GNS3 Ubuntu Caldera Sandcat attacker node with offensive tools. Part of the COHORT framework.
245
An Ubuntu Noble (24.04) container running the MITRE Caldera Sandcat agent (disguised as splunkd). Acts as the attacker node in COHORT — a multi-agent AI framework for autonomous network defense. More information and source material at cohort-experiments-app.streamlit.app.
The agent communicates with the Caldera C2 server over a dedicated out-of-band management interface (eth1) that bypasses the emulated GNS3 topology. Attacks are performed over eth0.
| Adapter | Purpose |
|---|---|
eth0 | GNS3 topology — attack traffic |
eth1 | Out-of-band management — Caldera C2 communication |
Using a separate management interface ensures C2 connectivity is maintained even if eth0 is disrupted by mitigations (e.g. firewall rule changes, link removal during IDS insertion).
| Variable | Default | Description |
|---|---|---|
IP | 192.168.1.2 | IP address assigned to eth0 |
DEFAULT_GATEWAY | 192.168.1.1 | Default gateway for eth0 |
CALDERA_SERVER | 172.17.0.1 | IP/hostname of the Caldera C2 server |
MGMT_IP | 203.0.113.2 | IP address assigned to eth1 (management) |
GROUP | red | Caldera agent group to join |
PROTOCOL | https | Protocol used to reach Caldera (https or http) |
PORT | 8443 | Caldera server port (8443 for HTTPS, 8888 for HTTP) |
Important: Network configuration is applied by
entrypoint.shat startup using these environment variables. Do not edit the network settings via GNS3's "Edit Config" — changes there will be overridden on every restart. Always configure IP, gateway, and Caldera server address through the environment variables in the GNS3 appliance settings.
hping3, nmap, tcpdump, netcat, socat, openssl, sshpass, dsniff (arpspoof), curl, wget, nftables, iptables, ufw, fail2ban, conntrack, ipset, iperf3, mtr, traceroute, python3, jq, vim
This image is designed for use in isolated network emulation environments only. It contains offensive security tools and a Caldera agent. Do not deploy on production or internet-accessible networks.
CC BY-NC-SA 4.0 — free to share and adapt for non-commercial purposes, with attribution and under the same license.
Content type
Image
Digest
sha256:c44bdc6a1…
Size
161.9 MB
Last updated
6 months ago
docker pull cohort3213/ubuntu-agent-sandcat-https