CVE-2025-68670

GitHubCurated repository PoCExploitCexploitintel/eip-pocs-and-cves

PoC files

880 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a fully functional remote exploit for CVE-2025-68670, a pre-authentication stack-based buffer overflow in xrdp. It includes multiple Python scripts that implement a complete RDP handshake to deliver a malicious payload, overwrite the return address, and redirect execution to attacker-chosen addresses within the xrdp binary, achieving instruction pointer control.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of Python scripts and documentation for a CVE-2025-68670 proof-of-concept exploit targeting a stack-based buffer overflow in xrdp. The scripts implement a legitimate RDP handshake to deliver a malicious domain field, causing a crash or redirecting execution to specific addresses within the xrdp binary. No concealed backdoor, credential theft, persistence mechanism, or unrelated payload was observed. The behavior is consistent with a standard security research PoC.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwarexrdp
Attack typesStack-based Buffer OverflowRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is classified as an exploit because it contains complete, functional code that actively exploits a vulnerability to achieve a security impact beyond simple detection. The script `exploit/exploit.py` is explicitly designed to 'Redirect execution to arbitrary functions in the binary's .text section' and 'Demonstrate... Instruction Pointer Control + Code Execution Redirection'. It performs a full RDP handshake, sends a crafted payload to trigger a stack-based buffer overflow, and overwrites the return address to hijack the control flow of the xrdp process.

exploit/exploit.py:1-28exploit/exploit.py:399-410exploit/exploit.py:563-567

Requirements

  • Network access to the target xrdp service on TCP port 3389.exploit/exploit.py:9
  • The target xrdp binary must be compiled without stack canary protection (-fno-stack-protector) and without PIE (-no-pie).README.md:170

Observed behavior

  • Initiates a TCP connection to the target and performs a complete, legitimate RDP protocol handshake (X.224, MCS Connect Initial, Channel Join) to reach the vulnerable code path.exploit/exploit.py:227-288
  • Constructs a malicious domain string containing a leading underscore, padding, and a double-underscore delimiter. This string is encoded as UTF-16LE and sent within the RDP TS_INFO_PACKET.exploit/exploit.py:163-220
  • The overflow overwrites saved callee-saved registers (RBX, RBP, R12-R15) and performs a 3-byte partial overwrite of the saved return address on the stack, redirecting execution to a chosen address in the binary's .text section (e.g., printf@plt).exploit/exploit.py:11-14README.md:340-349
  • Completes the RDP handshake by sending Confirm Active, Synchronize, Control, and Font List PDUs, which triggers the vulnerable function and the subsequent crash or code redirection.exploit/exploit.py:301-345
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The exploit scripts (exploit/exploit.py, poc/crash_poc.py, poc/control_flow_probe.py) implement a complete RDP handshake to trigger a stack-based buffer overflow in xrdp's xrdp_wm_parse_domain_information() function.This is the expected behavior for a PoC targeting CVE-2025-68670. The scripts send a crafted domain field to cause a crash or redirect execution to attacker-chosen addresses within the xrdp binary.exploit/exploit.py:34-35poc/crash_poc.py:5-14poc/control_flow_probe.py:1-8
Target Addresses
The exploit targets addresses within the xrdp binary's .text section, such as 0x405050 (printf@plt), 0x405360 (g_file_delete@plt), and 0x40501a (ret gadget).These addresses are used to demonstrate instruction pointer control by redirecting execution to known functions within the vulnerable xrdp process. This is a standard technique for proving control flow hijacking.exploit/exploit.py:141-146poc/control_flow_probe.py:112-134
Bypass Attempt
The file poc/bypass_poc.py describes a potential bypass of the CVE-2025-68670 fix by exploiting a different code path (g_strncat heap overflow in xrdp_sec.c).This is a secondary PoC targeting a related but distinct vulnerability. It does not introduce backdoor behavior; it attempts to trigger a heap overflow in a patched version of the software.poc/bypass_poc.py:1-48
Review boundaries

What the analysis did not establish

  • The evidence packet reports 23 binary files that were not analyzed, including compiled executables and core dumps. The analysis is based solely on the provided readable text files.
  • The analysis scope indicates 'complete_artifact_coverage: false', meaning not all files in the artifact were inspected.
  • 23 binary files were present in the artifact but were not analyzed per the evidence envelope's binary policy. Their contents could not be inspected for backdoor behavior.
  • The review is limited to the supplied text evidence; any behavior triggered only at runtime under specific conditions not described in the scripts would not be detected.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

8
GitHub

CVE-2025-68670/vuln-lab/docker-compose.yml

Created Vuln labCVE-2025-68670Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds and runs a vulnerable xrdp 0.10.4 server in a privileged container for CVE-2025-68670 research. The container disables ASLR, enables core dumps, and exposes port 3389. The README documents a pre-authentication stack buffer overflow exploit with IP control and gadget execution.

