malvbox 1.0.0__tar.gz

malvbox-1.0.0/.gitignore

@@ -0,0 +1,4 @@
+.buildenv/
+dist/
+*.egg-info/
+__pycache__/

malvbox-1.0.0/PKG-INFO

@@ -0,0 +1,53 @@
+Metadata-Version: 2.5
+Name: malvbox
+Version: 1.0.0
+Summary: Exegol-like offensive container CLI wired to the malveillance platform VPN
+License-Expression: MIT
+Keywords: docker,exegol,offensive-security,pentest,wireguard
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+
+# malvbox (wrapper installable)
+
+Distribue la commande `malvbox` **comme Exegol** : via `pipx`, sans que
+l'utilisateur ne manipule un fichier script.
+
+## Pour l'utilisateur final
+
+```bash
+pipx install malvbox        # une fois publié sur PyPI
+malvbox start redteam --vpn ~/malveillance.conf -s ~/partage
+```
+
+Prérequis : `docker`, `bash` (déjà présents sous Linux/WSL/macOS), et le module
+noyau `wireguard`. Le paquet n'embarque que le lanceur ; l'arsenal est dans
+l'image Docker `ghcr.io/loic051n7/malvbox:default`, tirée automatiquement.
+
+## Pour toi (mainteneur)
+
+Le paquet embarque le script bash canonique (`../malvbox`) et l'exécute. Pour
+(re)construire après une modif du script :
+
+```bash
+cd wrapper
+./build.sh                  # resync + build dans dist/
+./build.sh --publish        # + upload PyPI (twine)
+```
+
+Test local avant publication :
+
+```bash
+pipx install ./wrapper
+malvbox version
+```
+
+### Diffusion sans exposer le code source
+
+- **PyPI public** (comme Exegol) : `pipx install malvbox`. Le code reste
+  téléchargeable (open source), mais l'utilisateur ne gère aucun fichier.
+- **Index privé** (`--repository-url`) ou dépôt Git privé
+  (`pipx install git+https://…`) : diffusion restreinte si tu ne veux pas
+  rendre la source publique.
+
+Dans tous les cas, l'image Docker (l'arsenal) reste sur GHCR et se pull toute
+seule — rien d'autre à télécharger.

malvbox-1.0.0/README.md

@@ -0,0 +1,44 @@
+# malvbox (wrapper installable)
+
+Distribue la commande `malvbox` **comme Exegol** : via `pipx`, sans que
+l'utilisateur ne manipule un fichier script.
+
+## Pour l'utilisateur final
+
+```bash
+pipx install malvbox        # une fois publié sur PyPI
+malvbox start redteam --vpn ~/malveillance.conf -s ~/partage
+```
+
+Prérequis : `docker`, `bash` (déjà présents sous Linux/WSL/macOS), et le module
+noyau `wireguard`. Le paquet n'embarque que le lanceur ; l'arsenal est dans
+l'image Docker `ghcr.io/loic051n7/malvbox:default`, tirée automatiquement.
+
+## Pour toi (mainteneur)
+
+Le paquet embarque le script bash canonique (`../malvbox`) et l'exécute. Pour
+(re)construire après une modif du script :
+
+```bash
+cd wrapper
+./build.sh                  # resync + build dans dist/
+./build.sh --publish        # + upload PyPI (twine)
+```
+
+Test local avant publication :
+
+```bash
+pipx install ./wrapper
+malvbox version
+```
+
+### Diffusion sans exposer le code source
+
+- **PyPI public** (comme Exegol) : `pipx install malvbox`. Le code reste
+  téléchargeable (open source), mais l'utilisateur ne gère aucun fichier.
+- **Index privé** (`--repository-url`) ou dépôt Git privé
+  (`pipx install git+https://…`) : diffusion restreinte si tu ne veux pas
+  rendre la source publique.
+
+Dans tous les cas, l'image Docker (l'arsenal) reste sur GHCR et se pull toute
+seule — rien d'autre à télécharger.

