m0d0ri205/wargame_Re-LS

GitHubRepository PoC

PoC files

13 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2025-0184Compose · mixed

1 Compose manifest · 3 Dockerfiles · 7 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for a CTF challenge exploiting CVE-2025-0184, a DOCX SSRF vulnerability. It includes a main web server, internal services (admin, database, cache, metrics), Redis, and an optional Portainer container.

docker-compose.yml:1-126

Lab assessment

Vulnerability lab

The environment is explicitly described as a CTF challenge for CVE-2025-0184. The README states it is a 'CVE-2025-0184 DOCX SSRF CTF Challenge' and provides an exploit generator. The main application (src/app.py) contains intentional SSRF vulnerabilities and a flag to capture.

README.md:1-33src/app.py:1-328
Lab shapeCompose · mixed
Services7
Compose manifests1
Dockerfiles3
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

docx-ssrf-web

CTF web serverSSRF vulnerable application

Main Flask web application on port 8080 (mapped to host 13687). Accepts DOCX file uploads, extracts external relationships, and makes SSRF requests to the extracted URLs. Requires a hardcoded hash key for authentication. Contains a flag in environment variable FLAG.

docker-compose.yml:5-24src/app.py:1-328

internal-admin

target internal serviceflag holder

Internal Flask admin service on port 3003. Returns a flag when accessed with the correct admin token. Not exposed externally; reachable only from within the Docker network.

docker-compose.yml:26-38src/admin_service.py:1-96

internal-db

decoy internal service

Internal service on port 3001, built from Dockerfile.internal. Provides generic service info endpoints. No flag or sensitive data visible.

docker-compose.yml:40-51src/internal_service.py:1-115

internal-cache

decoy internal service

Internal service on port 3002, built from Dockerfile.internal. Provides generic service info endpoints.

docker-compose.yml:53-64src/internal_service.py:1-115

internal-metrics

decoy internal service

Internal service on port 3004, built from Dockerfile.internal. Provides generic service info endpoints.

docker-compose.yml:66-77src/internal_service.py:1-115

redis

optional session store

Redis 7 Alpine container, exposed on port 6379 within the network. Described as optional for session management.

docker-compose.yml:80-89

portainer

development monitoring tool

Portainer CE container, only started with the 'dev' profile. Mounts the Docker socket, providing host Docker management. Not part of the core challenge.

docker-compose.yml:92-103
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-0184

Supported by supplied evidence

The environment is explicitly built around CVE-2025-0184. The main application (src/app.py) implements a DOCX SSRF vulnerability, extracting URLs from DOCX relationships and making requests to them, which matches the described CVE. The README and exploit generator confirm the association.

src/app.py:1-328README.md:1-33exploits/exploit_generator.py:1-93
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.README.md:5-10
  • The attacker must know the hardcoded hash key (60e27a00dc01ca8e39c21cc3989dd525e24371b0bd238fe506e789e8572a69ae) to authenticate to the upload endpoint.src/app.py:44templates/index.html:300
  • The attacker must craft a malicious DOCX file containing an external relationship pointing to the internal admin service (http://internal-admin:3003/admin?token=...) to trigger the SSRF.exploits/exploit_generator.py:1-93

Evidence-described exercise path

  1. Build and start the Docker Compose environment using 'make setup', 'make build', 'make up'.README.md:5-10
  2. Access the web interface at http://localhost:13687 and authenticate using the hardcoded hash key.templates/index.html:300
  3. Generate a malicious DOCX payload using the provided exploit generator (exploits/exploit_generator.py) or manually craft a DOCX with an external relationship to http://internal-admin:3003/admin?token=...exploits/exploit_generator.py:1-93
  4. Upload the malicious DOCX file via the web interface. The server will extract the URL and make an SSRF request to the internal admin service.src/app.py:200-250
  5. The response from the internal admin service, containing the flag, is returned in the upload results.src/app.py:150-170
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the intended lab target (internal services). The SSRF requests are made to internal Docker network addresses. The Portainer container with Docker socket access is optional and only active in the 'dev' profile, which is a legitimate development tool. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior beyond the lab scope.

docker-compose.yml:1-126src/app.py:1-328
Review boundaries

What the analysis did not establish

  • The Portainer service mounts the Docker socket (/var/run/docker.sock) and is only active in the 'dev' profile, which could allow host container management if enabled, but it is not part of the default challenge profile.
  • The exploit generator script (exploits/exploit_generator.py) is a Python script that generates DOCX files; its behavior is fully visible and expected for the lab.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1