rf /var/lib/apt/lists/*

# Pin RustHound-CE version (must match ADscan expectations)
RUN cargo install --locked --version 2.4.7 rusthound-ce

###############################################################################
# John the Ripper build stage (generic john binary + official converters)
###############################################################################
FROM debian:trixie-slim AS john_builder

ARG DEBIAN_FRONTEND=noninteractive
ARG JOHN_BLEEDING_JUMBO_COMMIT=d8f5b0138e6f9fe24ab453f886dcaa2abb2e5407
SHELL ["/bin/bash", "-euo", "pipefail", "-c"]

RUN apt-get update -y && apt-get install -y --no-install-recommends \
      ca-certificates \
      git \
      build-essential \
      automake \
      autoconf \
      libtool \
      pkg-config \
      zlib1g-dev \
      libbz2-dev \
      libpcap-dev \
      libssl-dev \
      libgmp-dev \
    && rm -rf /var/lib/apt/lists/*

RUN set -eux; \
  mkdir -p /opt/adscan/tools/john; \
  git clone https://github.com/openwall/john.git /opt/adscan/tools/john; \
  git -C /opt/adscan/tools/john checkout "${JOHN_BLEEDING_JUMBO_COMMIT}"; \
  ( \
    cd /opt/adscan/tools/john/src && \
    make -s -f Makefile.legacy clean && \
    make -sj"$(nproc)" -f Makefile.legacy linux-x86-64 && \
    cp /opt/adscan/tools/john/run/john /tmp/john-generic && \
    ./configure --disable-native-tests --enable-simd=sse2 >/dev/null && \
    make -s clean && \
    make -sj"$(nproc)" && \
    cp /tmp/john-generic /opt/adscan/tools/john/run/john-generic && \
    ln -sf /opt/adscan/tools/john/run/john-generic /opt/adscan/tools/john/run/john \
  ); \
  chmod +x /opt/adscan/tools/john/run/john /opt/adscan/tools/john/run/john-generic

###############################################################################
# Shared runtime base for both PRO and LITE images
###############################################################################
FROM debian:trixie-slim AS runtime-common

ARG DEBIAN_FRONTEND=noninteractive
ARG JOHN_BLEEDING_JUMBO_COMMIT=d8f5b0138e6f9fe24ab453f886dcaa2abb2e5407
ARG CREDSWEEPER_VERSION=1.15.1
ARG HASHCAT_VERSION=7.1.2
ARG LIGOLO_NG_VERSION=0.8.3
ARG MEDUSA_COMMIT=fef1e1f0ee91f6108a5a48d3b3c11dc4df40b122
ARG FREERDP_VERSION=3.24.1
ARG FREERDP_COMMIT=b6e770ccba87c58ffd0a55366fef33361798e39c
SHELL ["/bin/bash", "-euo", "pipefail", "-c"]

ENV ADSCAN_HOME=/opt/adscan \
    HOME=/opt/adscan \
    XDG_CONFIG_HOME=/opt/adscan/.config \
    NPM_CONFIG_UPDATE_NOTIFIER=false \
    PATH="/opt/adscan/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

