v2.1.2 核心优化与多架构发布 (#561)

* feat: v2.1.0 核心重构与功能增强 ## 架构重构 - 全局变量消除，迁移至 Config/State 对象 - SMB 插件融合（smb/smb2/smbghost/smbinfo） - 服务探测重构，实现 Nmap 风格 fallback 机制 - 输出系统重构，TXT 实时刷盘 + 双写机制 - i18n 框架升级至 go-i18n ## 性能优化 - 正则表达式预编译 - 内存优化 map[string]struct{} - 并发指纹匹配 - SOCKS5 连接复用 - 滑动窗口调度 + 自适应线程池 ## 新功能 - Web 管理界面 - 多格式 POC 适配（xray/afrog） - 增强指纹库（3139条） - Favicon hash 指纹识别 - 插件选择性编译（Build Tags） - fscan-lab 靶场环境 - 默认端口扩展（62→133） ## 构建系统 - 添加 no_local tag 支持排除本地插件 - 多版本构建：fscan/fscan-nolocal/fscan-web - CI 添加 snapshot 模式支持仅测试构建 ## Bug 修复 - 修复 120+ 个问题，包括 RDP panic、批量扫描漏报、 JSON 输出格式、Redis 检测、Context 超时等 ## 测试增强 - 单元测试覆盖率 74-100% - 并发安全测试 - 集成测试（Web/端口/服务/SSH/ICMP） * fix(ci): 移除 PR 对 Project 自动化的触发 * fix: Elasticsearch未授权检测优先于爆破 (#554) * fix: 修复RDP爆破高误报率问题 (#555) - 移除 screen.go 中错误的认证结果覆盖逻辑 - 启用 NLA 协议的 ErrorCode 字段检测 - 添加 PubKeyAuth 验证确保认证真正成功 - 修复 io.go 中错误被静默忽略的问题 - 修复 socket.go/io.go 中可能导致 panic 的代码 - 修复 screen.go 中文件句柄泄漏和 log.Panic * fix: 修复-user/-pwd凭据参数不生效的问题问题原因： - Parse()解析凭据后更新globalConfig - 但BuildConfigFromFlags()创建新Config时使用默认字典 - 导致解析的UserPassPairs等凭据信息被丢弃修复内容： 1. initialize.go: 将Parse解析的凭据结果应用到新Config 2. credential.go: 单用户密码对时创建UserPassPairs 3. rdp.go: 单凭据测试时跳过指纹识别，减少连接次数 * feat: RDP使用NLA仅验证模式，避免挤掉已登录用户 - 添加ErrNLAAuthSuccess标志用于NLA验证成功信号 - tpkt层支持nlaAuthOnly模式，验证成功后不建立完整会话 - x224层正确传播NLA验证结果 - rdpCrack改用NlaAuth进行凭据验证 * fix: 修复进度条在Windows终端满屏重复输出的问题 - 添加终端宽度检测，动态调整进度条长度 - 使用空格覆盖清除旧内容，避免残留 - 简化进度条格式，确保不超过终端宽度 * feat: 优化日志颜色方案，区分漏洞和普通信息 - 新增 LogVuln 级别（红色），用于漏洞和重要发现 - 密码爆破成功、未授权访问、POC漏洞等改用红色显示 - 普通信息（扫描统计等）改为白色 - Web指纹保持绿色 * refactor: 精简化输出，移除冗余启动信息 - 移除showParseSummary开局配置输出 - 移除LogPluginInfo/LogPluginInfoWithPort插件信息输出 - 移除alive_scanner冗余统计输出 - 移除port_scan_start扫描开始提示 - 移除handleUDPPorts SNMP死代码 - 移除相关i18n条目 * chore: 版本号更新为2.1.1 * fix: 降级依赖版本以保持Go 1.20兼容性 * feat(ldap): 添加NTLM Hash认证支持 (#433) * chore: 清理无用的 replace 指令 * fix(ping): 修复 TTL expired 导致主机误判为存活的问题在 ExecCommandPing 中增加错误关键词检测，当 ping 输出包含 TTL expired、Destination unreachable 等错误信息时，不再将目标主机标记为存活。 Fixes #454 * fix(proxy): 修复透明代理导致输出全端口的问题在代理初始化时主动探测代理行为，通过连接 RFC 5737 保留的测试地址来检测是否存在"全回显"问题。如果探测到代理不可靠，则在端口扫描时跳过所有端口，避免误报。 - 新增 proxyReliable 标志位标记代理可靠性 - 新增 ProbeProxyBehavior 函数探测代理行为 - 端口扫描前检查代理可靠性并输出警告 Fixes #495 * refactor: 移动debug模块到common/debug子包 * fix(web): 修复-u模式下Web插件未执行的问题 * fix: 优化输出格式和颜色显示 - 网段统计格式改为 10.253.0.0/16 网段存活: 26 - WebTitle基础信息改为白色，指纹识别单独绿色输出 - 移除重复的端口数量输出 * fix: URL解析自动补全协议头 -uf 文件中 192.168.1.1:8080 自动转为 http://192.168.1.1:8080 * fix: 修复-u/-uf模式下URLs丢失导致0目标扫描的问题 Parse阶段将URLs设置到全局状态，但Initialize随后创建新状态并覆盖了全局状态，导致URLs数据丢失。现在在创建新状态前先保存并迁移Parse阶段设置的URLs和HostPorts数据。 * fix: 智能检测HTTP/HTTPS协议并优化URL显示 - 修复-u/-uf模式URLs丢失导致0目标扫描问题 - detectProtocol改为主动TLS握手检测，不依赖服务名 - WebTitle输出显示完整协议(http/https) - 隐藏标准端口(80/443)使输出更简洁 * refactor: 精简parsers包，统一配置构建入口 - 删除冗余的中间层（XXXInput、XXXParser类） - 新增 config_builder.go 统一配置构建 - parsers包从3000+行精简至~540行 - 保留核心函数：ParseIP、ParsePort、文件读取、凭据解析 * test: 扩展parsers单元测试覆盖边缘情况 - 新增内网简写解析测试(192/172/10) - 新增完整IP范围和无效CIDR测试 - 新增Windows行尾(CRLF)处理测试 - 新增凭据和哈希文件解析测试 - 新增端口解析边缘情况测试 - 测试覆盖率达到94.2% * refactor: 优化控制台输出格式 - 去掉时间戳，保留[*][+]前缀 - Web输出合并WebTitle和WebFinger为一行 - 有指纹显示绿色[+]，无指纹显示白色[*] - 格式: code:xxx len:xxx title:xxx server:xxx [指纹] - 服务探测格式: [Product:xxx ||Version:xxx] Banner:(xxx) - 字段对齐，输出更清爽 * feat: 添加凭据测试未发现弱密码的提示 - credential_tester.go: 失败时设置 Type=ResultTypeCredential - scanner.go: 根据结果类型在 error 级别输出'未发现弱密码'提示 - 新增 i18n 翻译 brute_no_weak_pass 使用 -log all 或 -log error 可看到此提示 * refactor(logging): 重构日志级别为层级过滤设计 - LogLevel 从 string 改为 int 类型，支持层级比较 - 层级设计：Debug(0) < Base(1) < Info(2) < Success(3) < Vuln(4) < Error(5) - 设置一个级别后，显示该级别及以上的日志 - Error 级别始终显示，不会被配置过滤掉 - 保留向后兼容别名（LevelAll, LevelInfoSuccess 等） - 更新测试以匹配新的层级过滤行为 * style(logging): Error级别日志改为黄色显示 * style(findnet): NetInfo输出改为每行一个IP * refactor(ms17010): 优化错误提示，明确指出SMBv1不支持等情况 * fix(credential): 修复凭据测试结果不一致的问题问题原因： 1. 未知错误类型不重试，导致服务端限流时跳过正确密码 2. SSH 错误分类不够准确，某些临时错误未被识别修复内容： 1. 未知错误改为可重试（可能是临时问题） 2. 增加 SSH 特有的网络错误识别（handshake failed, disconnect 等） * fix(portfinger): 修复SMB2服务指纹识别和NetInfo输出问题 - 添加SMB2ProgNeg探针支持现代Windows的SMB2协议 - 修复Go regexp对高位字节的UTF-8兼容问题，使用Latin-1转换 - 修复探针失败后连接重建逻辑 - 修复vendor_product字段名不匹配问题 - 修复NetInfo多行输出被其他日志打断的问题 * fix(config): 从默认端口移除9100，避免触发打印机打印 (#517) * feat(proxy): 增强代理端口扫描的深度验证机制 - 新增4阶段深度验证：Banner读取→探测发送→响应等待→最终判定 - 新增SOCKS5错误码和代理错误文本检测 - 优化ProbeProxyBehavior探测逻辑，发送数据验证连接可达性 - 解决透明代理/全回显代理导致的假阳性问题 * fix(proxy): 修复代理深度验证的若干问题 - detector.go: 修复 AutoConfigureProxy 覆盖探测结果的问题只有未探测过时才设置默认 proxyReliable 值 - port_scan.go: 改进深度验证机制 - 使用带 Host header 的 HTTP GET 请求替代 OPTIONS - 延长响应等待超时至 2s 以适配慢速服务器 - 正确重置连接 deadline 避免影响后续操作 * refactor: 统一 common 包文件命名风格 Flag.go -> flag.go * refactor(proxy): 删除自定义 contains() 函数，改用标准库 - 用 strings.Contains() 替代手写的 contains() - 删除过时的注释 * fix(parsers): 修复带横杠域名被误识别为IP范围的问题如 111-555.sss.com 这类域名因包含 - 被错误解析为 IP 范围，添加 looksLikeIPRange() 检查，只有 - 前是有效 IP 才走范围解析 * fix(proxy): 修复代理模式下服务识别错误和端口漏扫问题 - port_scan.go: 验证通过后重建干净连接，避免HTTP GET探测污染服务识别 - port_scan.go: 优化验证策略，用轻量CRLF探测替代HTTP GET，超时从2.2s降至0.6s - manager.go: 修正ProbeProxyBehavior判断逻辑，超时应视为代理正常转发 * fix(pool): 移除线程池预分配，优化大规模扫描内存占用 WithPreAlloc(true) 会预先创建所有 worker goroutine，在大规模扫描(如 25域名×65535端口)时可能导致内存问题 * refactor(logging): 统一日志前缀，删除废弃的 LogBase - 删除 LogBase 函数，所有调用迁移到 LogInfo/LogError - 新增 PrefixDebug ([.]) 前缀，所有日志级别现在都有前缀 - 修复日志输出缩进不一致的问题 - 删除未使用的 PrefixDefault 常量 * perf(icmp): 实现自适应等待算法优化存活检测性能 - 新增 waitAdaptive 函数，监控响应增量实现智能提前结束 - 算法保守原则：最小等待1s + 连续500ms无新响应才提前结束 - 添加100ms检查间隔避免CPU空转 - 保留原有最大等待时间(3s/6s)作为兜底 - 添加完整单元测试覆盖各种场景优化效果： - 全部响应：~100ms (原3s) - 无响应：~1s (原3s) - 部分响应后稳定：~1.5s (原3s) * perf(scan): 实现启发式优化提升扫描体验 1. 端口优先级排序：高价值端口(80,443,22,3389等)优先扫描 - 用户能更快看到有意义的结果 - 不影响端口喷洒策略 2. TCP 补充探测：ICMP 响应率<10%时自动启用 - 对未响应主机用 TCP 80/443/22/445 补充探测 - 解决防火墙过滤 ICMP 导致漏检的问题 * refactor(grdp): 精简RDP库，删除认证检测不需要的代码 - 删除 VNC 协议支持 (protocol/rfb, client/rfb.go) - 删除完整客户端框架 (client/) - 删除 RemoteApp 等插件 (plugin/) - 删除 RLE 图形解压 (core/rle.go) - 删除绘图指令处理 (pdu/orders.go, pdu/gdi.go) - 精简 screen.go，移除截图和完整会话功能 - 移除未使用的 RGB 转换函数 grdp 代码从 13,044 行精简至 7,581 行，削减 42% * refactor(common): 删除死代码，优化代码风格 - 删除未使用的 joinStrings/joinInts 函数 - 删除未使用的 memStats 字段和 getMemoryInfo 方法 - 简化 parsePasswords 中的循环为 append(...) 