Exploring Windows installers using Docker

16 Oct 2019

Exploring Windows installers using Docker

Somedays it’s useful to run an installer for a Windows program, check which files have changed, and copy out files we’re interested in afterwards. We can use a Windows Docker environment to do this.

Software Used

Docker
Dive (for exploring file changes)

As an example, we’ll use a prebuilt OpenJDK MSI installer. This was tested on a Windows 10 box to support the Windows base Docker image, and the Dockerfile is available at github.com/kevinkle/windows-installers. Note that you’ll need the host OS version to match (or be newer) than the container OS version and you’ll need to switch your host to use Windows containers, see here.

Building the Docker image

Here’s an example Dockerfile for the OpenJDK MSI installer. You could use a similar approach for any installer, but it has to support unattended installs, and if it’s not a MSI you’d have to modify the Run command to call the executable directly instead of using msiexec.

# This is because the Host is running 1903.
FROM mcr.microsoft.com/windows:1903

# Download OpenJDK
ADD https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u222-b10/OpenJDK8U-jdk_x86-32_windows_hotspot_8u222b10.msi C:\OpenJDK8U-jdk_x86-32_windows_hotspot_8u222b10.msi

# You could alternatively copy over the installer
# COPY example.msi c:\example.msi

# Execute structure from:
# docs.microsoft.com/en-us/virtualization/windowscontainers/manage-docker/manage-windows-dockerfile#examples-of-using-run-with-windows
RUN powershell.exe -Command Start-Process -Wait -FilePath msiexec -ArgumentList /i, "C:\OpenJDK8U-jdk_x86-32_windows_hotspot_8u222b10.msi", /qn

We’ll execute the docker build through Dive so we can jump straight to the file changes.

dive build -t winmsi .

This is executed from the folder containing the Dockerfile, and we’re tagging the image winmsi.

Exploring file changes

You should get a Dive interface like so:

dive

Hit the down arrow three times to get the changes from our MSI installer.

dive_msi

And for example, we can filter for java.exe by using:

Ctrl+F
java.exe

dive_java

Copying out the executable

We can then copy out a file we’re interested, per here. This creates a container from your Docker image, copys out the file, and removes the container. It doesn’t actually run the container during the docker create winmsi command.

docker create winmsi  # returns container ID
docker cp b8faa6eba9b78b83e473bb91d12fd4aca6a8090c172a783b906a8014e5706546:'/Program Files (x86)/AdoptOpenJDK/jdk-8.0.222.10-hotspot/bin/java.exe' .
docker rm b8faa6eba9b78b83e473bb91d12fd4aca6a8090c172a783b906a8014e5706546

Caveats

This is still executing code on your network
The installer must support unattended installs
You could use the same approach for testing any executable; for example, malware analysis is often run with network connectivity in case it pulls down malicious payloads after the fact