malvbox-1.0.0/build.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Resynchronise le script bash canonique puis construit le paquet malvbox.
+#   ./build.sh           -> copie ../malvbox et build le wheel dans dist/
+#   ./build.sh --publish -> build + upload sur PyPI (twine)
+# Utilise un venv local (.buildenv) pour éviter PEP 668 (externally-managed).
+set -euo pipefail
+cd "$(dirname "$0")"
+
+cp ../malvbox src/malvbox/malvbox.sh
+echo "✓ script synchronisé ($(wc -l < src/malvbox/malvbox.sh) lignes)"
+
+VENV=.buildenv
+[ -d "$VENV" ] || python3 -m venv "$VENV"
+"$VENV/bin/pip" install --quiet --upgrade pip build twine
+
+rm -rf dist
+"$VENV/bin/python" -m build
+echo "✓ paquet construit dans dist/"
+
+if [ "${1:-}" = "--publish" ]; then
+  "$VENV/bin/twine" upload dist/*
+  echo "✓ publié"
+fi

malvbox-1.0.0/pyproject.toml

@@ -0,0 +1,22 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "malvbox"
+version = "1.0.0"
+description = "Exegol-like offensive container CLI wired to the malveillance platform VPN"
+readme = "README.md"
+requires-python = ">=3.8"
+license = "MIT"
+keywords = ["pentest", "docker", "exegol", "wireguard", "offensive-security"]
+
+[project.scripts]
+malvbox = "malvbox.cli:main"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/malvbox"]
+
+# Embarque le script bash comme donnée de paquet (le point d'entrée l'exécute).
+[tool.hatch.build.targets.wheel.force-include]
+"src/malvbox/malvbox.sh" = "malvbox/malvbox.sh"

malvbox-1.0.0/src/malvbox/__init__.py

@@ -0,0 +1 @@
+__version__ = "1.0.0"

malvbox-1.0.0/src/malvbox/cli.py

@@ -0,0 +1,20 @@
+"""malvbox — thin launcher.
+
+The whole CLI lives in the bundled ``malvbox.sh``; this entry point just execs
+it with bash, forwarding all arguments. Packaging it this way lets users install
+the command with ``pipx install malvbox`` (like Exegol) without ever handling a
+raw script file.
+"""
+import os
+import shutil
+import sys
+from pathlib import Path
+
+
+def main() -> None:
+    script = Path(__file__).with_name("malvbox.sh")
+    bash = shutil.which("bash")
+    if bash is None:
+        sys.exit("malvbox: 'bash' is required but was not found in PATH "
+                 "(on Windows, run malvbox from WSL).")
+    os.execv(bash, [bash, str(script), *sys.argv[1:]])

