All right, so in the last picture, we set up Dacher in our Moonta server and we confirmed that the
juice shop container works.
Now we need to set up this universe of Otar and then we need to go through the somewhat convoluted process
of forwarding the logs from the container to the host, which is the input to the virtual machine.
Some ambiguity, right?
Because in Docker, a host is the computer that contains some more ambiguity.
The Docker container right in the virtual machine, speak to the host is our physical machine.
So there's two different ways we're using host here when it comes to the containers and docker, the
host is just the computer that has the Docker demon running, OK?
And that's our Moonta system.
So what we're going to do is first let's go ahead and grab the universal order.
So if we go to Splunk products, I can scroll down.
We can go to free trials and download.
Click on Download now.
When I click on login.
Because I already have an account, I'm going to walk in with my account, it's free to make an account.
All right.
Really, really cool.
So we're logged in.
What we want is want the Linux Debian package.
So I just click Linux and then I go to the dot.
Deb, move over to download now.
And it's going to take me to I get like.
And now that we've got that going, we're going to come in line, you get click here to select everything,
right, click and copy or tab to switch over and then we should be able to see what directory when we're
in the home directory produce.
Right.
Click here.
And we'll just download.
The University of Florida into the home directory.
All right, so do we have it?
Yes, and you can see it is a Debian binary package, so we can actually use the package to install
it.
So I can say, you know, package tech, I espie tab install.
I love doing it this way, it's a lot easier than using TARP, the TARP package, tarballs.
All right, so now we can go to the Splunk.
If everything worked out correctly, it did very cool.
And what we can do in here is we're just going to run the Splunk binary, OK?
And we're going to tell it to start up.
So start we're going to accept the license on start except license going to enter a user name for the
universal order and then an admin password.
OK, so think this already listening, it's already bound import 1889, so we could change course,
but let me show you some little tricks here.
Do you want to change sports now?
I'm going to say yes, orks grap eighty eighty nine it.
I can see it's Plunket running with this pide.
Thirty nine.
Right.
So zero kill minus nine.
Patiño nine.
Now, it's not there anymore, so we should be able to start the universal voter.
All right, so it's done very good.
Let's also tell Splunk to start on Bhoot, so they want the universal forwarder to start on.
Bhoot would start.
Sweet.
And now we want to set up the forwarding server, so we're going to say forward server is going to be
10, 100 zero ninety nine nine nine seven.
This is going to be our Splunk indexer, which will set up in a future lesson.
We're going to use these credentials and password dash.
One, two, three, bang.
All right.
Very cool.
So now we need to do is set up our log directory on the host.
This directory doesn't exist, so we want the container logs in the container to go here.
So we're going to create that directory
and the P p just tells it to create the entire path.
The VA dub dub dub.
Now we can go there
right now.
We have nothing here.
Right.
And it's currently on BIRUTE.
So we're gonna have to fix this.
We're gonna have to change the user and the group to match the user and group process running documents,
I think running the container.
OK, so what we're going to do is take a look at zero images, OK, that's the image we have.
Yes, nothing's running.
It shows you the running container's Takasugi.
All container's.
So I'm going to delete this container with R.M. and the container name is romantic song, and it just
makes it randomly.
I'll be freaked out by that.
All right.
So now what we can do so we can say, Dacher, run as a demon and we want to map the directory we just
created almost to the directory and you shop that contains our logs and we're going to forward Port
3000.
Oh, we're going to need it to use container so we don't get crazy names like Romantic right now if
we run, you know, dustups.
Well, it's still giving us an error message.
Let's try this command from GitHub page.
All right, so that runs.
Let's just run it as a demon so we get the command from back zero docker.
Yes.
All right.
So it's running now.
We want to do it because we want to go into this docker container.
So we're going to say exactly interact with the terminal and we want to go into Brave Newton and we're
going to run the shell.
All right, so now we need to look at the processes and you can see this user juicer is the process
inside the container, running the juice shop app.
And if you do ID on user, you'll see it's one thousand and one, you know, so it's one thousand and
one for the Goodbody.
So that is what we need to make.
This folder said to you, so if we say zero change ownership, the recursive to 1001 for the user and
the group for each team holder,
it says Blank Gunlock for you, it's not related to Splunk.
That's probably because in the past already
it has blank mapped to group I.D. 1001.
So as far as the containers concerned, one doesn't want us to use it or not.
Spok.
All right.
So now that we have that mapping in place, we should be able to stop the container and started again
and get everything to work.
Right.
Zero ducker, stop breathing, eating, and then we'll run it through Dukkha run, we're running in
privileged mode to make it increasingly vulnerable, especially if they contain a root access to your
host.
Never do the same production.
We're doing it in the lab.
So if we compromised the container, we can pivot to the host.
Right, truly for learning.
Make it a demon and make sure that the process, Heidi, is one thousand and one and everybody going
down to one.
And we're going to map each team folder O to the G shop logs directly
on the images container and we use the ports.
Three thousand
it's running.
That looks really good.
So what we can do now is zero dark.
Exactly.
It just container.
Let's go to the lock for the
if you look in here and see there's an access library going there.
But if we hit the page, the logs would show up.
Right, because I'm going to get request to the server.
Klepec over glogg is now inside the container, if we exit the container, this is the moment of truth.
You're going to e-mail the host.
We should have access like there and we do.
Sweet.
So now we have a way of monitoring that file, right?
So we can just say zero opt Splunk, then zero Splunk ad monitor farther to the east now and we just
restarts Splunk
and now should be able to monitor our logs.
All right.
I know that is kind of complicated.
Do you have any questions?
Just hit me up now.
We're going to start monkeying around.