lorsanta/exploit-CVE-2020-28926

GitHubRepository PoC

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2020-28926Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker container based on Ubuntu 16.04 that builds and runs MiniDLNA 1.2.1, intended as a target for exploiting CVE-2020-28926.

Dockerfile:1-38README.md:1-5

Lab assessment

Vulnerability lab

The README explicitly states the repository is for exploiting CVE-2020-28926, and the Dockerfile builds the vulnerable MiniDLNA 1.2.1 version. The included exploit script targets this CVE.

README.md:1explot.py:5-9
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

builds the vulnerable MiniDLNA 1.2.1 target

Defines an Ubuntu 16.04 image, installs build dependencies, copies the MiniDLNA 1.2.1 source, compiles and installs it, and copies a default configuration.

Dockerfile:1-38

build_and_run.sh

builds the Docker imageruns the container with seccomp disabled and port 8200 exposed

A shell script that builds the Docker image tagged 'minidlna' and runs it with --security-opt seccomp=unconfined and port mapping 8200:8200.

build_and_run.sh:1-5

explot.py

exploit script for CVE-2020-28926

A Python script that connects to a target IP and port, sends a crafted HTTP POST request with chunked transfer encoding to trigger an infinite loop or memory corruption (SIGSEGV) in MiniDLNA 1.2.1.

explot.py:1-57
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2020-28926

Supported by supplied evidence

The exploit script explicitly targets CVE-2020-28926, referencing the vulnerable code paths in upnphttp.c and the MiniDLNA 1.2.1 version. The Dockerfile builds that exact version.

explot.py:5-9Dockerfile:33
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • The MiniDLNA 1.2.1 source code must be present in a folder named 'minidlna-1.2.1' in the same directory as the Dockerfile.Dockerfile:33
  • Docker must be installed to build and run the container.build_and_run.sh:3-4

Evidence-described exercise path

  1. Place the MiniDLNA 1.2.1 source in a folder named 'minidlna-1.2.1' alongside the Dockerfile.Dockerfile:33
  2. Run build_and_run.sh to build the Docker image and start the container.build_and_run.sh:1-5
  3. Execute explot.py with the target IP and port (e.g., localhost:8200) to trigger the vulnerability.explot.py:1-57
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The exploit script targets only the MiniDLNA service inside the container. The Docker run command exposes port 8200 and disables seccomp, which are typical for a vulnerability lab. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior beyond the intended target.

explot.py:1-57build_and_run.sh:1-5
Review boundaries

What the analysis did not establish

  • The MiniDLNA 1.2.1 source code is not included in the packet; it must be supplied separately.
  • The Dockerfile copies the source from a local directory, but the directory contents are not provided.
  • The exploit script contains commented-out code for triggering SIGSEGV; only the infinite loop payload is active by default.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1