malvbox-1.0.0/src/malvbox/malvbox.sh

@@ -0,0 +1,234 @@
+#!/usr/bin/env bash
+# ═════════════════════════════════════════════════════════════════════════════
+# malvbox — Exegol-like CLI for the malveillance platform.
+#   One image (Kali + Exegol-Free arsenal + wordlists + resources) that wires
+#   straight onto the platform WireGuard VPN.
+#
+#   malvbox start redteam --vpn ~/malveillance.conf -s ~/share
+#   malvbox list | stop <name> | rm <name> [--purge]
+#   malvbox pull | build
+# ═════════════════════════════════════════════════════════════════════════════
+set -euo pipefail
+
+MALVBOX_VERSION="1.0"
+IMAGE_REPO="${MALVBOX_IMAGE_REPO:-ghcr.io/loic051n7/malvbox}"
+image_ref() { [ -n "${MALVBOX_IMAGE:-}" ] && echo "$MALVBOX_IMAGE" || echo "$IMAGE_REPO:default"; }
+PREFIX="malvbox-"
+SELF="$(readlink -f "${BASH_SOURCE[0]}" 2>/dev/null || echo "${BASH_SOURCE[0]}")"
+HERE="$(cd "$(dirname "$SELF")" && pwd)"
+
+c() { printf '\033[%sm%s\033[0m' "$1" "$2"; }
+info() { echo "$(c '1;36' '›') $*"; }
+err()  { echo "$(c '1;31' '✗') $*" >&2; }
+die()  { err "$*"; exit 1; }
+cname() { echo "${PREFIX}$1"; }
+
+# ── Encadré "container summary" façon Exegol ─────────────────────────────────
+BOX_L=16; BOX_V=64
+_dl()   { local s; s=$(printf '%*s' "$1" ''); printf '%s' "${s// /─}"; }
+tbord() { printf '%s%s%s%s%s\n' "$1" "$(_dl 18)" "$2" "$(_dl $((BOX_V+2)))" "$3"; }
+trow()  { # label  value  [ansi-code]
+  local val="$2" n=${#2} disp
+  [ "$n" -gt "$BOX_V" ] && { val="${2:0:$((BOX_V-1))}…"; n=$BOX_V; }
+  disp="$val"; [ -n "${3:-}" ] && disp="$(c "$3" "$val")"
+  printf '│ %*s │ %s%*s │\n' "$BOX_L" "$1" "$disp" "$((BOX_V-n))" ''
+}
+
+usage() {
+  cat <<EOF
+$(c '1;35' malvbox) — offensive box + VPN
+
+Usage: malvbox <command> [options]
+
+  start   <name> [--vpn <conf|url>] [-s <dir>]
+          create the box and open a shell — or, if it exists, start it and open
+          a shell. Run it again anytime to get back in. Graphical tools
+          (Firefox…) display on your screen automatically.
+  exec    <name> <cmd…>      run a command in the box (no interactive shell)
+  restart <name>             restart the box and open a shell
+  stop    <name>             stop a box (workspace kept)
+  update  <name> [start opts] pull the latest image and recreate the box
+  info    <name>             show a box's status and mounts
+  list                       list boxes and their state
+  rm      <name> [--purge]   remove a box (--purge: drop its workspace too)
+  pull                       pull the latest image
+  build                      build the image locally
+  version                    print malvbox and image version
+
+start options
+  -s, --share    share a host dir into the box (repeatable):
+                   ~/loot            -> /root/work/loot
+                   ~/loot:/opt/x     -> explicit mountpoint
+                   ~/loot:ro         -> read-only
+  --vpn          WireGuard .conf path OR URL (/api/user/vpn/config)
+  --cookie       session cookie if --vpn is a protected URL
+  --full-tunnel  route all traffic through the VPN
+  --no-pull      use the local image, skip pull
+EOF
+}
+
+need_docker() { command -v docker >/dev/null || die "docker not found in PATH"; }
+
+resolve_conf() { # <src> <cookie> -> local .conf path on stdout
+  local src="$1" cookie="${2:-}" tmp
+  if [[ "$src" =~ ^https?:// ]]; then
+    tmp="$(mktemp --suffix=.conf)"