CVE-2025-68670/vuln-lab/docker-compose.yml:1-21CVE-2025-68670/vuln-lab/Dockerfile.vulnerable:1-44CVE-2025-68670/vuln-lab/entrypoint.sh:1-19CVE-2025-68670/README.md:1-784

Lab assessment

Vulnerability lab

The environment is explicitly designed to reproduce and exploit CVE-2025-68670. The Dockerfile builds a vulnerable xrdp 0.10.4 with no stack canary, no PIE, and ASLR disabled. The entrypoint script disables ASLR and starts the vulnerable service. The README provides a detailed exploit report including crash PoC, IP control, and gadget execution.

CVE-2025-68670/vuln-lab/Dockerfile.vulnerable:1-44CVE-2025-68670/vuln-lab/entrypoint.sh:1-19CVE-2025-68670/README.md:1-784
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

vulnerable

vulnerable xrdp 0.10.4 serverexploit target

A privileged container built from Dockerfile.vulnerable that runs xrdp 0.10.4 with ASLR disabled, no stack canary, and no PIE. It listens on TCP/3389 and is the target for the CVE-2025-68670 pre-authentication stack buffer overflow exploit.

CVE-2025-68670/vuln-lab/docker-compose.yml:2-12CVE-2025-68670/vuln-lab/Dockerfile.vulnerable:1-44CVE-2025-68670/vuln-lab/entrypoint.sh:1-19
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-68670

Supported by supplied evidence

The lab environment is explicitly built to demonstrate CVE-2025-68670. The Dockerfile compiles xrdp 0.10.4 with -fno-stack-protector and -no-pie, and the entrypoint disables ASLR. The README provides a detailed root cause analysis, crash PoC, and verified IP control and gadget execution, all consistent with the described pre-authentication stack buffer overflow in xrdp_wm_parse_domain_information().

CVE-2025-68670/vuln-lab/Dockerfile.vulnerable:1-44CVE-2025-68670/vuln-lab/entrypoint.sh:1-19CVE-2025-68670/README.md:1-784
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • The container must run in privileged mode to disable ASLR via /proc/sys/kernel/randomize_va_space.CVE-2025-68670/vuln-lab/docker-compose.yml:6CVE-2025-68670/vuln-lab/entrypoint.sh:5
  • The xrdp binary must be built with -fno-stack-protector and -no-pie (as described in the README) to allow direct RIP overwrite and deterministic gadget addresses.CVE-2025-68670/README.md:1-784
  • The attacker must be able to reach TCP port 3389 on the container.CVE-2025-68670/vuln-lab/Dockerfile.vulnerable:42

Evidence-described exercise path

  1. Build and start the vulnerable container using docker-compose.yml.CVE-2025-68670/vuln-lab/docker-compose.yml:1-21
  2. Run the exploit script (e.g., exploit.py) against the container's IP on port 3389 to trigger the overflow and achieve IP control or DoS.CVE-2025-68670/README.md:1-784
  3. Verify the crash or gadget execution via GDB or core dumps as described in the README.CVE-2025-68670/README.md:1-784
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. The privileged mode and ASLR disable are necessary for the exploit exercise. The entrypoint script only starts the vulnerable xrdp service; it does not download payloads, connect to external systems, or perform any destructive actions. The exploit behavior targets only the lab's own xrdp process.

CVE-2025-68670/vuln-lab/entrypoint.sh:1-19CVE-2025-68670/vuln-lab/Dockerfile.vulnerable:1-44CVE-2025-68670/README.md:1-784
Review boundaries

What the analysis did not establish

  • The pre-built xrdp binary (xrdp-install) is not inspected; its exact compilation flags and behavior are assumed from the README.
  • The exploit scripts referenced in the README are not included in the evidence packet.
  • The Docker Compose file references an external network 'stackforge_default' which is not defined in the packet.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

CVE-2025-68670/vuln-lab/docker-compose.patched.yml

Created Vuln labCVE-2025-68670Compose · builds

1 Compose manifest · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker-based vulnerability research lab for CVE-2025-68670, a pre-authentication stack buffer overflow in xrdp < 0.10.5. The lab runs a patched xrdp service in a privileged container, with exploit scripts and reports demonstrating denial of service and instruction pointer control.