RUN apt-get update -y && apt-get install -y --no-install-recommends \
      ca-certificates \
      curl \
      git \
      ripgrep \
      jq \
      bat \
      gosu \
      sudo \
      libcap2-bin \
      net-tools \
      iputils-ping \
      iproute2 \
      procps \
      unzip \
      p7zip-full \
      wget \
      rclone \
      xz-utils \
      bzip2 \
      python3 \
      python3-pip \
      python3-venv \
      python3-dev \
      chromium \
      chromium-driver \
      nodejs \
      npm \
      build-essential \
      automake \
      autoconf \
      libtool \
      pkg-config \
      make \
      cmake \
      ninja-build \
      clang \
      llvm \
      libclang-dev \
      libffi-dev \
      libssl-dev \
      zlib1g-dev \
      libbz2-dev \
      libreadline-dev \
      libsqlite3-dev \
      libncurses-dev \
      libncursesw5-dev \
      tk-dev \
      liblzma-dev \
      libgmp-dev \
      libkrb5-dev \
      libgssapi-krb5-2 \
      libsasl2-2 \
      libsasl2-modules-gssapi-mit \
      krb5-user \
      libssl3t64 \
      libldap2 \
      libldns-dev \
      nmap \
      hydra \
      pocl-opencl-icd \
      samba \
      samba-common-bin \
      mono-devel \
      mingw-w64 \
      gcc-mingw-w64-x86-64 \
      musl-tools \
      tesseract-ocr \
      antiword \
      moreutils \
      libreoffice \
      graphviz \
      fontconfig \
      fonts-crosextra-carlito \
      fonts-crosextra-caladea \
      fonts-liberation \
      libx11-dev \
      libxext-dev \
      libxinerama-dev \
      libxcursor-dev \
      libxkbcommon-dev \
      libxkbfile-dev \
      libxrandr-dev \
      libxi-dev \
      libxrender-dev \
      libxv-dev \
      libxfixes-dev \
      libxdamage-dev \
      libxtst-dev \
      libfuse3-dev \
      libpam0g-dev \
      libasound2-dev \
      libcups2-dev \
      libpulse-dev \
      libjpeg-dev \
      libpng-dev \
      libavutil-dev \
      libavcodec-dev \
      libswscale-dev \
      libusb-1.0-0-dev \
      libpcsclite-dev \
      libsystemd-dev \
      libwayland-dev \
      wayland-protocols \
      libepoxy-dev \
      libicu-dev \
      libmagic1 \
      ntpsec-ntpdate \
      unbound \
      unbound-anchor \
      dns-root-data \
    && mkdir -p /etc/OpenCL/vendors \
    && printf '%s\n' 'libnvidia-opencl.so.1' > /etc/OpenCL/vendors/nvidia.icd \
    && rm -rf /var/lib/apt/lists/*

# Codex CLI (official ChatGPT plan sign-in path for Plus/Pro subscriptions).
# Installed globally so `ask login codex` and `ask` can use `codex` directly.
RUN set -eux; \
  npm install --global @openai/codex; \
  codex --version

# Base runtime layout
RUN mkdir -p /opt/adscan/{bin,tools,tool_venvs,wordlists,logs,fonts} /workspaces \
  && fc-cache -f \
  && chmod -R 0777 /opt/adscan /workspaces

COPY --from=john_builder /opt/adscan/tools/john/run /opt/adscan/tools/john/run

# Install Python tool environments (mirrors `PipToolsConfig` from adscan.py)
RUN set -eux; \
  pip_retry() { \
    local python_bin="$1"; shift; \
    local attempt=1; \
    local max_attempts=4; \
    until "$python_bin" -m pip install --no-cache-dir --retries 8 --timeout 120 "$@"; do \
      if [ "$attempt" -ge "$max_attempts" ]; then \
        echo "pip install failed after ${max_attempts} attempts: $*" >&2; \
        return 1; \
      fi; \
      echo "pip install failed (attempt ${attempt}/${max_attempts}) for: $*" >&2; \
      sleep $((attempt * 5)); \
      attempt=$((attempt + 1)); \
    done; \
  }; \
  python3 -m venv /opt/adscan/tool_venvs/impacket/venv; \
  pip_retry /opt/adscan/tool_venvs/impacket/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/impacket/venv/bin/python "impacket==0.13.0" "pycryptodome==3.23.0"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/netexec/venv; \
  pip_retry /opt/adscan/tool_venvs/netexec/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/netexec/venv/bin/python "git+https://github.com/Pennyw0rth/NetExec.git@f187717"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/certipy/venv; \
  pip_retry /opt/adscan/tool_venvs/certipy/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/certipy/venv/bin/python "certipy-ad==5.0.4"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/bloodyad/venv; \
  pip_retry /opt/adscan/tool_venvs/bloodyad/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/bloodyad/venv/bin/python "bloodyAD==2.5.1" "minikerberos==0.4.9"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/bloodhound-ce-py/venv; \
  pip_retry /opt/adscan/tool_venvs/bloodhound-ce-py/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/bloodhound-ce-py/venv/bin/python "bloodhound-ce==1.9.1"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/weakpass/venv; \
  pip_retry /opt/adscan/tool_venvs/weakpass/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/weakpass/venv/bin/python "weakpass-lookup"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/enum-trusts/venv; \
  pip_retry /opt/adscan/tool_venvs/enum-trusts/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/enum-trusts/venv/bin/python "git+https://github.com/ADScanPro/enum-trusts.git@f7eae14"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/manspider/venv; \
  pip_retry /opt/adscan/tool_venvs/manspider/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/manspider/venv/bin/python "git+https://github.com/ADScanPro/MANSPIDER@cedb138"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/credsweeper/venv; \
  pip_retry /opt/adscan/tool_venvs/credsweeper/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/credsweeper/venv/bin/python "credsweeper==${CREDSWEEPER_VERSION}"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/pypykatz/venv; \
  pip_retry /opt/adscan/tool_venvs/pypykatz/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/pypykatz/venv/bin/python "pypykatz==0.6.13"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/lsassy/venv; \
  pip_retry /opt/adscan/tool_venvs/lsassy/venv/bin/python -U pip; \
  pip_retry /opt/adscan/tool_venvs/lsassy/venv/bin/python "lsassy==3.1.16"; \
  \
  chmod -R 0777 /opt/adscan/tool_venvs

