c0r0n3r/dheater

GitHubRepository PoC

PoC files

48 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2002-20001Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile builds a container for D(HE)ater, a proof-of-concept denial-of-service tool that enforces Diffie-Hellman key exchange against TLS/SSH servers. The container runs as 'nobody' and executes the 'dheat' command.

Dockerfile:1-14

Lab assessment

Vulnerability lab

The repository explicitly describes itself as a proof-of-concept implementation of the D(HE)at attack (CVE-2002-20001), a denial-of-service vulnerability. The Dockerfile packages this tool, and the README, CHANGELOG, and other documentation confirm its purpose for defensive testing and research.

README.md:1-10CHANGELOG.md:1-5CITATION.cff:1-10
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

builds the D(HE)ater container image

Uses python:3.13-slim, copies the source into /usr/src/dheater, installs the package with pip, switches to user nobody, and sets the entrypoint to 'dheat' with default '--help'.

Dockerfile:1-14

dheater Python package

implements the D(HE)at attack logicprovides the 'dheat' CLI entrypointprovides the 'dh_param_priv_key_size_setter' helper

Contains the main attack script (dheater/__main__.py) that performs pre-checks, enforces DHE/ECDHE key exchange over TLS or SSH, and manages threads. Also includes a helper to set private key size in DH parameter files.

dheater/__main__.py:1-760dheater/dh_param_priv_key_size_setter.py:1-56pyproject.toml:48-50

DH parameter files

provide well-known DH parameters for the attack

A collection of PEM-encoded DH parameter files (ffdhe and modp groups) in various key sizes, used by the tool to forge ephemeral keys.

data/dhparam-ffdhe-2048.pem:1-8data/dhparam-modp-2048.pem:1-8

Fail2Ban filters

provide detection rules for D(HE)at attack patterns

Fail2Ban configuration files for Apache and Dovecot to detect SSL/TLS handshake interruptions caused by the attack.

fail2ban/apache-ssl.conf:1-13fail2ban/dovecot-ssl.conf:1-16

CI/CD pipeline

automates testing and Docker image publishing

GitLab CI configuration runs linting, unit tests, and builds/pushes the Docker image to Docker Hub with a description referencing CVE-2002-20001.

.gitlab-ci.yml:1-54
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2002-20001

Supported by supplied evidence

The entire repository is dedicated to demonstrating CVE-2002-20001. The README, CHANGELOG, CITATION.cff, pyproject.toml, and CI configuration all explicitly associate the tool with this CVE.

README.md:1-10CHANGELOG.md:1-5CITATION.cff:1-10pyproject.toml:7.gitlab-ci.yml:50
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Python 3.9 or newer is required to run the tool.pyproject.toml:18
  • The target server must support DHE or ECDHE key exchange over TLS or SSH.dheater/__main__.py:1-760
  • The user must specify a target URI and protocol (--protocol tls|ssh).README.md:27-33

Evidence-described exercise path

  1. Build the Docker image from the Dockerfile.Dockerfile:1-14
  2. Run the container with the 'dheat' command, providing the target protocol and URI (e.g., 'dheat --protocol tls example.com:443').README.md:27-33
  3. The tool performs a pre-check to confirm DHE/ECDHE support, then launches threads that continuously send forged key exchange messages to saturate the server's CPU.dheater/__main__.py:1-760
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile builds a tool explicitly designed to attack external TLS/SSH servers. It does not contain any instructions that target the Docker host, escape the container, persist data, steal credentials, or connect to external systems beyond the user-specified target. The container runs as 'nobody' and the entrypoint is the attack tool itself. All behavior is consistent with a vulnerability research lab.

Dockerfile:1-14dheater/__main__.py:1-760
Review boundaries

What the analysis did not establish

  • The packet does not include a Compose file, so multi-service orchestration is not assessed.
  • The Dockerfile uses 'ADD . /usr/src/dheater', which copies the entire build context; the exact contents of the build context are not fully enumerated beyond the provided evidence files.
  • The tool's network behavior is directed at a user-supplied target; the safety verdict assumes the user follows the documented responsible-use policy.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1