CVE-2025-68670/vuln-lab/docker-compose.patched.yml:1-21CVE-2025-68670/README.md:1-50

Lab assessment

Vulnerability lab

The packet contains a Docker Compose file defining a service named 'patched' for CVE-2025-68670, along with multiple exploit scripts (e.g., exploit.py, crash_poc.py) and detailed reports describing vulnerability analysis, exploitation methodology, and validation results. This is clearly a vulnerability research and reproduction environment.

CVE-2025-68670/vuln-lab/docker-compose.patched.yml:1-21CVE-2025-68670/README.md:1-50CVE-2025-68670/exploit/exploit.py:1-30
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

patched service

vulnerable targetxrdp server

A Docker service built from a patched Dockerfile, running xrdp with privileged mode. It exposes no ports explicitly but has a healthcheck verifying that xrdp listens on port 3389. It connects to two networks: lab-net and an external stackforge_default.

CVE-2025-68670/vuln-lab/docker-compose.patched.yml:1-21

exploit scripts

exploit deliveryproof-of-concept

Multiple Python scripts (exploit.py, crash_poc.py, bypass_poc.py, etc.) that implement the RDP protocol handshake and send a malicious domain field to trigger the stack buffer overflow in xrdp. They demonstrate denial of service and instruction pointer control.

CVE-2025-68670/exploit/exploit.py:1-30CVE-2025-68670/poc/crash_poc.py:1-30

reports

documentationvulnerability analysis

Markdown reports detailing the vulnerability root cause, environment setup, exploit development, and validation results. They confirm the lab's purpose and the achieved exploitation primitives.

CVE-2025-68670/README.md:1-50CVE-2025-68670/reports/exploit_development_report.md:1-30
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-68670

Supported by supplied evidence

The entire packet is dedicated to CVE-2025-68670. The README, exploit scripts, and reports consistently describe a stack-based buffer overflow in xrdp's domain parsing function, matching the CVE description. The exploit code and validation reports provide concrete evidence of successful denial of service and instruction pointer control.

CVE-2025-68670/README.md:1-50CVE-2025-68670/exploit/exploit.py:1-30CVE-2025-68670/poc_verification_report.md:1-30
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • A running instance of the patched xrdp service, reachable over TCP/3389.CVE-2025-68670/vuln-lab/docker-compose.patched.yml:1-21
  • The xrdp binary must be compiled without stack canaries and PIE, with ASLR disabled (as configured in the lab).CVE-2025-68670/README.md:100-120
  • Python 3.6+ with no external dependencies to run the exploit scripts.CVE-2025-68670/exploit/exploit.py:1-10

Evidence-described exercise path

  1. Start the vulnerable xrdp service using the provided Docker Compose file.CVE-2025-68670/vuln-lab/docker-compose.patched.yml:1-21
  2. Run the exploit script (e.g., exploit.py) against the target IP and port 3389 to trigger the overflow.CVE-2025-68670/exploit/exploit.py:1-30
  3. Observe the crash of the xrdp child process (DoS) or verify instruction pointer control via GDB or core dumps.CVE-2025-68670/poc_verification_report.md:1-30
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own xrdp target. The exploit scripts connect to the lab container over TCP/3389 to trigger the documented vulnerability. There is no evidence of host escape, external connections, credential theft, persistence, or destructive actions beyond crashing the xrdp child process, which is expected in a vulnerability lab. The privileged mode and network configuration are consistent with lab requirements for ASLR control and network access.

CVE-2025-68670/exploit/exploit.py:1-621CVE-2025-68670/vuln-lab/docker-compose.patched.yml:1-21
Review boundaries

What the analysis did not establish

  • The Dockerfile referenced in the Compose file (lab/Dockerfile.patched) is not included in the evidence packet, so the exact build steps and any additional tools or configurations inside the container are unknown.
  • Several files are marked as BINARY (e.g., UTF-8-test.txt) and were not inspected; their content could not be assessed.
  • The packet does not include the actual xrdp binary or core dump files, so the crash and register state evidence relies solely on the provided text reports and GDB output excerpts.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted · 1 binary file not inspected

GitHub

CVE-2025-68670/docker-compose.yml

Created Vuln labCVE-2025-68670Compose · mixed

1 Compose manifest · 1 Dockerfile · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds and runs a single container named 'CVE-2025-68670-xrdp' based on Ubuntu 22.04. The container runs a pre-built xrdp 0.10.4 RDP server with ASLR disabled, exposed on host port 13389, and includes debugging tools (gdb, strace). The environment is explicitly labeled for CVE-2025-68670 vulnerability research.