# External tools (git/curl)
RUN set -eux; \
  mkdir -p /opt/adscan/tools; \
  curl -fsSL "https://hashcat.net/files/hashcat-${HASHCAT_VERSION}.7z" -o /tmp/hashcat.7z; \
  7z x /tmp/hashcat.7z -o/opt/adscan/tools >/dev/null; \
  test -x "/opt/adscan/tools/hashcat-${HASHCAT_VERSION}/hashcat.bin"; \
  ln -sf "/opt/adscan/tools/hashcat-${HASHCAT_VERSION}/hashcat.bin" /opt/adscan/bin/hashcat; \
  /opt/adscan/bin/hashcat --version | grep -F "v${HASHCAT_VERSION}"; \
  rm -f /tmp/hashcat.7z; \
  \
  git clone --depth 1 https://github.com/Greenwolf/ntlm_theft.git /opt/adscan/tools/ntlm_theft; \
  mkdir -p /opt/adscan/tools/firepwd; \
  curl -fsSL https://raw.githubusercontent.com/lclevy/firepwd/refs/heads/master/firepwd.py -o /opt/adscan/tools/firepwd/firepwd.py; \
  curl -fsSL https://raw.githubusercontent.com/lclevy/firepwd/refs/heads/master/requirements.txt -o /opt/adscan/tools/firepwd/requirements.txt; \
  python3 -m venv /opt/adscan/tool_venvs/firepwd/venv; \
  /opt/adscan/tool_venvs/firepwd/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/firepwd/venv/bin/python -m pip install --no-cache-dir -r /opt/adscan/tools/firepwd/requirements.txt; \
  \
  git clone --depth 1 https://github.com/spextat0r/LSA-Reaper.git /opt/adscan/tools/LSA-Reaper; \
  python3 -m venv --system-site-packages /opt/adscan/tool_venvs/LSA-Reaper/venv; \
  /opt/adscan/tool_venvs/LSA-Reaper/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/LSA-Reaper/venv/bin/python -m pip install --no-cache-dir -r /opt/adscan/tools/LSA-Reaper/requirements.txt impacket; \
  \
  mkdir -p /opt/adscan/tools/PKINITtools; \
  curl -fsSL https://raw.githubusercontent.com/dirkjanm/PKINITtools/refs/heads/master/gettgtpkinit.py -o /opt/adscan/tools/PKINITtools/gettgtpkinit.py; \
  curl -fsSL https://raw.githubusercontent.com/dirkjanm/PKINITtools/refs/heads/master/getnthash.py -o /opt/adscan/tools/PKINITtools/getnthash.py; \
  curl -fsSL https://raw.githubusercontent.com/dirkjanm/PKINITtools/refs/heads/master/requirements.txt -o /opt/adscan/tools/PKINITtools/requirements.txt; \
  python3 -m venv /opt/adscan/tool_venvs/PKINITtools/venv; \
  /opt/adscan/tool_venvs/PKINITtools/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/PKINITtools/venv/bin/python -m pip install --no-cache-dir -r /opt/adscan/tools/PKINITtools/requirements.txt; \
  \
  mkdir -p /opt/adscan/tools/kerbrute; \
  curl -fsSL https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64 -o /opt/adscan/tools/kerbrute/kerbrute; \
  chmod +x /opt/adscan/tools/kerbrute/kerbrute; \
  \
  mkdir -p /opt/adscan/tools/ligolo-ng/proxy/linux-amd64; \
  curl -fsSL \
    "https://github.com/nicocha30/ligolo-ng/releases/download/v${LIGOLO_NG_VERSION}/ligolo-ng_proxy_${LIGOLO_NG_VERSION}_linux_amd64.tar.gz" \
    -o /tmp/ligolo_proxy.tar.gz; \
  tar -xzf /tmp/ligolo_proxy.tar.gz -C /opt/adscan/tools/ligolo-ng/proxy/linux-amd64 proxy; \
  chmod +x /opt/adscan/tools/ligolo-ng/proxy/linux-amd64/proxy; \
  setcap cap_net_admin,cap_net_bind_service+ep /opt/adscan/tools/ligolo-ng/proxy/linux-amd64/proxy; \
  ln -sf /opt/adscan/tools/ligolo-ng/proxy/linux-amd64/proxy /opt/adscan/bin/ligolo-proxy; \
  rm -f /tmp/ligolo_proxy.tar.gz; \
  \
  mkdir -p /opt/adscan/tools/ligolo-ng/agent/windows-amd64; \
  curl -fsSL \
    "https://github.com/nicocha30/ligolo-ng/releases/download/v${LIGOLO_NG_VERSION}/ligolo-ng_agent_${LIGOLO_NG_VERSION}_windows_amd64.zip" \
    -o /tmp/ligolo_agent_windows_amd64.zip; \
  unzip -q /tmp/ligolo_agent_windows_amd64.zip agent.exe -d /opt/adscan/tools/ligolo-ng/agent/windows-amd64; \
  rm -f /tmp/ligolo_agent_windows_amd64.zip; \
  \
  git clone --depth 1 https://github.com/lgandx/Responder.git /opt/adscan/tools/responder; \