形式 * refactor(services): 统一数据库插件的DBWrapper 4个数据库插件(MySQL、PostgreSQL、MSSQL、Oracle)都有相同的sql.DB包装代码，合并为通用的SQLDBWrapper，减少重复。 * refactor(core,grdp): 删除未使用的死代码 - 移除 BaseScanStrategy.LogPluginInfoWithPort 方法（无调用者） - 移除 mcs.go 中被注释的旧 connect 函数实现 * refactor: 删除 deadcode 检测出的未使用函数 - proxy/detector.go: 删除 IsSOCKS5Standard, IsProxyInitialized - findnet.go: 删除 NetworkInfo.OneLine, TreeFormat 方法 - port_scan.go: 删除 estimateScanTime 函数 - web_scanner.go: 删除 GetFingerprints 函数 - 清理相关测试代码 * refactor: 删除更多未使用的死代码 - parse.go: 删除 RemoveDuplicate 函数及其测试 - parsers.go: 删除 excludeHosts, removeDuplicates 别名函数 - 更新测试使用真正的函数名 * fix(test): 修复 TestParseIP_InvalidIPRange 测试用例 - 删除不合理的测试用例（无效IP被当作普通主机名处理是设计行为） - 修复测试逻辑，只在真正通过时输出"正确" * fix(scan): 移除域名预解析，保留原始域名进行扫描域名预解析会将域名转换为IP，导致虚拟主机场景下HTTP访问失败（Host头变成IP而非域名，无法正确路由） * fix(scan): 修复 -hf 参数无法单独使用的问题 * fix(proxy): 修复透明代理环境下 SOCKS5 代理全端口误报问题问题：在透明代理(TUN模式)环境下使用 SOCKS5 代理扫描时，会出现全端口开放的误报，因为代理可靠性检测被透明代理污染。修复方案（参考 fscanx）： 1. 将探针从 CRLF 改为 HTTP GET，更有效检测真实连接状态 2. 删除 "uncertain" 状态，无响应一律判定为端口关闭 3. 调整超时时间以适应代理链路延迟 Fixes #524 * feat(telnet): 新增 telnetd RCE 命令执行验证，修复未授权访问日志级别 * fix: 修复 i18n.Tr vet 报错、Unicode 测试用例，移除过期域名 - 移除 i18n.Tr 中错误的 fmt.Sprintf fallback，消除 go vet 误报 - 修复 match_engine_test Unicode 测试用例与 Latin-1 转换逻辑不匹配 - README 移除过期的 fscan.club 域名 - 添加 .gitattributes 统一换行符为 LF * refactor: 统一控制台输出风格，使用统一的日志函数手动合并 PR #558 的改动，适配重构后的代码路径 * fix(ci): 修复版本注入和CI触发配置 - goreleaser ldflags 指向正确的包路径 common.version/commit/date - version 改为 var 支持 ldflags 注入，banner 显示 commit 和构建日期 - test-build 触发分支增加 dev-* 通配 * fix(ci): 修复 Windows 产物 .exe.exe 双后缀问题 * feat(ci): 扩展构建架构支持 MIPS/ARM/FreeBSD/Solaris
2026-09-24 20:21:52 +08:00 · 2026-04-25 17:39:16 +08:00
parent 594f567650
commit 760c8ea502
927 changed files with 82001 additions and 24995 deletions
@@ -0,0 +1,14 @@
+FROM rmohr/activemq:5.15.9
+
+# 复制STOMP专用配置文件
+COPY activemq.xml /opt/activemq/conf/activemq.xml
+
+# 仅暴露STOMP协议端口
+EXPOSE 61613 61614
+
+# 设置环境变量
+ENV ACTIVEMQ_OPTS_MEMORY="-Xms64M -Xmx512M"
+ENV ACTIVEMQ_OPTS="-Djava.util.logging.config.file=logging.properties -Djava.security.auth.login.config=/opt/activemq/conf/login.config"
+
+# 启动ActiveMQ
+CMD ["/opt/activemq/bin/activemq", "console"]
@@ -0,0 +1,2 @@
+docker build -t activemq-weak .
+docker run -d --name activemq-test -p 61616:61616 -p 8161:8161 -p 61613:61613 activemq-weak
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns:amq="http://activemq.apache.org/schema/core"
+       xsi:schemaLocation="
+       http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+       http://activemq.apache.org/schema/core http://activemq.apache.org/schema/core/activemq-core.xsd">
+
+    <!-- 专注于STOMP协议的ActiveMQ配置 -->
+    <broker xmlns="http://activemq.apache.org/schema/core" useJmx="false" persistent="false">
+        <!-- 安全认证配置 -->
+        <plugins>
+            <simpleAuthenticationPlugin>
+                <users>
+                    <!-- 主要测试账户 -->
+                    <authenticationUser username="admin" password="Aa123456789" groups="admins,publishers,consumers"/>
+                    <authenticationUser username="admin" password="admin" groups="admins,publishers,consumers"/>
+                    <authenticationUser username="test" password="test123" groups="publishers,consumers"/>
+                    <authenticationUser username="root" password="root123" groups="admins"/>
+                    <authenticationUser username="system" password="admin123" groups="admins"/>
+                    <authenticationUser username="guest" password="guest" groups="consumers"/>
+                    <authenticationUser username="activemq" password="activemq" groups="publishers,consumers"/>
+                </users>
+            </simpleAuthenticationPlugin>
+
+            <!-- 简化的授权配置 -->
+            <authorizationPlugin>
+                <map>
+                    <authorizationMap>
+                        <authorizationEntries>
+                            <authorizationEntry queue=">" read="consumers,admins" write="publishers,admins" admin="admins"/>
+                            <authorizationEntry topic=">" read="consumers,admins" write="publishers,admins" admin="admins"/>
+                        </authorizationEntries>
+                    </authorizationMap>
+                </map>
+            </authorizationPlugin>
+        </plugins>
+
+        <!-- 仅启用STOMP传输连接器 -->
+        <transportConnectors>
+            <transportConnector name="stomp" uri="stomp://0.0.0.0:61613?maximumConnections=500&amp;wireFormat.maxFrameSize=104857600"/>
+            <transportConnector name="stomp+ssl" uri="stomp+ssl://0.0.0.0:61614?maximumConnections=500&amp;wireFormat.maxFrameSize=104857600"/>
+        </transportConnectors>
+        
+        <!-- 禁用JMX和Web控制台以简化配置 -->
+        <managementContext>
+            <managementContext createConnector="false"/>
+        </managementContext>
+        
+        <!-- 简化的持久化配置 -->
+        <persistenceAdapter>
+            <memoryPersistenceAdapter/>
+        </persistenceAdapter>
+    </broker>
+</beans>
@@ -0,0 +1,15 @@
+version: '3.8'
+
+services:
+  activemq:
+    build: .
+    ports:
+      - "61613:61613"  # STOMP
+      - "61616:61616"  # OpenWire
+      - "8162:8161"    # Web Console (mapped to host port 8162)
+    environment:
+      - ACTIVEMQ_ADMIN_LOGIN=admin
+      - ACTIVEMQ_ADMIN_PASSWORD=Aa123456789
+    volumes:
+      - ./activemq.xml:/opt/activemq/conf/activemq.xml
+      - ./users.properties:/opt/activemq/conf/users.properties
@@ -0,0 +1,12 @@
+# ActiveMQ Web Console用户认证配置
+# 格式: username: password [,role1,role2,...]
+
+# 管理员用户
+admin: Aa123456789,admin,user
+test: test123,user
+root: root123,admin,user
+system: admin123,admin,user
+
+# 默认测试用户
+user: user,user
+guest: guest,user
@@ -0,0 +1,112 @@
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one or more
+    contributor license agreements.  See the NOTICE file distributed with
+    this work for additional information regarding copyright ownership.
