MauroEldritch/GEVAUDAN

GitHubRepository PoC

PoC files

8 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2018-1088CVE-2018-1112Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile builds a Debian Stretch container with GlusterFS server 3.8.8-1 installed, intended as a vulnerable target for CVE-2018-1088 and CVE-2018-1112. The repository also contains standalone and Metasploit exploit scripts.

Dockerfile:1-16README.md:1-29

Lab assessment

Vulnerability lab

The README explicitly states the project is an exploit for CVE-2018-1088 and CVE-2018-1112, and the Dockerfile installs a specific vulnerable version of glusterfs-server (3.8.8-1). The included scripts (gevaudan.rb, chastel.rb, metasploit module) are designed to detect and exploit these CVEs.

README.md:5-7Dockerfile:4
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

vulnerable target environment

Builds a Debian Stretch container, installs glusterfs-server 3.8.8-1, creates a world-writable mount point /mnt/gluster_volume, and starts the GlusterFS server. The CMD keeps the container alive with sleep infinity.

Dockerfile:1-16

gevaudan.rb

standalone exploit

A Ruby script that exploits CVE-2018-1088 and CVE-2018-1112 by mounting the gluster_shared_storage volume from a target host, then writing a malicious cron entry to /snaps/glusterfs_snap_cron_tasks to achieve privilege escalation.

gevaudan.rb:1-112

chastel.rb

vulnerability detection tool

A Ruby script that checks the local GlusterFS version, shared storage configuration, and presence of a symlink at /etc/cron.d/glusterfs_snap_cron_tasks to determine if the system is vulnerable to CVE-2018-1088 and CVE-2018-1112.

chastel.rb:1-36

metasploit/gluster_shared_storage.rb

Metasploit exploit module

A Metasploit module that exploits the same vulnerabilities by mounting the shared storage volume and injecting a user-specified command into the cron file, providing a framework-integrated attack.

metasploit/gluster_shared_storage.rb:1-108
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2018-1088

Supported by supplied evidence

The README, gevaudan.rb, chastel.rb, and the Metasploit module all reference CVE-2018-1088 as one of the targeted vulnerabilities. The exploit logic (mounting gluster_shared_storage and writing to a cron symlink) aligns with the described privilege escalation flaw.

README.md:5-7gevaudan.rb:3-4chastel.rb:2metasploit/gluster_shared_storage.rb:22-23

CVE-2018-1112

Supported by supplied evidence

The README, gevaudan.rb, chastel.rb, and the Metasploit module all reference CVE-2018-1112 as one of the targeted vulnerabilities. The exploit logic (mounting gluster_shared_storage and writing to a cron symlink) aligns with the described privilege escalation flaw.

README.md:5-7gevaudan.rb:3-4chastel.rb:2metasploit/gluster_shared_storage.rb:22-23
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • The exploit scripts require root privileges to run.gevaudan.rb:44-49
  • The target must be running GlusterFS server version 3.8.8-1 with gluster_shared_storage enabled.Dockerfile:4chastel.rb:14-22
  • The glusterfs-client package (providing mount.glusterfs) must be installed on the attacker machine.gevaudan.rb:52-57
  • Network connectivity to the target's GlusterFS ports (49152-49156) is required.gevaudan.rb:66-74

Evidence-described exercise path

  1. Build the Docker image from the provided Dockerfile to create a vulnerable GlusterFS server container.Dockerfile:1-16
  2. Run the container, ensuring the GlusterFS server starts and the shared storage volume is enabled.Dockerfile:14-16
  3. From an attacker machine with glusterfs-client installed, run gevaudan.rb or the Metasploit module, specifying the target container's IP address.gevaudan.rb:1-112metasploit/gluster_shared_storage.rb:1-108
  4. The exploit mounts the gluster_shared_storage volume and writes a malicious cron entry to /snaps/glusterfs_snap_cron_tasks, which will be executed as root on the target.gevaudan.rb:93-108metasploit/gluster_shared_storage.rb:88-103
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at exploiting the documented CVE-2018-1088 and CVE-2018-1112 vulnerabilities within the intended lab target. The Dockerfile sets up a vulnerable GlusterFS server, and the scripts mount a volume and write a cron entry to demonstrate privilege escalation. There is no evidence of hidden, unnecessary, or externally directed compromise, persistence, credential theft, or backdoor behavior.

Dockerfile:1-16gevaudan.rb:1-112metasploit/gluster_shared_storage.rb:1-108
Review boundaries

What the analysis did not establish

  • The Dockerfile does not include any port mappings, volume mounts, or privileged mode directives; the lab setup may require additional Docker run arguments to expose the GlusterFS ports and enable shared storage.
  • The exploit scripts assume the target has gluster_shared_storage enabled and the cron symlink present, but the Dockerfile does not configure these; manual steps may be needed to fully replicate the vulnerable state.
  • The Metasploit module references a payload (CMD) that is user-supplied; the visible code does not specify a default malicious command, but the exercise path inherently involves executing arbitrary commands as root on the target.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

2