  python3 -m venv /opt/adscan/tool_venvs/responder/venv; \
  /opt/adscan/tool_venvs/responder/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/responder/venv/bin/python -m pip install --no-cache-dir -r /opt/adscan/tools/responder/requirements.txt; \
  \
  git clone --depth 1 https://github.com/p0dalirius/Coercer.git /opt/adscan/tools/coercer; \
  python3 -m venv /opt/adscan/tool_venvs/coercer/venv; \
  /opt/adscan/tool_venvs/coercer/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/coercer/venv/bin/python -m pip install --no-cache-dir -r /opt/adscan/tools/coercer/requirements.txt; \
  \
  git clone https://github.com/jmk-foofus/medusa.git /opt/adscan/tools/medusa; \
  git -C /opt/adscan/tools/medusa checkout "${MEDUSA_COMMIT}"; \
  git clone --branch "${FREERDP_VERSION}" --depth 1 https://github.com/FreeRDP/FreeRDP.git /opt/adscan/tools/freerdp; \
  test "$(git -C /opt/adscan/tools/freerdp rev-parse HEAD)" = "${FREERDP_COMMIT}"; \
  cmake -S /opt/adscan/tools/freerdp -B /opt/adscan/tools/freerdp/build -G Ninja \
    -DCMAKE_BUILD_TYPE=Release \
    -DCMAKE_INSTALL_PREFIX=/opt/adscan/tools/freerdp/install \
    -DBUILD_TESTING=OFF \
    -DWITH_SERVER=OFF \
    -DWITH_X11=ON \
    -DWITH_WAYLAND=ON; \
  cmake --build /opt/adscan/tools/freerdp/build --parallel "$(nproc)"; \
  cmake --install /opt/adscan/tools/freerdp/build; \
  ln -sf /opt/adscan/tools/freerdp/install/bin/xfreerdp /opt/adscan/bin/xfreerdp; \
  ln -sf /opt/adscan/tools/freerdp/install/bin/xfreerdp /opt/adscan/bin/xfreerdp3; \
  printf '%s\n' '/opt/adscan/tools/freerdp/install/lib' '/opt/adscan/tools/freerdp/install/lib64' \
    > /etc/ld.so.conf.d/adscan-freerdp.conf; \
  ldconfig; \
  ( \
    export PKG_CONFIG_PATH="/opt/adscan/tools/freerdp/install/lib/pkgconfig:/opt/adscan/tools/freerdp/install/lib64/pkgconfig${PKG_CONFIG_PATH:+:${PKG_CONFIG_PATH}}" && \
    export CPPFLAGS="-I/opt/adscan/tools/freerdp/install/include/freerdp3 -I/opt/adscan/tools/freerdp/install/include/winpr3${CPPFLAGS:+ ${CPPFLAGS}}" && \
    export CFLAGS="-I/opt/adscan/tools/freerdp/install/include${CFLAGS:+ ${CFLAGS}}" && \
    export LDFLAGS="-L/opt/adscan/tools/freerdp/install/lib -L/opt/adscan/tools/freerdp/install/lib64 -Wl,-rpath,/opt/adscan/tools/freerdp/install/lib -Wl,-rpath,/opt/adscan/tools/freerdp/install/lib64${LDFLAGS:+ ${LDFLAGS}}" && \
    cd /opt/adscan/tools/medusa; \
    make distclean >/dev/null 2>&1 || true; \
    autoreconf -fi && \
    ./configure --prefix=/opt/adscan/tools/medusa/install --with-freerdp=/opt/adscan/tools/freerdp/install && \
    make -sj"$(nproc)" && \
    make install \
  ); \
  ln -sf /opt/adscan/tools/medusa/install/bin/medusa /opt/adscan/bin/medusa; \
  /opt/adscan/bin/xfreerdp --version; \
  /opt/adscan/bin/medusa -d | grep -i 'rdp'; \
  \
  chmod +x /opt/adscan/tools/john/run/john /opt/adscan/tools/john/run/john-generic; \
  for tool in john keepass2john keepass2john.py zip2john zip2john.py pfx2john pfx2john.py ansible2john ansible2john.py; do \
    if [ -e "/opt/adscan/tools/john/run/${tool}" ]; then \
      chmod +x "/opt/adscan/tools/john/run/${tool}" || true; \
      ln -sf "/opt/adscan/tools/john/run/${tool}" "/opt/adscan/bin/${tool}"; \
    fi; \
  done; \
  if [ -e "/opt/adscan/tools/john/run/john.conf" ]; then \
    ln -sf "/opt/adscan/tools/john/run/john.conf" "/opt/adscan/bin/john.conf"; \
  fi; \
  \
  git clone --depth 1 https://github.com/blechschmidt/massdns.git /opt/adscan/tools/massdns; \
  make -C /opt/adscan/tools/massdns; \
  chmod +x /opt/adscan/tools/massdns/bin/massdns; \
  ln -sf /opt/adscan/tools/massdns/bin/massdns /opt/adscan/bin/massdns; \
  \
  chmod -R 0777 /opt/adscan/tools /opt/adscan/tool_venvs