+    The ASF licenses this file to You under the Apache License, Version 2.0
+    (the "License"); you may not use this file except in compliance with
+    the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
+
+    <bean id="securityConstraint" class="org.eclipse.jetty.util.security.Constraint">
+        <property name="name" value="BASIC" />
+        <property name="roles" value="user,admin" />
+        <property name="authenticate" value="true" />
+    </bean>
+
+    <bean id="adminSecurityConstraint" class="org.eclipse.jetty.util.security.Constraint">
+        <property name="name" value="BASIC" />
+        <property name="roles" value="admin" />
+        <property name="authenticate" value="true" />
+    </bean>
+
+    <bean id="securityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping">
+        <property name="constraint" ref="securityConstraint" />
+        <property name="pathSpec" value="/admin/*,/api/*" />
+    </bean>
+
+    <bean id="realmSecurityHandler" class="org.eclipse.jetty.security.ConstraintSecurityHandler">
+        <property name="authenticator">
+            <bean class="org.eclipse.jetty.security.authentication.BasicAuthenticator" />
+        </property>
+        <property name="constraintMappings">
+            <list>
+                <ref bean="securityConstraintMapping" />
+            </list>
+        </property>
+        <property name="loginService">
+            <bean class="org.eclipse.jetty.security.HashLoginService">
+                <property name="name" value="ActiveMQRealm" />
+                <property name="config" value="${activemq.conf}/jetty-realm.properties" />
+            </bean>
+        </property>
+    </bean>
+
+    <bean id="contexts" class="org.eclipse.jetty.server.handler.ContextHandlerCollection">
+    </bean>
+
+    <bean id="jettyPort" class="org.apache.activemq.web.config.SystemPropertiesConfiguration" init-method="configure">
+        <property name="properties">
+            <map>
+                <entry key="jetty.port" value="8161" />
+                <entry key="jetty.host" value="0.0.0.0" />
+            </map>
+        </property>
+    </bean>
+
+    <bean id="Server" class="org.eclipse.jetty.server.Server"
+        depends-on="jettyPort"
+        init-method="start" destroy-method="stop">
+
+        <property name="connectors">
+            <list>
+                <bean id="Connector" class="org.eclipse.jetty.server.ServerConnector">
+                    <constructor-arg ref="Server" />
+                    <property name="host" value="#{systemProperties['jetty.host']}" />
+                    <property name="port" value="#{systemProperties['jetty.port']}" />
+                </bean>
+            </list>
+        </property>
+
+        <property name="handler">
+            <bean id="handlers" class="org.eclipse.jetty.server.handler.HandlerCollection">
+                <property name="handlers">
+                    <list>
+                        <ref bean="contexts" />
+                        <bean class="org.eclipse.jetty.server.handler.DefaultHandler" />
+                    </list>
+                </property>
+            </bean>
+        </property>
+
+    </bean>
+
+    <bean id="invokeStart" class="org.springframework.beans.factory.config.MethodInvokingBean">
+        <property name="targetObject" ref="Server" />
+        <property name="targetMethod" value="start" />
+    </bean>
+
+    <bean class="org.eclipse.jetty.webapp.WebAppContext">
+        <property name="contextPath" value="/admin" />
+        <property name="resourceBase" value="${activemq.home}/webapps/admin" />
+        <property name="server" ref="Server" />
+        <property name="securityHandler" ref="realmSecurityHandler" />
+    </bean>
+
+    <bean class="org.eclipse.jetty.webapp.WebAppContext">
+        <property name="contextPath" value="/api" />
+        <property name="resourceBase" value="${activemq.home}/webapps/api" />  
+        <property name="server" ref="Server" />
+        <property name="securityHandler" ref="realmSecurityHandler" />
+    </bean>
+
+</beans>
@@ -0,0 +1,4 @@
+admin=Aa123456789
+test=test123
+root=root123
+system=admin123
@@ -0,0 +1,2 @@
+docker build -t cassandra-weak .
+docker run -d --name cassandra-test -e CASSANDRA_AUTHENTICATOR=AllowAllAuthenticator -p 9042:9042 -p 9160:9160 cassandra:3.11
@@ -0,0 +1,19 @@
+FROM docker.elastic.co/elasticsearch/elasticsearch:7.9.3
+
+# 设置环境变量允许单节点运行
+ENV discovery.type=single-node
+
+# 允许任意IP访问
+ENV network.host=0.0.0.0
+
+# 设置弱密码
+ENV ELASTIC_PASSWORD=elastic123
+
+# 暴露端口
+EXPOSE 9200 9300
+
+# 设置默认用户名elastic和密码elastic123
+RUN echo 'elastic:elastic123' > /usr/share/elasticsearch/config/users
+
+# 关闭xpack安全功能，使其可以无认证访问
+RUN echo 'xpack.security.enabled: false' >> /usr/share/elasticsearch/config/elasticsearch.yml
@@ -0,0 +1,2 @@
+docker build -t elastic-test .
+docker run -d -p 9200:9200 -p 9300:9300 elastic-test
@@ -0,0 +1,2 @@
+docker run -d -p 20:20 -p 21:21 -e FTP_USER=admin  -e FTP_PASS=123456  -e PASV_ADDRESS=127.0.0.1 --name ftp bogem/ftp
+Mac上可能有问题
@@ -0,0 +1,16 @@
+version: '3'
+services:
+  ftp:
+    image: bogem/ftp
+    container_name: ftp-test
+    environment:
+      - FTP_USER=admin
+      - FTP_PASS=123456
+      - PASV_ADDRESS=127.0.0.1
+      - PASV_MIN_PORT=30000
+      - PASV_MAX_PORT=30100
+    ports:
+      - "21:21"
+      - "20:20"
+      - "30000-30100:30000-30100"
+    restart: unless-stopped
@@ -0,0 +1,74 @@
+FROM ubuntu:20.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# 安装 Dovecot 和工具
+RUN apt-get update && \
+    apt-get install -y dovecot-imapd dovecot-gssapi ssl-cert net-tools procps && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
+
+# 创建邮件存储目录和邮箱
+RUN mkdir -p /var/mail/vhosts/ && \
+    chmod 777 /var/mail/vhosts/
+
+# 创建用户和密码文件
+RUN echo "test:{PLAIN}123456" > /etc/dovecot/passwd && \
+    echo "admin:{PLAIN}admin123" >> /etc/dovecot/passwd && \
+    echo "root:{PLAIN}root123" >> /etc/dovecot/passwd && \
+    chown dovecot:dovecot /etc/dovecot/passwd && \
+    chmod 600 /etc/dovecot/passwd
+
+# 配置Dovecot
+RUN echo ' \
+protocols = imap \n\
+listen = * \n\
+ssl = yes \n\
+ssl_cert = </etc/ssl/certs/ssl-cert-snakeoil.pem \n\
+ssl_key = </etc/ssl/private/ssl-cert-snakeoil.key \n\
+mail_location = mbox:~/mail:INBOX=/var/mail/%u \n\
+disable_plaintext_auth = no \n\
+auth_mechanisms = plain login \n\
+auth_debug = yes \n\
+auth_debug_passwords = yes \n\
+mail_debug = yes \n\
+\n\
+passdb { \n\
+  driver = passwd-file \n\
+  args = scheme=PLAIN /etc/dovecot/passwd \n\
+} \n\
+\n\
+userdb { \n\
+  driver = static \n\
+  args = uid=vmail gid=vmail home=/var/mail/%u \n\
+} \n\
+\n\
+service auth { \n\
+  user = dovecot \n\
+  unix_listener auth-userdb { \n\
+    mode = 0600 \n\
+    user = vmail \n\
+  } \n\
+} \n\
+\n\
+service imap-login { \n\
+  inet_listener imap { \n\
+    port = 143 \n\
+  } \n\
+  inet_listener imaps { \n\
+    port = 993 \n\
+    ssl = yes \n\
+  } \n\
+} \n\
+' > /etc/dovecot/dovecot.conf
+
+# 创建vmail用户并设置正确的权限
+RUN groupadd -g 5000 vmail && \
+    useradd -g vmail -u 5000 vmail && \
+    chown -R vmail:vmail /var/mail && \
+    chown -R dovecot:dovecot /etc/dovecot && \
+    chmod -R 644 /etc/dovecot/dovecot.conf
+
+EXPOSE 143 993
+
+CMD ["dovecot", "-F"]
@@ -0,0 +1,2 @@
+docker build -t weak-imap .
+docker run -d --name imap-test -p 143:143 -p 993:993 weak-imap
@@ -0,0 +1 @@
+docker-compose up -d
@@ -0,0 +1,22 @@
+# docker-compose.yml
+version: '3'
+services:
+  kafka:
+    image: bitnami/kafka:latest
+    ports:
+      - "9092:9092"
+    environment:
+      - KAFKA_CFG_NODE_ID=1
+      - KAFKA_CFG_PROCESS_ROLES=broker,controller
+      - KAFKA_CFG_CONTROLLER_QUORUM_VOTERS=1@kafka:9093
+      - KAFKA_CFG_CONTROLLER_LISTENER_NAMES=CONTROLLER
+      - KAFKA_CFG_LISTENERS=CONTROLLER://:9093,SASL_PLAINTEXT://:9092
+      - KAFKA_CFG_ADVERTISED_LISTENERS=SASL_PLAINTEXT://localhost:9092
+      - KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=CONTROLLER:PLAINTEXT,SASL_PLAINTEXT:SASL_PLAINTEXT
+      - KAFKA_CFG_SASL_ENABLED_MECHANISMS=PLAIN
+      - KAFKA_CFG_SASL_MECHANISM_INTER_BROKER_PROTOCOL=PLAIN
+      - KAFKA_CFG_INTER_BROKER_LISTENER_NAME=SASL_PLAINTEXT
+      - KAFKA_OPTS=-Djava.security.auth.login.config=/opt/bitnami/kafka/config/kafka_jaas.conf
+      - ALLOW_PLAINTEXT_LISTENER=yes
+    volumes:
+      - ./kafka_jaas.conf:/opt/bitnami/kafka/config/kafka_jaas.conf
@@ -0,0 +1,8 @@
+KafkaServer {
+   org.apache.kafka.common.security.plain.PlainLoginModule required
+   username="admin"
+   password="admin123"
+   user_admin="admin123"
+   user_test="test123"
+   user_kafka="kafka123";
+};
@@ -0,0 +1,18 @@
+FROM osixia/openldap:1.5.0
+
+# 环境变量设置
+ENV LDAP_ORGANISATION="Example Inc"
+ENV LDAP_DOMAIN="example.com"
+ENV LDAP_BASE_DN="dc=example,dc=com"
+# 设置一个弱密码
+ENV LDAP_ADMIN_PASSWORD="Aa123456789"
+# 允许匿名访问
+ENV LDAP_READONLY_USER="true"
+ENV LDAP_READONLY_USER_USERNAME="readonly"
+ENV LDAP_READONLY_USER_PASSWORD="readonly"
+
+# 暴露端口
+EXPOSE 389 636
+
+# 创建初始化脚本
+COPY bootstrap.ldif /container/service/slapd/assets/config/bootstrap/ldif/custom/
@@ -0,0 +1,2 @@
+docker build -t ldap-weak .
+docker run -d --name ldap-test -p 389:389 -p 636:636 ldap-weak
@@ -0,0 +1,24 @@
+dn: ou=users,dc=example,dc=com
+objectClass: organizationalUnit
+ou: users
+
+dn: cn=admin,ou=users,dc=example,dc=com
+objectClass: inetOrgPerson
+cn: admin
+sn: admin
+uid: admin
+userPassword: admin123
+
+dn: cn=test,ou=users,dc=example,dc=com
+objectClass: inetOrgPerson
+cn: test
+sn: test
+uid: test
+userPassword: test123
+
+dn: cn=root,ou=users,dc=example,dc=com
+objectClass: inetOrgPerson
+cn: root
+sn: root
+uid: root
+userPassword: root123
@@ -0,0 +1,14 @@
+# 使用SQL Server官方镜像
+FROM mcr.microsoft.com/mssql/server:2022-latest
+
+# 设置环境变量
+ENV ACCEPT_EULA=Y
+ENV MSSQL_SA_PASSWORD=P@ssword123
+ENV MSSQL_PID=Express
+
+# 开放1433端口
+EXPOSE 1433
+
+# 健康检查
+HEALTHCHECK --interval=30s --timeout=3s \
+  CMD /opt/mssql-tools/bin/sqlcmd -S localhost -U sa -P P@ssword123 -Q "SELECT 1" || exit 1
@@ -0,0 +1,5 @@
+docker build -t mssql-server .