+    if [ -n "$cookie" ]; then curl -fsSL --cookie "$cookie" "$src" -o "$tmp" || die "VPN download failed (bad cookie?)"
+    else curl -fsSL "$src" -o "$tmp" || die "VPN download failed (private config: pass --cookie)"; fi
+    grep -q '\[Interface\]' "$tmp" || die "downloaded file is not a WireGuard config"
+    echo "$tmp"
+  else
+    [ -f "$src" ] || die "VPN config not found: $src"
+    echo "$src"
+  fi
+}
+
+cmd_start() {
+  need_docker
+  local name="" vpn="" cookie="" full=0 nopull=0
+  local -a run_cmd=() shares=()
+  while [ $# -gt 0 ]; do case "$1" in
+    -n|--name) name="$2"; shift 2 ;;
+    --vpn) vpn="$2"; shift 2 ;;
+    --cookie) cookie="$2"; shift 2 ;;
+    --full-tunnel) full=1; shift ;;
+    -s|--share) shares+=("$2"); shift 2 ;;
+    --image) MALVBOX_IMAGE="$2"; shift 2 ;;
+    --no-pull) nopull=1; shift ;;
+    --) shift; run_cmd=("$@"); break ;;
+    -*) die "unknown option: $1" ;;
+    *) [ -z "$name" ] && { name="$1"; shift; } || die "unexpected argument: $1" ;;
+  esac; done
+  [ -n "$name" ] || { usage; die "a name is required: malvbox start <name>"; }
+  # Display forwarding is always on when the host exposes one (WSLg / X11), so
+  # graphical tools (Firefox…) can open their window on your screen.
+  local gui=0
+  { [ -d /mnt/wslg ] || [ -e /tmp/.X11-unix ] || [ -n "${DISPLAY:-}" ]; } && gui=1
+  local image cn; image="$(image_ref)"; cn="$(cname "$name")"
+
+  # Already running -> open another shell. Stopped -> start it, then shell.
+  if docker ps --format '{{.Names}}' | grep -qx "$cn"; then
+    exec docker exec -it "$cn" zsh
+  fi
+  if docker ps -a --format '{{.Names}}' | grep -qx "$cn"; then
+    docker start "$cn" >/dev/null; exec docker exec -it "$cn" zsh
+  fi
+
+  local -a args=(run -it --name "$cn" --hostname "$name"
+    -v "${PREFIX}${name}-work:/root/work"
+    --cap-add NET_ADMIN --device /dev/net/tun
+    --sysctl net.ipv4.conf.all.src_valid_mark=1)
+
+  # Shared dirs (host<->box, rw, live). Default mountpoint in the home (~), kept
+  # separate from ~/work where you actually work.
+  local sh hostp contp ro; local -a share_disp=()
+  for sh in "${shares[@]:-}"; do
+    [ -z "$sh" ] && continue
+    ro=""; case "$sh" in *:ro) ro=":ro"; sh="${sh%:ro}" ;; esac
+    if [[ "$sh" == *:/* ]]; then hostp="${sh%%:*}"; contp="${sh#*:}"
+    else hostp="$sh"; contp="/root/$(basename "$sh")"; fi
+    hostp="$(cd "$hostp" 2>/dev/null && pwd || echo "$hostp")"
+    [ -e "$hostp" ] || die "share not found: $hostp"
+    args+=(-v "$hostp:$contp$ro")
+    share_disp+=("$hostp -> $contp (${ro:+ro}${ro:-rw})")
+  done
+
+  # GUI: X11 forwarding + a root-owned runtime dir so Firefox runs as root.
+  if [ "$gui" = 1 ]; then
+    args+=(-e "DISPLAY=${DISPLAY:-:0}" -v /tmp/.X11-unix:/tmp/.X11-unix
+      -e XDG_RUNTIME_DIR=/run/user/0 -e MOZ_ENABLE_WAYLAND=0)
+  fi
+
+  # VPN: mount the .conf; the entrypoint brings the tunnel up.
+  local vpn_disp="none" conf=""
+  if [ -n "$vpn" ]; then
+    conf="$(resolve_conf "$vpn" "$cookie")"
+    args+=(-v "$conf:/vpn/wg.conf:ro")
+    vpn_disp="$conf"
+    if [ "$full" = 1 ]; then args+=(-e VPN_FULL_TUNNEL=1); vpn_disp="$conf (full-tunnel)"; fi
+  fi
+
+  if [ "$nopull" = 0 ]; then
+    docker pull "$image" >/dev/null 2>&1 || info "pull failed (offline?) — using local image"
+  fi
+
+  echo
+  echo "$(c '1;33' ★) $(c '1;37' 'Container summary')"
+  tbord ┌ ┬ ┐
+  trow Name "$name" '1;37'
+  trow Image "$image"
+  tbord ├ ┼ ┤