# SysWhispers4 – direct-syscall stub generator for evasion-compiled Windows binaries.
# mingw-w64 (already installed above) provides the x86_64-w64-mingw32-g++ cross-compiler
# required by the binary_ops Tier-2 pipeline.
RUN set -eux; \
  git clone --depth 1 https://github.com/JoasASantos/SysWhispers4.git /opt/adscan/tools/syswhispers4; \
  python3 -m venv /opt/adscan/tool_venvs/syswhispers4/venv; \
  /opt/adscan/tool_venvs/syswhispers4/venv/bin/python -m pip install --no-cache-dir -U pip; \
  if [ -f /opt/adscan/tools/syswhispers4/requirements.txt ]; then \
    /opt/adscan/tool_venvs/syswhispers4/venv/bin/python -m pip install --no-cache-dir \
      -r /opt/adscan/tools/syswhispers4/requirements.txt; \
  fi; \
  python3 /opt/adscan/tools/syswhispers4/syswhispers.py --help >/dev/null 2>&1 || true; \
  chmod -R 0777 /opt/adscan/tools/syswhispers4 /opt/adscan/tool_venvs/syswhispers4

# Donut – PE-to-shellcode converter for the Tier-3 in-memory loader pipeline.
# Installed to /opt/adscan/bin/ which is on PATH (see ENV above).
# CFLAGS=-w suppresses deprecation warnings that would fail on GCC 13+ with -Werror.
RUN set -eux; \
  git clone --depth 1 https://github.com/TheWover/donut.git /tmp/donut_build; \
  make -C /tmp/donut_build CFLAGS="-w -O2"; \
  cp /tmp/donut_build/donut /opt/adscan/bin/donut; \
  chmod 0755 /opt/adscan/bin/donut; \
  rm -rf /tmp/donut_build