+docker run -d \
+  -p 1433:1433 \
+  --name mssql-container \
+  mssql-server
@@ -0,0 +1,11 @@
+# 使用Memcached官方镜像
+FROM memcached:latest
+
+# 开放11211端口
+EXPOSE 11211
+
+# 设置启动参数
+# -m 64: 分配64MB内存
+# -c 1024: 最大同时连接数1024
+# -v: 显示版本信息
+CMD ["memcached", "-m", "64", "-c", "1024", "-v"]
@@ -0,0 +1,5 @@
+docker build -t memcached-server .
+docker run -d \
+  -p 11211:11211 \
+  --name memcached-container \
+  memcached-server
@@ -0,0 +1 @@
+docker run --rm -p 5020:5020 oitc/modbus-server:latest
@@ -0,0 +1,13 @@
+# 使用MongoDB官方镜像
+FROM mongo:latest
+
+# 设置环境变量
+ENV MONGO_INITDB_ROOT_USERNAME=admin
+ENV MONGO_INITDB_ROOT_PASSWORD=123456
+
+# 开放27017端口
+EXPOSE 27017
+
+# 健康检查
+HEALTHCHECK --interval=30s --timeout=3s \
+  CMD mongosh --eval 'db.runCommand("ping").ok' localhost:27017/test --quiet
@@ -0,0 +1,5 @@
+docker build -t mongodb-server .
+docker run -d \
+  -p 27017:27017 \
+  --name mongodb-container \
+  mongodb-server
@@ -0,0 +1,17 @@
+# 使用MySQL官方镜像
+FROM mysql:latest
+
+# 设置环境变量
+ENV MYSQL_ROOT_PASSWORD=Password
+ENV MYSQL_DATABASE=mydb
+
+# 开放3306端口
+EXPOSE 3306
+
+# MySQL配置
+# 允许远程访问
+COPY my.cnf /etc/mysql/conf.d/my.cnf
+
+# 健康检查
+HEALTHCHECK --interval=30s --timeout=3s \
+  CMD mysql -uroot -p"${MYSQL_ROOT_PASSWORD}" -e "SELECT 1" || exit 1
@@ -0,0 +1,2 @@
+docker build -t mysql-server .
+docker run -d -p 3306:3306 --name mysql-container mysql-server
@@ -0,0 +1,2 @@
+[mysqld]
+bind-address = 0.0.0.0
@@ -0,0 +1,9 @@
+FROM neo4j:4.4
+
+ENV NEO4J_AUTH=neo4j/123456
+ENV NEO4J_dbms_security_procedures_unrestricted=apoc.*
+ENV NEO4J_dbms_security_auth_enabled=true
+
+EXPOSE 7474 7687
+
+CMD ["neo4j"]
@@ -0,0 +1,11 @@
+version: '3'
+services:
+  neo4j:
+    image: neo4j:4.4
+    ports:
+      - "7474:7474"
+      - "7687:7687"
+    environment:
+      - NEO4J_AUTH=neo4j/123456
+      - NEO4J_dbms_security_auth_enabled=true
+    container_name: neo4j-weak
@@ -0,0 +1,13 @@
+# 使用Oracle官方容器镜像
+FROM container-registry.oracle.com/database/express:21.3.0-xe
+
+# 设置环境变量
+ENV ORACLE_PWD=123456
+ENV ORACLE_CHARACTERSET=AL32UTF8
+
+# 开放1521端口
+EXPOSE 1521 5500
+
+# 健康检查
+HEALTHCHECK --interval=30s --timeout=30s --start-period=5m --retries=3 \
+  CMD nc -z localhost 1521 || exit 1
@@ -0,0 +1,11 @@
+首先需要在Oracle Container Registry网站注册并接受许可协议：
+https://container-registry.oracle.com
+
+docker login container-registry.oracle.com
+
+docker build -t oracle-db .
+
+docker run -d \
+  -p 1521:1521 \
+  --name oracle-container \
+  oracle-db
@@ -0,0 +1,64 @@
+FROM ubuntu:20.04
+
+# 避免交互式提示
+ENV DEBIAN_FRONTEND=noninteractive
+
+# 安装必要的包
+RUN apt-get update && apt-get install -y \
+    dovecot-pop3d \
+    openssl \
+    && rm -rf /var/lib/apt/lists/*
+
+# 生成SSL证书
+RUN openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
+    -keyout /etc/ssl/private/dovecot.pem \
+    -out /etc/ssl/certs/dovecot.pem \
+    -subj "/C=US/ST=State/L=City/O=Organization/CN=localhost"
+
+# 配置Dovecot
+RUN echo '\
+protocols = pop3\n\
+listen = *\n\
+ssl = yes\n\
+ssl_cert = </etc/ssl/certs/dovecot.pem\n\
+ssl_key = </etc/ssl/private/dovecot.pem\n\
+auth_mechanisms = plain login\n\
+disable_plaintext_auth = no\n\
+mail_location = mbox:~/mail:INBOX=/var/mail/%u\n\
+\n\
+passdb {\n\
+  driver = passwd-file\n\
+  args = scheme=PLAIN username_format=%u /etc/dovecot/passwd\n\
+}\n\
+\n\
+userdb {\n\
+  driver = passwd-file\n\
+  args = username_format=%u /etc/dovecot/users\n\
+}\n\
+' > /etc/dovecot/dovecot.conf
+
+# 创建密码文件
+RUN echo '\
+admin:{PLAIN}admin123\n\
+test:{PLAIN}test123\n\
+root:{PLAIN}root123\n\
+' > /etc/dovecot/passwd
+
+# 创建用户文件
+RUN echo '\
+admin:x:1000:1000::/home/admin:/bin/false\n\
+test:x:1001:1001::/home/test:/bin/false\n\
+root:x:1002:1002::/home/root:/bin/false\n\
+' > /etc/dovecot/users
+
+# 创建必要的目录和权限
+RUN mkdir -p /home/admin /home/test /home/root && \
+    chown 1000:1000 /home/admin && \
+    chown 1001:1001 /home/test && \
+    chown 1002:1002 /home/root
+
+# 暴露端口
+EXPOSE 110 995
+
+# 启动Dovecot
+CMD ["dovecot", "-F"]
@@ -0,0 +1,2 @@
+docker build -t pop3-test .
+docker run -d --name pop3-server -p 110:110 -p 995:995 pop3-test
@@ -0,0 +1,14 @@
+# 使用PostgreSQL官方镜像
+FROM postgres:latest
+
+# 设置环境变量
+ENV POSTGRES_USER=postgres
+ENV POSTGRES_PASSWORD=123456
+ENV POSTGRES_DB=mydb
+
+# 开放5432端口
+EXPOSE 5432
+
+# 健康检查
+HEALTHCHECK --interval=30s --timeout=3s \
+  CMD pg_isready -U postgres || exit 1
@@ -0,0 +1,5 @@
+docker build -t postgres-server .
+docker run -d \
+-p 5432:5432 \
+--name postgres-container \
+postgres-server
@@ -0,0 +1,10 @@
+FROM rabbitmq:3-management
+
+# 环境变量设置默认的用户名和密码
+ENV RABBITMQ_DEFAULT_USER=admin
+ENV RABBITMQ_DEFAULT_PASS=123456
+
+# 开放标准端口
+# 5672: AMQP 协议端口
+# 15672: HTTP API 端口和管理UI
+EXPOSE 5672 15672
@@ -0,0 +1,2 @@
+docker build -t rabbitmq-weak .
+docker run -d --name rabbitmq-test -p 5672:5672 -p 15672:15672 rabbitmq-weak
@@ -0,0 +1,35 @@
+FROM redis:5.0.1
+
+# 创建测试目录并设置权限
+RUN mkdir -p /root/.ssh && \
+    mkdir -p /var/spool/cron && \
+    mkdir -p /var/spool/cron/crontabs && \
+    mkdir -p /var/www/html && \
+    mkdir -p /etc/redis && \
+    mkdir -p /tmp/test && \
+    chmod 755 /root && \
+    chmod -R 777 /root/.ssh && \
+    chmod -R 777 /var/spool/cron && \
+    chmod -R 777 /var/spool/cron/crontabs && \
+    chmod -R 777 /var/www/html && \
+    chmod -R 777 /etc/redis && \
+    chmod -R 777 /tmp/test && \
+    echo "测试目录已创建，可以写入" > /tmp/test/test.txt
+
+# 配置Redis允许远程连接和任意文件写入
+RUN echo "port 6379\n\
+bind 0.0.0.0\n\
+dir /data\n\
+dbfilename dump.rdb\n\
+protected-mode no\n\
+daemonize no\n\
+appendonly no\n\
+requirepass \"\"\n\
+" > /etc/redis/redis.conf
+
+WORKDIR /data
+
+EXPOSE 6379
+
+# 启动Redis服务器
+CMD ["redis-server", "/etc/redis/redis.conf"]
@@ -0,0 +1,5 @@
+docker build -t redis-server .
+docker run -d \
+  -p 6379:6379 \
+  --name redis-container \
+  redis-server
@@ -0,0 +1,18 @@
+version: '3.8'
+services:
+  redis:
+    build: .
+    container_name: redis_test
+    ports:
+      - "6379:6379"
+    volumes:
+      - redis-data:/data
+    networks:
+      - test-network
+
+networks:
+  test-network:
+    driver: bridge
+
+volumes:
+  redis-data:
@@ -0,0 +1,5 @@
+bind 0.0.0.0
+port 6379
+protected-mode no
+dir /data
+daemonize no
@@ -0,0 +1,40 @@
+FROM ubuntu:20.04
+
+# 安装rsync
+RUN apt-get update && \
+    apt-get install -y rsync
+
+# 创建测试目录和用户
+RUN mkdir -p /data/public && \
+    mkdir -p /data/secure && \
+    useradd -m testuser && \
+    echo "testuser:123456" | chpasswd
+
+# 配置文件
+RUN echo 'pid file = /var/run/rsyncd.pid' > /etc/rsyncd.conf && \
+    echo 'log file = /var/log/rsyncd.log' >> /etc/rsyncd.conf && \
+    echo 'transfer logging = yes' >> /etc/rsyncd.conf && \
+    echo 'use chroot = yes' >> /etc/rsyncd.conf && \
+    echo '[public]' >> /etc/rsyncd.conf && \
+    echo 'path = /data/public' >> /etc/rsyncd.conf && \
+    echo 'comment = Public Share' >> /etc/rsyncd.conf && \
+    echo 'read only = yes' >> /etc/rsyncd.conf && \
+    echo 'auth users = *' >> /etc/rsyncd.conf && \
+    echo 'secrets file = /etc/rsyncd.secrets' >> /etc/rsyncd.conf && \
+    echo '[anonymous]' >> /etc/rsyncd.conf && \
+    echo 'path = /data/public' >> /etc/rsyncd.conf && \
+    echo 'comment = Anonymous Share' >> /etc/rsyncd.conf && \
+    echo 'read only = yes' >> /etc/rsyncd.conf && \
+    echo 'auth users = ' >> /etc/rsyncd.conf
+
+# 创建密码文件（使用fscan默认字典能检测到的弱密码）
+RUN echo 'root:123456' > /etc/rsyncd.secrets && \
+    echo 'admin:admin' >> /etc/rsyncd.secrets && \
+    echo 'backup:backup' >> /etc/rsyncd.secrets && \
+    chmod 600 /etc/rsyncd.secrets
+
+# 暴露Rsync默认端口
+EXPOSE 873
+
+# 启动rsync守护进程
+CMD ["rsync", "--daemon", "--no-detach", "--config=/etc/rsyncd.conf"]
@@ -0,0 +1,2 @@
+docker build -t rsync-test .