CVE-2025-68670/docker-compose.yml:1-27CVE-2025-68670/Dockerfile.vulnerable:1-44CVE-2025-68670/entrypoint.sh:1-19

Lab assessment

Vulnerability lab

The environment is explicitly named and configured for CVE-2025-68670. It disables ASLR, enables core dumps, installs debugging tools, and runs a specific vulnerable version of xrdp (0.10.4). The Dockerfile comments and entrypoint script messages confirm the vulnerability research purpose.

CVE-2025-68670/docker-compose.yml:3CVE-2025-68670/Dockerfile.vulnerable:1-44CVE-2025-68670/entrypoint.sh:14
Lab shapeCompose · mixed
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

vulnerable (xrdp server)

vulnerable targetRDP server

A container running xrdp 0.10.4 with ASLR disabled, exposed on host port 13389. It is built from a pre-compiled xrdp installation and configured with 'rdp' security layer, no encryption, and debug logging to facilitate exploitation.

CVE-2025-68670/docker-compose.yml:2-20CVE-2025-68670/Dockerfile.vulnerable:1-44CVE-2025-68670/entrypoint.sh:1-19

entrypoint.sh

startup scriptASLR disabler

A shell script that disables ASLR, enables core dumps, creates runtime directories, and starts xrdp in the foreground. It prints a banner identifying the CVE and the listening port.

CVE-2025-68670/entrypoint.sh:1-19

xrdp-install (pre-built binaries and configs)

vulnerable applicationRDP server binariesconfiguration files

A directory containing pre-built xrdp 0.10.4 binaries (sbin/xrdp, sbin/xrdp-chansrv, sbin/xrdp-sesman), libraries, headers, and configuration files. The main xrdp binary is uninspected due to size. The configuration is modified for lab use (rdp security, no encryption, debug logging).

CVE-2025-68670/Dockerfile.vulnerable:18CVE-2025-68670/Dockerfile.vulnerable:28-30
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-68670

Supported by supplied evidence

The environment is explicitly built and configured to demonstrate CVE-2025-68670. The Dockerfile, entrypoint script, and container name all reference this CVE. The lab includes a vulnerable xrdp 0.10.4 server with ASLR disabled and debugging tools, consistent with a vulnerability reproduction environment.

CVE-2025-68670/docker-compose.yml:3CVE-2025-68670/entrypoint.sh:14CVE-2025-68670/Dockerfile.vulnerable:1-44
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.CVE-2025-68670/docker-compose.yml:1-27
  • The pre-built xrdp installation directory 'xrdp-install' must be present in the build context.CVE-2025-68670/Dockerfile.vulnerable:18
  • The container requires privileged mode and SYS_PTRACE capability to disable ASLR and enable debugging.CVE-2025-68670/docker-compose.yml:6-8

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile and Compose file.CVE-2025-68670/docker-compose.yml:4-5
  2. Start the container with 'docker compose up', which runs the entrypoint script to disable ASLR and launch xrdp on port 3389 (mapped to host port 13389).CVE-2025-68670/docker-compose.yml:12-13CVE-2025-68670/entrypoint.sh:1-19
  3. Connect to the xrdp service on host port 13389 using an RDP client or exploit script to trigger the vulnerability.CVE-2025-68670/docker-compose.yml:12-13
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. It runs a single service (xrdp) inside a container, with no evidence of hidden persistence, credential theft, data destruction, or connections to external systems. The privileged mode and SYS_PTRACE capability are necessary for the lab's purpose (disabling ASLR, debugging). The port mapping (13389:3389) is a standard lab requirement for accessing the vulnerable service.

CVE-2025-68670/docker-compose.yml:1-27CVE-2025-68670/Dockerfile.vulnerable:1-44CVE-2025-68670/entrypoint.sh:1-19
Review boundaries

What the analysis did not establish

  • The main xrdp binary (sbin/xrdp) and xrdp-chansrv are uninspected due to size; their behavior cannot be fully verified.
  • Several other binaries in xrdp-install/bin are marked BINARY and uninspected.
  • The exploit scripts and PoC files in the repository are not included in the evidence packet, so the exact exploitation method is not described.
  • The packet does not include a README or documentation for the lab, only structural files.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted · 7 binary files not inspected

GitHub

CVE-2025-68670/lab-patched/docker-compose.yml

Created Vuln labCVE-2025-68670Compose · builds

1 Compose manifest · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for a patched xrdp 0.10.5 instance, intended as a vulnerability research lab for CVE-2025-68670. It builds a service named 'patched' from an external build context, runs it in privileged mode, and connects it to two networks.