+  if [ "$gui" = 1 ]; then trow "Console GUI" "on ✓ (X11)" '1;32'; else trow "Console GUI" "off" '2'; fi
+  if [ "$vpn_disp" = none ]; then trow VPN "off" '2'; else trow VPN "$vpn_disp" '1;32'; fi
+  trow Network "bridge"
+  trow Resources "/opt/resources"
+  if [ ${#share_disp[@]} -gt 0 ]; then
+    trow Shares "${share_disp[0]}"
+    for ((i=1;i<${#share_disp[@]};i++)); do trow "" "${share_disp[i]}"; done
+  else
+    trow Shares "none" '2'
+  fi
+  trow Workspace "/root/work  (${PREFIX}${name}-work)"
+  trow Privileged "off ✓ (cap NET_ADMIN)"
+  tbord └ ┴ ┘
+  echo
+
+  exec docker "${args[@]}" "$image" "${run_cmd[@]:-zsh}"
+}
+
+cmd_exec() { need_docker; [ $# -ge 2 ] || die "usage: malvbox exec <name> <cmd...>"
+  local name="$1"; shift
+  exec docker exec -it "$(cname "$name")" "$@"; }
+
+cmd_restart() { need_docker; [ $# -ge 1 ] || die "usage: malvbox restart <name>"
+  local cn; cn="$(cname "$1")"; docker restart "$cn" >/dev/null || die "no such box: $1"
+  exec docker exec -it "$cn" zsh; }
+
+cmd_update() { need_docker; [ $# -ge 1 ] || die "usage: malvbox update <name> [start options]"
+  local name="$1"; shift
+  info "pulling latest image…"; docker pull "$(image_ref)" || info "pull failed — keeping current image"
+  docker rm -f "$(cname "$name")" >/dev/null 2>&1 || true   # workspace volume is kept
+  info "recreating '$name' on the latest image…"
+  cmd_start "$name" --no-pull "$@"; }
+
+cmd_info() { need_docker; [ $# -ge 1 ] || die "usage: malvbox info <name>"
+  local cn; cn="$(cname "$1")"
+  docker ps -a --filter "name=^/${cn}$" --format 'BOX {{.Names}}  ·  {{.Status}}  ·  {{.Image}}' | sed "s/${PREFIX}//"
+  docker inspect "$cn" --format 'mounts:{{range .Mounts}}
+  {{if .Name}}{{.Name}}{{else}}{{.Source}}{{end}} -> {{.Destination}}{{end}}' 2>/dev/null || die "no such box: $1"; }
+
+cmd_stop() { need_docker; [ $# -ge 1 ] || die "usage: malvbox stop <name>"
+  docker stop "$(cname "$1")" >/dev/null && info "stopped $1"; }
+
+cmd_rm() { need_docker; [ $# -ge 1 ] || die "usage: malvbox rm <name> [--purge]"
+  local name="$1" purge=0; [ "${2:-}" = "--purge" ] && purge=1
+  docker rm -f "$(cname "$name")" >/dev/null 2>&1 || true
+  if [ "$purge" = 1 ]; then docker volume rm "${PREFIX}${name}-work" >/dev/null 2>&1 || true
+    info "removed $name (+ workspace)"
+  else info "removed $name (workspace kept)"; fi; }
+
+cmd_list() { need_docker
+  docker ps -a --filter "name=^/${PREFIX}" \
+    --format 'table {{.Names}}\t{{.Status}}\t{{.Image}}' | sed "1s/NAMES/BOX/;s/${PREFIX}//"; }
+
+cmd_pull()  { need_docker; exec docker pull "$(image_ref)"; }
+cmd_build() { need_docker
+  [ -f "$HERE/Dockerfile" ] || die "no Dockerfile next to this script — 'build' needs the source repo. To just use malvbox, run 'malvbox pull'."
+  # --progress=plain streams the per-repo clone counter ([ 42%] 71/168 …) live.
+  exec docker build --progress=plain -t "$(image_ref)" "$HERE"; }
+
+case "${1:-}" in
+  start)   shift; cmd_start   "$@" ;;
+  exec)    shift; cmd_exec    "$@" ;;
+  restart) shift; cmd_restart "$@" ;;
+  stop)    shift; cmd_stop    "$@" ;;
+  update)  shift; cmd_update  "$@" ;;
+  info)    shift; cmd_info    "$@" ;;
+  list|ls) shift; cmd_list    "$@" ;;
+  rm|remove) shift; cmd_rm    "$@" ;;
+  pull)    shift; cmd_pull    "$@" ;;
+  build)   shift; cmd_build   "$@" ;;
+  version|--version|-v) echo "malvbox $MALVBOX_VERSION  ·  image $(image_ref)" ;;
+  ""|-h|--help|help) usage ;;
+  *) err "unknown command: $1"; usage; exit 1 ;;
+esac