+docker run -d --name rsync-server -p 873:873 rsync-test
@@ -0,0 +1,9 @@
+version: '3.8'
+
+services:
+  rsync:
+    build: .
+    ports:
+      - "873:873"
+    container_name: rsync_test
+    restart: unless-stopped
@@ -0,0 +1,52 @@
+FROM ubuntu:20.04
+
+# 安装 Samba 服务
+RUN apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    samba \
+    samba-common-bin \
+    && rm -rf /var/lib/apt/lists/*
+
+# 创建共享目录
+RUN mkdir -p /shared/documents /shared/backups
+
+# 创建 Samba 用户 (弱密码账户用于渗透测试)
+RUN useradd -M -s /sbin/nologin printer && \
+    (echo 'printer123'; echo 'printer123') | smbpasswd -s -a printer && \
+    useradd -M -s /sbin/nologin administrator && \
+    (echo 'admin123'; echo 'admin123') | smbpasswd -s -a administrator && \
+    useradd -M -s /sbin/nologin admin && \
+    (echo 'admin'; echo 'admin') | smbpasswd -s -a admin && \
+    useradd -M -s /sbin/nologin guest && \
+    (echo 'guest'; echo 'guest') | smbpasswd -s -a guest
+
+# 配置 Samba
+RUN printf '[global]\n\
+   workgroup = WORKGROUP\n\
+   server string = Office Printer Server\n\
+   security = user\n\
+   map to guest = Never\n\
+   dns proxy = no\n\
+   passdb backend = tdbsam\n\
+\n\
+[print$]\n\
+   comment = Printer Drivers Share\n\
+   path = /shared/documents\n\
+   browseable = yes\n\
+   read only = no\n\
+   guest ok = no\n\
+   valid users = printer administrator admin guest\n\
+\n\
+[backup]\n\
+   comment = Printer Backup Files\n\
+   path = /shared/backups\n\
+   browseable = yes\n\
+   read only = no\n\
+   guest ok = no\n\
+   valid users = printer administrator admin guest\n' > /etc/samba/smb.conf
+
+# 开放 SMB 端口
+EXPOSE 139 445
+
+# 启动 Samba 服务
+CMD ["smbd", "--foreground", "--no-process-group"]
@@ -0,0 +1,51 @@
+FROM ubuntu:20.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# 安装必要的软件
+RUN apt-get update && apt-get install -y \
+    postfix \
+    sasl2-bin \
+    libsasl2-modules \
+    mailutils \
+    rsyslog \
+    && rm -rf /var/lib/apt/lists/*
+
+# 配置Postfix
+RUN postconf -e 'smtpd_sasl_auth_enable = yes' \
+    && postconf -e 'smtpd_sasl_security_options = noanonymous' \
+    && postconf -e 'smtpd_sasl_local_domain =' \
+    && postconf -e 'broken_sasl_auth_clients = yes' \
+    && postconf -e 'smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination' \
+    && postconf -e 'inet_interfaces = all'
+
+# 配置SASL
+RUN mkdir -p /etc/postfix/sasl/
+RUN echo "pwcheck_method: auxprop" > /etc/postfix/sasl/smtpd.conf \
+    && echo "auxprop_plugin: sasldb" >> /etc/postfix/sasl/smtpd.conf \
+    && echo "mech_list: PLAIN LOGIN" >> /etc/postfix/sasl/smtpd.conf
+
+# 创建SASL用户（使用固定域名localhost）
+RUN echo "123456" | saslpasswd2 -p -c -u localhost test
+RUN echo "admin123" | saslpasswd2 -p -c -u localhost admin
+RUN echo "root123" | saslpasswd2 -p -c -u localhost root
+
+# 设置权限
+RUN chown postfix:postfix /etc/sasldb2
+
+# 创建日志目录和文件
+RUN mkdir -p /var/log && \
+    touch /var/log/mail.log && \
+    chmod 644 /var/log/mail.log
+
+# 开放端口
+EXPOSE 25
+
+# 创建启动脚本
+RUN echo '#!/bin/bash' > /start.sh \
+    && echo 'service rsyslog start' >> /start.sh \
+    && echo 'service postfix start' >> /start.sh \
+    && echo 'tail -f /var/log/mail.log' >> /start.sh \
+    && chmod +x /start.sh
+
+CMD ["/start.sh"]
@@ -0,0 +1,2 @@
+docker build -t smtp-weak .
+docker run -d --name smtp-test -p 25:25 smtp-weak
@@ -0,0 +1,9 @@
+version: '3.8'
+
+services:
+  smtp:
+    build: .
+    ports:
+      - "25:25"
+    container_name: smtp_test
+    restart: unless-stopped
@@ -0,0 +1,3 @@
+#!/bin/bash
+service postfix start
+tail -f /var/log/mail.log
@@ -0,0 +1,23 @@
+FROM ubuntu:20.04
+
+# 安装SNMP服务
+RUN apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y snmpd && \
+    rm -rf /var/lib/apt/lists/*
+
+# 备份原配置
+RUN cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.orig
+
+# 创建新的配置文件
+RUN echo "rocommunity public default" > /etc/snmp/snmpd.conf && \
+    echo "rocommunity private default" >> /etc/snmp/snmpd.conf && \
+    echo "rocommunity cisco default" >> /etc/snmp/snmpd.conf && \
+    echo "rocommunity community default" >> /etc/snmp/snmpd.conf && \
+    # 允许从任何地址访问
+    echo "agentAddress udp:161,udp6:[::1]:161" >> /etc/snmp/snmpd.conf
+
+# 开放SNMP端口
+EXPOSE 161/udp
+
+# 启动SNMP服务
+CMD ["snmpd", "-f", "-Lo", "-C", "-c", "/etc/snmp/snmpd.conf"]
@@ -0,0 +1,2 @@
+docker build -t snmp-weak .
+docker run -d --name snmp-test -p 161:161/udp snmp-weak
@@ -0,0 +1,9 @@
+version: '3.8'
+
+services:
+  snmp:
+    build: .
+    ports:
+      - "161:161/udp"
+    container_name: snmp_test
+    restart: unless-stopped
@@ -0,0 +1,62 @@
+# 使用Ubuntu最新版本作为基础镜像
+FROM ubuntu:latest
+
+# 安装必要的软件包（SSH服务 + 常用渗透工具）
+RUN apt-get update && apt-get install -y \
+    openssh-server \
+    telnet \
+    curl \
+    wget \
+    netcat-traditional \
+    net-tools \
+    iputils-ping \
+    dnsutils \
+    vim \
+    && rm -rf /var/lib/apt/lists/*
+
+# 创建SSH所需的目录
+RUN mkdir /var/run/sshd
+
+# 允许root用户SSH登录并设置密码
+RUN sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config
+RUN echo 'root:Aa123456789' | chpasswd
+
+# 创建多个弱密码用户（匹配fscan默认字典）
+RUN useradd -m admin && echo 'admin:admin' | chpasswd && \
+    useradd -m test && echo 'test:123456' | chpasswd && \
+    useradd -m user && echo 'user:password' | chpasswd && \
+    echo 'root:root' | chpasswd
+
+# 配置密钥认证用户（ubuntu用户已存在于Ubuntu镜像中）
+RUN mkdir -p /home/ubuntu/.ssh && \
+    chmod 700 /home/ubuntu/.ssh
+
+# 复制SSH测试密钥
+COPY test_key.pub /home/ubuntu/.ssh/authorized_keys
+COPY test_key_root.pub /root/.ssh/authorized_keys
+
+# 设置密钥权限
+RUN chmod 600 /home/ubuntu/.ssh/authorized_keys && \
+    chown -R ubuntu:ubuntu /home/ubuntu/.ssh && \
+    mkdir -p /root/.ssh && chmod 700 /root/.ssh && \
+    chmod 600 /root/.ssh/authorized_keys
+
+# 下载并安装 frp 服务端 (v0.65.0)
+RUN wget -q https://github.com/fatedier/frp/releases/download/v0.65.0/frp_0.65.0_linux_amd64.tar.gz && \
+    tar -xzf frp_0.65.0_linux_amd64.tar.gz && \
+    mv frp_0.65.0_linux_amd64/frps /usr/local/bin/frps && \
+    chmod +x /usr/local/bin/frps && \
+    rm -rf frp_0.65.0_linux_amd64*
+
+# 创建 frp 配置目录
+RUN mkdir -p /etc/frp
+
+# 开放22端口（SSH）和7000端口（FRP）
+EXPOSE 22 7000
+
+# 复制并设置启动脚本
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+# 使用启动脚本（自动修复SSH密钥权限）
+ENTRYPOINT ["/entrypoint.sh"]
@@ -0,0 +1,2 @@
+docker build -t ubuntu-ssh .
+docker run -d -p 2222:22 ubuntu-ssh
@@ -0,0 +1,21 @@
+version: '3.8'
+
+services:
+  ssh:
+    build: .