# Windows attack binaries (binary_ops catalog – Tier 1 prebuilt cache).
# Stored at /opt/adscan/tools/windows-tools/<name>/<filename> to match
# get_adscan_home() / "tools" / "windows-tools" with ADSCAN_HOME=/opt/adscan.
ARG MIMIKATZ_VERSION=2.2.0-20220919
ARG RUBEUS_COMMIT=e37fa53
ARG WHISKER_COMMIT=9a236c063e37f2d59c1637bdefcae6b4371bf466
ARG SHARPHOUND_VERSION=v2.10.0
ARG KRBRELAYUP_URL=https://kb.offsec.nl/tools/techniques/krbrelayup/files/KrbRelayUp.exe
ARG RUNASCS_VERSION=1.5
RUN set -eux; \
  mkdir -p \
    /opt/adscan/tools/windows-tools/mimikatz \
    /opt/adscan/tools/windows-tools/rubeus \
    /opt/adscan/tools/windows-tools/certify \
    /opt/adscan/tools/windows-tools/whisker \
    /opt/adscan/tools/windows-tools/seatbelt \
    /opt/adscan/tools/windows-tools/sharphound \
    /opt/adscan/tools/windows-tools/krbrelayup \
    /opt/adscan/tools/windows-tools/runascs; \
  \
  # mimikatz – credential extraction (official gentilkiwi release ZIP)
  curl -fsSL \
    "https://github.com/gentilkiwi/mimikatz/releases/download/${MIMIKATZ_VERSION}/mimikatz_trunk.zip" \
    -o /tmp/mimikatz.zip; \
  unzip -p /tmp/mimikatz.zip x64/mimikatz.exe \
    > /opt/adscan/tools/windows-tools/mimikatz/mimikatz.exe; \
  rm /tmp/mimikatz.zip; \
  \
  # Rubeus – Kerberos attacks (Ghostpack compiled binaries mirror)
  curl -fsSL \
    "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/Rubeus.exe" \
    -o /opt/adscan/tools/windows-tools/rubeus/Rubeus.exe; \
  \
  # Certify – ADCS exploitation (Ghostpack compiled binaries mirror)
  curl -fsSL \
    "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/Certify.exe" \
    -o /opt/adscan/tools/windows-tools/certify/Certify.exe; \
  \
  # Whisker – Shadow credentials.
  # The old Ghostpack-CompiledBinaries mirror stopped shipping Whisker.exe,
  # so build it from the official source to keep the image reproducible.
  git clone --depth 1 https://github.com/eladshamir/Whisker.git /tmp/Whisker; \
  git -C /tmp/Whisker checkout "${WHISKER_COMMIT}"; \
  perl -0pi -e 's#<Reference Include="System.DirectoryServices" />#<Reference Include="System.DirectoryServices" />\n    <Reference Include="System.Numerics" />#' \
    /tmp/Whisker/Whisker/Whisker.csproj; \
  build_tool=""; \
  if command -v msbuild >/dev/null 2>&1; then \
    build_tool="msbuild"; \
  elif command -v xbuild >/dev/null 2>&1; then \
    build_tool="xbuild"; \
  else \
    echo "Neither msbuild nor xbuild is available for Whisker build" >&2; \
    exit 1; \
  fi; \
  "${build_tool}" /tmp/Whisker/Whisker.sln /p:Configuration=Release /verbosity:minimal; \
  test -f /tmp/Whisker/Whisker/bin/Release/Whisker.exe; \
  cp /tmp/Whisker/Whisker/bin/Release/Whisker.exe /opt/adscan/tools/windows-tools/whisker/Whisker.exe; \
  rm -rf /tmp/Whisker; \
  \
  # Seatbelt – host security enumeration (Ghostpack compiled binaries mirror)
  curl -fsSL \
    "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/Seatbelt.exe" \
    -o /opt/adscan/tools/windows-tools/seatbelt/Seatbelt.exe; \
  \
  # SharpHound – BloodHound collection from inside the target.
  # Keep this aligned with the managed BloodHound CE version. For BH CE v8.7.0,
  # upstream pins SHARPHOUND_VERSION=v2.10.0 in their Dockerfiles.
  curl -fsSL \
    "https://github.com/SpecterOps/SharpHound/releases/download/${SHARPHOUND_VERSION}/SharpHound_${SHARPHOUND_VERSION}_windows_x86.zip" \
    -o /tmp/sharphound.zip; \
  unzip -p /tmp/sharphound.zip SharpHound.exe \
    > /opt/adscan/tools/windows-tools/sharphound/SharpHound.exe; \
  rm -f /tmp/sharphound.zip; \
  \
  # KrbRelayUp – local privilege escalation via Kerberos relay.
  # The historical GitHub release URL now returns 404 and the source tree
  # requires a larger Mono/xbuild compatibility patch set than we want inside
  # the runtime image, so use the maintained OffSec knowledge-base binary.
  curl -fsSL "${KRBRELAYUP_URL}" \
    -o /opt/adscan/tools/windows-tools/krbrelayup/KrbRelayUp.exe; \
  \
  # RunasCs – run as different user (official GitHub release ZIP)
  # Also symlinked to the legacy path so runascs_manager.py finds it.
  curl -fsSL \
    "https://github.com/antonioCoco/RunasCs/releases/download/v${RUNASCS_VERSION}/RunasCs.zip" \
    -o /tmp/runascs.zip; \
  unzip -p /tmp/runascs.zip RunasCs.exe \
    > /opt/adscan/tools/windows-tools/runascs/RunasCs.exe; \
  rm /tmp/runascs.zip; \
  mkdir -p /opt/adscan/tools/runascs/windows-amd64; \
  ln -sf \
    /opt/adscan/tools/windows-tools/runascs/RunasCs.exe \
    /opt/adscan/tools/runascs/windows-amd64/RunasCs.exe; \
  \
  chmod -R 0777 /opt/adscan/tools/windows-tools