+    container_name: ssh_test
+    hostname: ssh-target
+    ports:
+      - "2222:22"  # 映射到宿主机2222端口
+    networks:
+      - test-network
+    restart: unless-stopped
+    stdin_open: true
+    tty: true
+
+networks:
+  test-network:
+    driver: bridge
+
+# 注意：不使用volumes挂载.ssh目录（会导致权限问题）
+# authorized_keys在构建时COPY进镜像
@@ -0,0 +1,12 @@
+#!/bin/bash
+# 修复SSH密钥权限（Docker volume在Windows上挂载时默认777）
+if [ -f /root/.ssh/authorized_keys ]; then
+    chmod 600 /root/.ssh/authorized_keys
+    chown root:root /root/.ssh/authorized_keys
+fi
+
+# 确保.ssh目录权限正确
+chmod 700 /root/.ssh
+
+# 启动SSH服务
+exec /usr/sbin/sshd -D
@@ -0,0 +1,27 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAQEA5SPgB8mqgvEZcjADVHhQqAOl3w/sND8SJtupUq9HmGOvlQH1Fcsi
+Nu4vT9aD+GzW1EpTrmAxJJ3uuGQ9aFsDamNkk0FIFL1nHeKzktWX/qiG175Yn9PKZJ6IzW
+2B+5W+VD5m81iWs++UhzyGoxYu9F75XaOgYj3P8v6xUoZrqJz5pTcr9v4xPXXw+eFPDfdT
+/sqlkctu8gHkt2DoUgpt8RNNXwJrjju9cTgOykzuC+OWPQHTl+OdLj+32Aj7FWjvtjmaI7
+vZtXnWUyGntEQKwXTa1Ou95bCMviisi0FVO5NwDcINl7SaO3wTvmINA2EUBT9jM73SiLt3
+npTFPYxEvQAAA8j4I37D+CN+wwAAAAdzc2gtcnNhAAABAQDlI+AHyaqC8RlyMANUeFCoA6
+XfD+w0PxIm26lSr0eYY6+VAfUVyyI27i9P1oP4bNbUSlOuYDEkne64ZD1oWwNqY2STQUgU
+vWcd4rOS1Zf+qIbXvlif08pknojNbYH7lb5UPmbzWJaz75SHPIajFi70Xvldo6BiPc/y/r
+FShmuonPmlNyv2/jE9dfD54U8N91P+yqWRy27yAeS3YOhSCm3xE01fAmuOO71xOA7KTO4L
+45Y9AdOX450uP7fYCPsVaO+2OZoju9m1edZTIae0RArBdNrU673lsIy+KKyLQVU7k3ANwg
+2XtJo7fBO+Yg0DYRQFP2MzvdKIu3eelMU9jES9AAAAAwEAAQAAAQAQHDxbV9Cy+aAUIO+P
+ABGNqon+O6icCMYuMLoAK/4w5utYouVYJarPaWIurxKixAY7sUkeZLl3zVnUIYoWvPVpxL
+i0yL14ZdOq7H47J+TSnQc0AnhJLnMXrXTJWrZtmZri4etLlzIrTwAmnPkLXNsqx8WpEYDM
+f3OQLluJxZUqqtKgCThjHl6rnkPW8XtChtjhTijRk06Y2kq5Z2mpBe6+g5vn+01FYZmm/w
+pNJevNT0sUhORgtprNi1xYqTimGjTn4Jum6xVPQme9ZDkjMy/gNYomzdJ1PVdXig3GLKuK
+T9UXZAAvUYuRWmVWRtKqo94PvzfkwzOMTFXlrE1jY+2ZAAAAgE1d6wc5wC1iw/39SQzFS2
+SCtvToMyIYA+hG2O+jtqLG1dEZB1gd8Cy201RHS2z3ohm7lRzJ33QPs0HrKoa/WqhGi4N6
+zM8GQrBXhEytdAz99ewqgiKUxvNo6hQ1/ro6HeWK7/reQ2fHd36x00FisOcrsYjPm5Kfqc
+hFxWc2ZKkeAAAAgQD/ttb4YyZrv6TYS1cchDhu6GoSjd+hXLSs8rTDruxMVIWBKBCIgksM
+FjQVaaS/Du6dbIuxUZLboqqfX+HWoxE71hbsSPakuKeOImGBQAGMmL+TCt3EvHhCrWhAT4
+9KMvPPzt1NXzrUXkfM9s3wiB2pO1GDP/nmAzCKcZnEoiY6yQAAAIEA5WVuuG1QBptV+yCA
+GizYhsStGW0dQSZps4ObEbWLSf3fdZgCDeZgOYnB4nL+KcfS4QSTsl+06dEh9N510ukNLy
+tRv94zr7mnLrbX30KWE5NfEz1TgRFXQjl0P5tiY1E3x0p8fbMC3rfif2JbGPESys0xDRvG
+r0EkhWtqz4KkwFUAAAAOZnNjYW4tdGVzdC1rZXkBAgMEBQ==
+-----END OPENSSH PRIVATE KEY-----
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDlI+AHyaqC8RlyMANUeFCoA6XfD+w0PxIm26lSr0eYY6+VAfUVyyI27i9P1oP4bNbUSlOuYDEkne64ZD1oWwNqY2STQUgUvWcd4rOS1Zf+qIbXvlif08pknojNbYH7lb5UPmbzWJaz75SHPIajFi70Xvldo6BiPc/y/rFShmuonPmlNyv2/jE9dfD54U8N91P+yqWRy27yAeS3YOhSCm3xE01fAmuOO71xOA7KTO4L45Y9AdOX450uP7fYCPsVaO+2OZoju9m1edZTIae0RArBdNrU673lsIy+KKyLQVU7k3ANwg2XtJo7fBO+Yg0DYRQFP2MzvdKIu3eelMU9jES9 fscan-test-key
@@ -0,0 +1,27 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAQEAqk+3GXolJ7TKoZrZgo08f16t7EZcHd4zr8YlqdZ080nCyDIrzSDi
+DlEUdCRFN6A5G3uVQxpQI0COdxCOVuEkbF27i0H2HxKq3k4ShEUS5aywv9tiAkR9WDkIz0
+adi89VcLQoW8P//HalPu5RooU0JqXKJvtd/yZ6W0a9EYkU7VRh3FDqtPnPPxD2JbPpcyOw
+AJsCmR/UawQg77pS9+3RBNXO2CRR6yWsQLI5zkZVqTEhh2Nfwzs+/UhzS3W/gXCSYLMFRA
+ztWEJYL9QFyGBNzIJMA6pdoT8Irvk1ZzX8weng+zMFJR2i6EOSGRE1fEFZiQ4k+ZQlLLb4
+clkSlCasZwAAA8il4sn+peLJ/gAAAAdzc2gtcnNhAAABAQCqT7cZeiUntMqhmtmCjTx/Xq
+3sRlwd3jOvxiWp1nTzScLIMivNIOIOURR0JEU3oDkbe5VDGlAjQI53EI5W4SRsXbuLQfYf
+EqreThKERRLlrLC/22ICRH1YOQjPRp2Lz1VwtChbw//8dqU+7lGihTQmpcom+13/JnpbRr
+0RiRTtVGHcUOq0+c8/EPYls+lzI7AAmwKZH9RrBCDvulL37dEE1c7YJFHrJaxAsjnORlWp
+MSGHY1/DOz79SHNLdb+BcJJgswVEDO1YQlgv1AXIYE3MgkwDql2hPwiu+TVnNfzB6eD7Mw
+UlHaLoQ5IZETV8QVmJDiT5lCUstvhyWRKUJqxnAAAAAwEAAQAAAQAQVm74nTHaQhVxdOgq
+W2pzHNMvXWfcdPfdWUiR/HYh7oX7wWsClbB0ciJgVShkrSnn8S4rjpHNx+rCu45ZVuYGao
+7L+EBoJljI1DwiKc7Qby/8v6ACcAKG3OBzoyZdhpP/ffDPLhlXj87LSij/n6qV4y/mFxVN
+yCmoVDwH5hq2p3TsGY766jr3UgvV9Kq+9gsdvyfWex29xMlupRMfDpSdE5KC2qmzwV4Akq
+DpKMWQtCCThpHqRu68J0QgSRmQRPQk1Q/YEhX0dQXNd9svzXF8QDBx17P0Sm6C9iwiTJoD
+ULsutT9D+KzDmq9AmxRnqyg/SY/eYBQ3pHMVaaGk4LeJAAAAgFfsSYo62z9TAaxEOT0ZYo
+hSYR4kzTIlX8RByvy4trPtcB5C3hD+q/xMLZiNM22nEPicUoYUaok7Bk46xAcCBbFRMnJ0
+WycESdOxHSMYzUW+hAKWypxAxMlF9M9cmYAv/hASxtbINx3rVbk1YMUS+RFdtBI1wBIOk9
+11zGzU9ICuAAAAgQDhaKu4pRq9sDrKLR5WrALq0HX93UvYlDyU5JfY7xuvCozEeUDQzCAA
+Nh/dNjqGx60AfAFGGf/k6SCv1SRJHhs7GQE3zABxQwO4hb/h7MNs+g3WtdLoV8N8xK1O9o
+nV0Pev3dLx8cStvWoNwARyx/HLh0/O+pImRqoCpnMwKjLxzwAAAIEAwWzOG/BDmPvgppso
+qo2ZZLXkW8KqA0E095Z97EvYNOY5H0iL8n7vcuLrLfUxSd62UZVSt57JXMo26d9k0UDXwd
+Nv8cI3Y5TUAhJLjANiWhCZomns93LoAysMIq/CMHWhDO5CIGKNHEY+JhbrqxcWlYPfQizA
+iNQluqSGy0jWuekAAAAPZnNjYW4tdGVzdC1yb290AQIDBA==
+-----END OPENSSH PRIVATE KEY-----
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqT7cZeiUntMqhmtmCjTx/Xq3sRlwd3jOvxiWp1nTzScLIMivNIOIOURR0JEU3oDkbe5VDGlAjQI53EI5W4SRsXbuLQfYfEqreThKERRLlrLC/22ICRH1YOQjPRp2Lz1VwtChbw//8dqU+7lGihTQmpcom+13/JnpbRr0RiRTtVGHcUOq0+c8/EPYls+lzI7AAmwKZH9RrBCDvulL37dEE1c7YJFHrJaxAsjnORlWpMSGHY1/DOz79SHNLdb+BcJJgswVEDO1YQlgv1AXIYE3MgkwDql2hPwiu+TVnNfzB6eD7MwUlHaLoQ5IZETV8QVmJDiT5lCUstvhyWRKUJqxn fscan-test-root
@@ -0,0 +1,4 @@
+root:root
+admin:admin
+test:123456
+user:password
@@ -0,0 +1,8 @@
+root
+admin
+123456
+password
+Aa123456789
+test
+{user}
+{user}123
@@ -0,0 +1,5 @@
+root
+admin
+test
+user
+ubuntu
@@ -0,0 +1,18 @@
+FROM busybox:latest
+
+# 安装必要的包
+RUN ["busybox", "telnetd", "--help"]
+
+# 创建测试用户
+RUN adduser -D -h /home/test test && \
+    echo "test:123456" | chpasswd
+
+# 创建弱密码管理员
+RUN adduser -D -h /home/admin admin && \
+    echo "admin:admin" | chpasswd
+
+# 暴露 Telnet 端口
+EXPOSE 23
+
+# 启动 Telnet 服务
+CMD ["busybox", "telnetd", "-F", "-l", "/bin/sh"]
@@ -0,0 +1,2 @@
+docker build -t telnet-test .
+docker run -d -p 23:23 --name telnet-server telnet-test
@@ -0,0 +1,9 @@
+version: '3.8'
+
+services:
+  telnet:
+    build: .
+    ports:
+      - "23:23"
+    container_name: telnet_test
+    restart: unless-stopped
@@ -0,0 +1,17 @@
+FROM tomcat:9.0-jdk8
+
+# 删除默认应用
+RUN rm -rf /usr/local/tomcat/webapps/*
+
+# 复制tomcat-users.xml配置文件
+COPY tomcat-users.xml /usr/local/tomcat/conf/
+
+# 允许远程访问manager
+COPY context.xml /usr/local/tomcat/webapps.dist/manager/META-INF/
+COPY context.xml /usr/local/tomcat/webapps.dist/host-manager/META-INF/
+
+# 复制默认应用
+RUN cp -r /usr/local/tomcat/webapps.dist/* /usr/local/tomcat/webapps/
+
+EXPOSE 8080
+CMD ["catalina.sh", "run"]
@@ -0,0 +1,2 @@
+docker build -t tomcat-weak .
+docker run -d --name tomcat-test -p 8080:8080 tomcat-weak
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Context antiResourceLocking="false" privileged="true" >
+    <Valve className="org.apache.catalina.valves.RemoteAddrValve"
+           allow=".*" />
+</Context>
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<tomcat-users xmlns="http://tomcat.apache.org/xml"
+              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+              xsi:schemaLocation="http://tomcat.apache.org/xml tomcat-users.xsd"
+              version="1.0">
+
+    <role rolename="manager-gui"/>
+    <role rolename="manager-script"/>
+    <role rolename="manager-jmx"/>
+    <role rolename="manager-status"/>
+    <role rolename="admin-gui"/>
+    <role rolename="admin-script"/>
+
+    <user username="admin" password="123456" roles="manager-gui,manager-script,manager-jmx,manager-status"/>
+    <user username="tomcat" password="tomcat" roles="manager-gui"/>
+    <user username="both" password="both" roles="manager-gui,admin-gui"/>
+    <user username="root" password="root123" roles="manager-gui,manager-script"/>
+
+</tomcat-users>
@@ -0,0 +1,45 @@
+FROM ubuntu:20.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV TZ=Asia/Shanghai
+
+# 安装必要的包
+RUN apt-get update && apt-get install -y \
+    tightvncserver \
+    xfce4 \
+    xfce4-terminal \
+    supervisor
+
+# 创建新用户
+RUN useradd -m vncuser
+ENV USER=vncuser
+ENV HOME=/home/vncuser
+
+# 设置supervisor配置
+RUN mkdir -p /var/log/supervisor
+COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf
+
+# 切换到vncuser用户
+USER vncuser
+WORKDIR /home/vncuser
+
+# 创建必要的文件和目录
+RUN touch ~/.Xauthority
+RUN mkdir -p ~/.vnc
+
+# 创建启动脚本
+RUN echo '#!/bin/bash\nxrdb $HOME/.Xresources\nstartxfce4 &' > ~/.vnc/xstartup
+RUN chmod +x ~/.vnc/xstartup
+
+# 设置VNC密码
+RUN echo "123456" | vncpasswd -f > ~/.vnc/passwd
+RUN chmod 600 ~/.vnc/passwd
+
+# 切回root用户来运行supervisor
+USER root
+
+# 暴露VNC端口
+EXPOSE 5901
+
+# 使用supervisor启动服务
+CMD ["/usr/bin/supervisord"]
@@ -0,0 +1,2 @@
+docker build -t vnc-server .
+docker run -d -p 5901:5901 vnc-server
@@ -0,0 +1,9 @@
+version: '3.8'
+
+services:
+  vnc:
+    build: .
+    ports:
+      - "5901:5901"
+    container_name: vnc_test
+    restart: unless-stopped
@@ -0,0 +1,11 @@
+version: '3.8'
+
+services:
+  vnc-simple:
+    image: consol/ubuntu-xfce-vnc:latest
+    ports:
+      - "5901:5901"
+    environment:
+      - VNC_PW=123456
+    container_name: vnc_simple_test
+    restart: unless-stopped
@@ -0,0 +1,16 @@
+[supervisord]
+nodaemon=true
+
+[program:vnc]
+command=/usr/bin/Xvnc :1 -geometry 1280x800 -depth 24 -rfbport 5901 -rfbauth /home/vncuser/.vnc/passwd -alwaysshared -dontdisconnect -desktop "Ubuntu VNC"
+user=vncuser
+autostart=true
+autorestart=true
+environment=HOME="/home/vncuser",USER="vncuser"
+
+[program:xfce]
+command=/usr/bin/startxfce4
+user=vncuser
+autostart=true
+autorestart=true
+environment=DISPLAY=":1",HOME="/home/vncuser",USER="vncuser"
@@ -0,0 +1,20 @@
+FROM container-registry.oracle.com/middleware/weblogic:12.2.1.4-dev
+
+# 环境变量
+ENV DOMAIN_NAME="base_domain" \
+    ADMIN_PORT="7001" \
+    ADMIN_NAME="weblogic" \
+    ADMIN_PASSWORD="weblogic123" \
+    PRODUCTION_MODE="dev" \
+    DOMAIN_HOME="/u01/oracle/user_projects/domains/base_domain"
+
+USER oracle
+
+# 创建域配置脚本
+COPY --chown=oracle:oracle create-domain.py /u01/oracle/
+COPY --chown=oracle:oracle start.sh /u01/oracle/
+RUN chmod +x /u01/oracle/start.sh
+
+EXPOSE 7001 7002
+
+CMD ["/u01/oracle/start.sh"]
@@ -0,0 +1,2 @@
+docker build -t weblogic-weak .
+docker run -d --name weblogic-test -p 7001:7001 -p 7002:7002 weblogic-weak
@@ -0,0 +1,26 @@
+import os
+
+# 读取模板
+readTemplate("/u01/oracle/wlserver/common/templates/wls/wls.jar")
+
+# 配置管理服务器
+cd('/Security/base_domain/User/weblogic')
+cmo.setPassword('weblogic123')
+
+# 设置域名称和路径
+cd('/')
+cmo.setName('base_domain')
+setOption('DomainName', 'base_domain')
+setOption('ServerStartMode', 'dev')
+setOption('OverwriteDomain', 'true')
+
+# 配置管理服务器
+cd('/Servers/AdminServer')
+set('ListenAddress', '')
+set('ListenPort', 7001)
+
+# 写入域配置
+writeDomain('/u01/oracle/user_projects/domains/base_domain')
+closeTemplate()
+
+exit()
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+# 创建域
+wlst.sh -skipWLSModuleScanning /u01/oracle/create-domain.py
+
+# 等待域创建完成
+sleep 5
+
+# 启动服务器
+/u01/oracle/user_projects/domains/base_domain/bin/startWebLogic.sh
@@ -0,0 +1,58 @@
+version: '3'
+
+services:
+  mysql:
+    image: mysql:8.0
+    container_name: zabbix-mysql
+    command: --default-authentication-plugin=mysql_native_password
+    environment:
+      MYSQL_ROOT_PASSWORD: root123
+      MYSQL_DATABASE: zabbix
+      MYSQL_USER: zabbix
+      MYSQL_PASSWORD: zabbix123
+    ports:
+      - "3306:3306"
+    volumes:
+      - ./mysql_data:/var/lib/mysql
+    networks:
+      - zabbix-net
+
+  zabbix-server:
+    image: zabbix/zabbix-server-mysql:ubuntu-6.0.23
+    container_name: zabbix-server
+    environment:
+      DB_SERVER_HOST: mysql
+      MYSQL_DATABASE: zabbix
+      MYSQL_USER: zabbix
+      MYSQL_PASSWORD: zabbix123
+      MYSQL_ROOT_PASSWORD: root123
+    ports:
+      - "10051:10051"
+    depends_on:
+      - mysql
+    networks:
+      - zabbix-net
+
+  zabbix-web:
+    image: zabbix/zabbix-web-nginx-mysql:ubuntu-6.0.23
+    container_name: zabbix-web
+    environment:
+      DB_SERVER_HOST: mysql
+      MYSQL_DATABASE: zabbix
+      MYSQL_USER: zabbix
+      MYSQL_PASSWORD: zabbix123
+      MYSQL_ROOT_PASSWORD: root123
+      ZBX_SERVER_HOST: zabbix-server
+      PHP_TZ: Asia/Shanghai
+    ports:
+      - "80:8080"
+      - "443:8443"
+    depends_on:
+      - mysql
+      - zabbix-server
+    networks:
+      - zabbix-net
+
+networks:
+  zabbix-net:
+    driver: bridge
@@ -0,0 +1,339 @@
+version: '3.8'
+
+services:
+  # === 数据库服务 ===
+  mysql:
+    image: mysql:latest
+    container_name: fscan-mysql
+    environment:
+      MYSQL_ROOT_PASSWORD: Password
+      MYSQL_DATABASE: mydb
+    ports:
+      - "3306:3306"
+    volumes:
+      - mysql_data:/var/lib/mysql
+    healthcheck:
+      test: ["CMD", "mysql", "-uroot", "-pPassword", "-e", "SELECT 1"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
+    restart: unless-stopped
+
+  postgresql:
+    image: postgres:latest
+    container_name: fscan-postgresql
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: 123456
+      POSTGRES_DB: mydb
+    ports:
+      - "5432:5432"
+    volumes:
+      - postgresql_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
+    restart: unless-stopped
+
+  mongodb:
+    image: mongo:latest
+    container_name: fscan-mongodb
+    environment:
+      MONGO_INITDB_ROOT_USERNAME: admin
+      MONGO_INITDB_ROOT_PASSWORD: 123456
+    ports:
+      - "27017:27017"
+    volumes:
+      - mongodb_data:/data/db
+    healthcheck:
+      test: ["CMD", "mongosh", "--eval", "db.runCommand('ping').ok", "localhost:27017/test", "--quiet"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
+    restart: unless-stopped
+
+  redis:
+    image: redis:5.0.1
+    container_name: fscan-redis
+    command: redis-server --bind 0.0.0.0 --protected-mode no --port 6379
+    ports:
+      - "6379:6379"
+    volumes:
+      - redis_data:/data
+      - ./test_dirs:/test_dirs