# Wordlists
RUN set -eux; \
  mkdir -p /opt/adscan/wordlists; \
  curl -fsSL https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt -o /opt/adscan/wordlists/rockyou.txt; \
  curl -fsSL https://gist.github.com/The-Viper-One/a1ee60d8b3607807cc387d794e809f0b/raw/b7d83af6a8bbb43013e04f78328687d19d0cf9a7/kerberoast_pws.xz -o /opt/adscan/wordlists/kerberoast_pws.xz; \
  xz -d -c /opt/adscan/wordlists/kerberoast_pws.xz > /opt/adscan/wordlists/kerberoast_pws; \
  curl -fsSL https://weakpass.com/download/2073/hashmob.net_2025.medium.found.7z -o /opt/adscan/wordlists/hashmob.net_2025.medium.found.7z; \
  7z x -y -o/opt/adscan/wordlists /opt/adscan/wordlists/hashmob.net_2025.medium.found.7z; \
  curl -fsSL https://weakpass.com/download/1938/kaonashi14M.txt.7z -o /opt/adscan/wordlists/kaonashi14M.txt.7z; \
  7z x -y -o/opt/adscan/wordlists /opt/adscan/wordlists/kaonashi14M.txt.7z; \
  mkdir -p /usr/share/wordlists; \
  git clone --depth 1 https://github.com/insidetrust/statistically-likely-usernames.git /usr/share/wordlists/statistically-likely-usernames; \
  rm -f /opt/adscan/wordlists/kerberoast_pws.xz; \
  rm -f /opt/adscan/wordlists/hashmob.net_2025.medium.found.7z; \
  rm -f /opt/adscan/wordlists/kaonashi14M.txt.7z; \
  chmod -R 0777 /opt/adscan/wordlists /usr/share/wordlists/statistically-likely-usernames