+    restart: unless-stopped
+
+  neo4j:
+    image: neo4j:4.4
+    container_name: fscan-neo4j
+    environment:
+      NEO4J_AUTH: neo4j/123456
+      NEO4J_dbms_security_procedures_unrestricted: apoc.*
+      NEO4J_dbms_security_auth_enabled: true
+    ports:
+      - "7474:7474"
+      - "7687:7687"
+    volumes:
+      - neo4j_data:/data
+    restart: unless-stopped
+
+  memcached:
+    image: memcached:latest
+    container_name: fscan-memcached
+    command: ["memcached", "-m", "64", "-c", "1024", "-v"]
+    ports:
+      - "11211:11211"
+    restart: unless-stopped
+
+  cassandra:
+    image: cassandra:3.11
+    container_name: fscan-cassandra
+    environment:
+      CASSANDRA_AUTHENTICATOR: AllowAllAuthenticator
+    ports:
+      - "9042:9042"
+      - "9160:9160"
+    volumes:
+      - cassandra_data:/var/lib/cassandra
+    restart: unless-stopped
+
+  mssql:
+    image: mcr.microsoft.com/mssql/server:2022-latest
+    container_name: fscan-mssql
+    environment:
+      ACCEPT_EULA: Y
+      MSSQL_SA_PASSWORD: P@ssword123
+      MSSQL_PID: Express
+    ports:
+      - "1433:1433"
+    volumes:
+      - mssql_data:/var/opt/mssql
+    healthcheck:
+      test: ["CMD-SHELL", "/opt/mssql-tools/bin/sqlcmd -S localhost -U sa -P P@ssword123 -Q 'SELECT 1' || exit 1"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
+    restart: unless-stopped
+
+  # === Web服务 ===
+  tomcat:
+    build: ./TestDocker/Tomcat/
+    container_name: fscan-tomcat
+    ports:
+      - "8080:8080"
+    volumes:
+      - tomcat_webapps:/usr/local/tomcat/webapps
+    restart: unless-stopped
+
+  # === 搜索引擎 ===
+  elasticsearch:
+    image: docker.elastic.co/elasticsearch/elasticsearch:7.9.3
+    container_name: fscan-elasticsearch
+    environment:
+      - discovery.type=single-node
+      - network.host=0.0.0.0
+      - ELASTIC_PASSWORD=elastic123
+      - xpack.security.enabled=false
+    ports:
+      - "9200:9200"
+      - "9300:9300"
+    volumes:
+      - elasticsearch_data:/usr/share/elasticsearch/data
+    restart: unless-stopped
+
+  # === 消息队列 ===
+  rabbitmq:
+    image: rabbitmq:3-management
+    container_name: fscan-rabbitmq
+    environment:
+      RABBITMQ_DEFAULT_USER: admin
+      RABBITMQ_DEFAULT_PASS: 123456
+    ports:
+      - "5672:5672"
+      - "15672:15672"
+    volumes:
+      - rabbitmq_data:/var/lib/rabbitmq
+    restart: unless-stopped
+
+  activemq:
+    build: ./TestDocker/ActiveMQ/
+    container_name: fscan-activemq
+    ports:
+      - "61613:61613"
+      - "61614:61614"
+    restart: unless-stopped
+
+  kafka:
+    image: bitnami/kafka:latest
+    container_name: fscan-kafka
+    environment:
+      - KAFKA_CFG_NODE_ID=1
+      - KAFKA_CFG_PROCESS_ROLES=broker,controller
+      - KAFKA_CFG_CONTROLLER_QUORUM_VOTERS=1@kafka:9093
+      - KAFKA_CFG_CONTROLLER_LISTENER_NAMES=CONTROLLER
+      - KAFKA_CFG_LISTENERS=CONTROLLER://:9093,SASL_PLAINTEXT://:9092
+      - KAFKA_CFG_ADVERTISED_LISTENERS=SASL_PLAINTEXT://localhost:9092
+      - KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=CONTROLLER:PLAINTEXT,SASL_PLAINTEXT:SASL_PLAINTEXT
+      - KAFKA_CFG_SASL_ENABLED_MECHANISMS=PLAIN
+      - KAFKA_CFG_SASL_MECHANISM_INTER_BROKER_PROTOCOL=PLAIN
+      - KAFKA_CFG_INTER_BROKER_LISTENER_NAME=SASL_PLAINTEXT
+      - KAFKA_OPTS=-Djava.security.auth.login.config=/opt/bitnami/kafka/config/kafka_jaas.conf
+      - ALLOW_PLAINTEXT_LISTENER=yes
+    ports:
+      - "9092:9092"
+    volumes:
+      - ./TestDocker/Kafka/kafka_jaas.conf:/opt/bitnami/kafka/config/kafka_jaas.conf
+      - kafka_data:/bitnami/kafka
+    restart: unless-stopped
+
+  # === 目录服务 ===
+  ldap:
+    build: ./TestDocker/LDAP/
+    container_name: fscan-ldap
+    environment:
+      LDAP_ORGANISATION: "Example Inc"
+      LDAP_DOMAIN: "example.com"
+      LDAP_BASE_DN: "dc=example,dc=com"
+      LDAP_ADMIN_PASSWORD: "Aa123456789"
+      LDAP_READONLY_USER: "true"
+      LDAP_READONLY_USER_USERNAME: "readonly"
+      LDAP_READONLY_USER_PASSWORD: "readonly"
+    ports:
+      - "389:389"
+      - "636:636"
+    volumes:
+      - ldap_data:/var/lib/ldap
+    restart: unless-stopped
+
+  # === 网络服务 ===
+  ftp:
+    image: bogem/ftp
+    container_name: fscan-ftp
+    environment:
+      - FTP_USER=admin
+      - FTP_PASS=123456
+      - PASV_ADDRESS=127.0.0.1
+      - PASV_MIN_PORT=30000
+      - PASV_MAX_PORT=30100
+    ports:
+      - "21:21"
+      - "20:20"
+      - "30000-30100:30000-30100"
+    restart: unless-stopped
+
+  ssh:
+    build: ./TestDocker/SSH/
+    container_name: fscan-ssh
+    ports:
+      - "2222:22"
+    restart: unless-stopped
+
+  smtp:
+    build: ./TestDocker/SMTP/
+    container_name: fscan-smtp
+    ports:
+      - "25:25"
+    restart: unless-stopped
+
+  snmp:
+    build: ./TestDocker/SNMP/
+    container_name: fscan-snmp
+    ports:
+      - "161:161/udp"
+    restart: unless-stopped
+
+  rsync:
+    build: ./TestDocker/Rsync/
+    container_name: fscan-rsync
+    ports:
+      - "873:873"
+    volumes:
+      - ./test_data:/data/public
+    restart: unless-stopped
+
+  vnc:
+    build: ./TestDocker/VNC/
+    container_name: fscan-vnc
+    ports:
+      - "5901:5901"
+    restart: unless-stopped
+
+  telnet:
+    build: ./TestDocker/Telnet/
+    container_name: fscan-telnet
+    ports:
+      - "23:23"
+    restart: unless-stopped
+
+  # === 监控系统 ===
+  zabbix-mysql:
+    image: mysql:8.0
+    container_name: fscan-zabbix-mysql
+    command: --default-authentication-plugin=mysql_native_password
+    environment:
+      MYSQL_ROOT_PASSWORD: root123
+      MYSQL_DATABASE: zabbix
+      MYSQL_USER: zabbix
+      MYSQL_PASSWORD: zabbix123
+    ports:
+      - "3307:3306"  # 避免与主MySQL冲突
+    volumes:
+      - zabbix_mysql_data:/var/lib/mysql
+    restart: unless-stopped
+
+  zabbix-server:
+    image: zabbix/zabbix-server-mysql:ubuntu-6.0.23
+    container_name: fscan-zabbix-server
+    environment:
+      DB_SERVER_HOST: zabbix-mysql
+      MYSQL_DATABASE: zabbix
+      MYSQL_USER: zabbix
+      MYSQL_PASSWORD: zabbix123
+      MYSQL_ROOT_PASSWORD: root123
+    ports:
+      - "10051:10051"
+    depends_on:
+      - zabbix-mysql
+    restart: unless-stopped
+
+  zabbix-web:
+    image: zabbix/zabbix-web-nginx-mysql:ubuntu-6.0.23
+    container_name: fscan-zabbix-web
+    environment:
+      DB_SERVER_HOST: zabbix-mysql
+      MYSQL_DATABASE: zabbix
+      MYSQL_USER: zabbix
+      MYSQL_PASSWORD: zabbix123
+      MYSQL_ROOT_PASSWORD: root123
+      ZBX_SERVER_HOST: zabbix-server
+      PHP_TZ: Asia/Shanghai
+    ports:
+      - "8081:8080"  # 避免与Tomcat冲突
+      - "8443:8443"
+    depends_on:
+      - zabbix-mysql
+      - zabbix-server
+    restart: unless-stopped
+
+# === 数据卷 ===
+volumes:
+  mysql_data:
+  postgresql_data:
+  mongodb_data:
+  redis_data:
+  neo4j_data:
+  cassandra_data:
+  tomcat_webapps:
+  elasticsearch_data:
+  rabbitmq_data:
+  kafka_data:
+  ldap_data:
+  zabbix_mysql_data:
+  mssql_data:
+
+# === 网络 ===
+networks:
+  default:
+    driver: bridge
				`@@ -0,0 +1 @@`
				`docker run --rm -p 5020:5020 oitc/modbus-server:latest`
				`@@ -0,0 +1 @@`
				`ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDlI+AHyaqC8RlyMANUeFCoA6XfD+w0PxIm26lSr0eYY6+VAfUVyyI27i9P1oP4bNbUSlOuYDEkne64ZD1oWwNqY2STQUgUvWcd4rOS1Zf+qIbXvlif08pknojNbYH7lb5UPmbzWJaz75SHPIajFi70Xvldo6BiPc/y/rFShmuonPmlNyv2/jE9dfD54U8N91P+yqWRy27yAeS3YOhSCm3xE01fAmuOO71xOA7KTO4L45Y9AdOX450uP7fYCPsVaO+2OZoju9m1edZTIae0RArBdNrU673lsIy+KKyLQVU7k3ANwg2XtJo7fBO+Yg0DYRQFP2MzvdKIu3eelMU9jES9 fscan-test-key`
				`@@ -0,0 +1 @@`
				`ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqT7cZeiUntMqhmtmCjTx/Xq3sRlwd3jOvxiWp1nTzScLIMivNIOIOURR0JEU3oDkbe5VDGlAjQI53EI5W4SRsXbuLQfYfEqreThKERRLlrLC/22ICRH1YOQjPRp2Lz1VwtChbw//8dqU+7lGihTQmpcom+13/JnpbRr0RiRTtVGHcUOq0+c8/EPYls+lzI7AAmwKZH9RrBCDvulL37dEE1c7YJFHrJaxAsjnORlWpMSGHY1/DOz79SHNLdb+BcJJgswVEDO1YQlgv1AXIYE3MgkwDql2hPwiu+TVnNfzB6eD7MwUlHaLoQ5IZETV8QVmJDiT5lCUstvhyWRKUJqxn fscan-test-root`