COPY adscan_internal/assets/wordlists/kerberos-format-inference.txt /opt/adscan/wordlists/kerberos-format-inference.txt
COPY adscan_internal/assets/wordlists/kerberos-format-inference.json /opt/adscan/wordlists/kerberos-format-inference.json

# RustHound-CE (Kerberos-capable build)
COPY --from=rusthound_builder /usr/local/cargo/bin/rusthound-ce /usr/local/bin/rusthound-ce
RUN rusthound-ce --version

# Unbound container configuration
COPY docker/unbound_container_base.conf /etc/unbound/unbound.conf
COPY docker/unbound_adscan_control.conf /etc/unbound/unbound.conf.d/00-adscan-control.conf

COPY docker/adscan_entrypoint.sh /usr/local/bin/adscan-entrypoint
RUN chmod +x /usr/local/bin/adscan-entrypoint

###############################################################################
# PRO target: compiled binary runtime
###############################################################################
FROM runtime-common AS runtime-pro

COPY dist/adscan /usr/local/bin/adscan
RUN chmod +x /usr/local/bin/adscan

ENTRYPOINT ["/usr/local/bin/adscan-entrypoint"]

###############################################################################
# LITE target: source runtime (open-source)
###############################################################################
FROM runtime-common AS runtime-lite

# Runtime Python dependencies for source-mode ADscan CLI.
RUN set -eux; \
  python3 -m venv /opt/adscan/venv; \
  /opt/adscan/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/venv/bin/python -m pip install --no-cache-dir \
    prompt_toolkit==3.0.52 \
    psutil==7.2.2 \
    rich==13.9.4 \
    python-docx==1.2.0 \
    openpyxl==3.1.5 \
    netifaces==0.11.0 \
    neo4j==6.1.0 \
    posthog==7.9.3 \
    certifi==2026.1.4 \
    ipaddress==1.0.23 \
    python-dotenv==1.2.1 \
    sentry-sdk==2.52.0 \
    packaging==25.0 \
    questionary==2.1.1 \
    pypsrp==0.9.0 \
    pydantic-settings==2.13.1 \
    pydantic-ai==1.62.0 \
    certihound==0.3.0 \
    gssapi==1.10.1 \
    python-magic==0.4.27 \
    markitdown==0.1.5 \
    credsweeper==${CREDSWEEPER_VERSION} \
    pykeepass==4.1.1.post1 \
    impacket==0.13.0 \
    pycryptodome==3.23.0 \
    gpp-decrypt==2.0.0 \
    requests==2.32.5 \
    matplotlib==3.10.8 \
    graphviz==0.21 \
    pyarrow==21.0.0 \
    rustworkx==0.15.1 \
    selenium==4.31.0 \
    textual==0.80.1

COPY adscan.py /opt/adscan-src/adscan.py
COPY adscan_core /opt/adscan-src/adscan_core
COPY adscan_internal /opt/adscan-src/adscan_internal
COPY adscan_launcher /opt/adscan-src/adscan_launcher
COPY custom_config.yaml /opt/adscan-src/custom_config.yaml
COPY pyproject.toml /opt/adscan-src/pyproject.toml

# Normalize source permissions to avoid host-side restrictive modes leaking into
# the image (e.g. 0700 dirs), which can break imports when running as the
# non-root `adscan` user.
RUN chmod -R a+rX /opt/adscan-src

# Safety assertions: LITE image must not contain private modules.
RUN test ! -d /opt/adscan-src/adscan_internal/pro
RUN test ! -d /opt/adscan-src/adscan_internal/reporting
RUN test ! -f /opt/adscan-src/adscan_internal/services/report_service.py
RUN test ! -f /opt/adscan-src/adscan_internal/report_generator.py

ENV PYTHONPATH=/opt/adscan-src

RUN printf '%s\n' \
  '#!/usr/bin/env bash' \
  'set -euo pipefail' \
  'exec /opt/adscan/venv/bin/python /opt/adscan-src/adscan.py "$@"' \
  > /usr/local/bin/adscan \
  && chmod +x /usr/local/bin/adscan

ENTRYPOINT ["/usr/local/bin/adscan-entrypoint"]