CVE-2025-68670/lab-patched/docker-compose.yml:1-21

Lab assessment

Vulnerability lab

The unit is explicitly named after CVE-2025-68670 and the README describes it as a lab for a pre-authentication stack buffer overflow in xrdp. The Compose file defines a service named 'patched' that builds a patched version of xrdp, consistent with a vulnerability research environment.

CVE-2025-68670/README.md:1-3CVE-2025-68670/lab-patched/docker-compose.yml:1-3
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

patched

vulnerability research targetxrdp server

A Docker service built from an external context targeting a patched xrdp 0.10.5. It runs in privileged mode, listens on port 3389 (implied by healthcheck), and is connected to lab-net and an external stackforge_default network.

CVE-2025-68670/lab-patched/docker-compose.yml:2-15

lab-net

isolated lab network

A bridge network defined for the lab environment.

CVE-2025-68670/lab-patched/docker-compose.yml:17-18

stackforge_default

external network

An external network referenced by the service, presumably pre-existing.

CVE-2025-68670/lab-patched/docker-compose.yml:19-20
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-68670

Supported by supplied evidence

The README explicitly states the lab is for CVE-2025-68670, describing the vulnerability in xrdp and providing a patched version. The Compose file builds a 'patched' service, aligning with the CVE's remediation context.

CVE-2025-68670/README.md:1-3CVE-2025-68670/lab-patched/docker-compose.yml:2-3
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • The build context /targets/CVE-2025-68670 must exist on the Docker host and contain the patched xrdp source and Dockerfile.CVE-2025-68670/lab-patched/docker-compose.yml:4-5
  • The external network 'stackforge_default' must already exist.CVE-2025-68670/lab-patched/docker-compose.yml:19-20
  • The container must run in privileged mode to disable ASLR via /proc/sys/kernel/randomize_va_space.CVE-2025-68670/lab-patched/docker-compose.yml:7CVE-2025-68670/lab-patched/entrypoint-patched.sh:5

Evidence-described exercise path

  1. Build and start the patched xrdp service using the provided Docker Compose file.CVE-2025-68670/lab-patched/docker-compose.yml:1-21
  2. Verify the service is healthy and listening on port 3389.CVE-2025-68670/lab-patched/docker-compose.yml:8-11
  3. Run the exploit script against the target to test the patched version's resistance to CVE-2025-68670.CVE-2025-68670/README.md:700-710
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a vulnerability research lab targeting a patched xrdp instance. The privileged mode and ASLR disablement are documented requirements for the lab. No evidence of hidden, unnecessary, or externally directed compromise is present.

CVE-2025-68670/lab-patched/docker-compose.yml:7CVE-2025-68670/lab-patched/entrypoint-patched.sh:5CVE-2025-68670/README.md:1-3
Review boundaries

What the analysis did not establish

  • The Dockerfile and build context are external and not included in the evidence packet, so the exact build steps and final image contents are unknown.
  • The exploit scripts referenced in the README are not included in the evidence packet.
  • The external network 'stackforge_default' is not defined in the provided files, so its purpose and connectivity are unknown.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

CVE-2025-68670/lab-patched/docker-compose-asan.yml

Created Vuln labCVE-2025-68670Compose · builds

1 Compose manifest · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for a patched xrdp 0.10.5 server with AddressSanitizer (ASAN) instrumentation, intended for vulnerability research on CVE-2025-68670.

CVE-2025-68670/lab-patched/docker-compose-asan.yml:1-21CVE-2025-68670/lab-patched/entrypoint-asan.sh:1-16CVE-2025-68670/README.md:1-784

Lab assessment

Vulnerability lab

The README explicitly describes CVE-2025-68670 as a critical pre-authentication stack buffer overflow in xrdp, provides root cause analysis, exploit methodology, and validation results. The Compose file builds a patched xrdp 0.10.5 with ASAN instrumentation, and the entrypoint script disables ASLR and configures ASAN logging, all consistent with a vulnerability research lab.

CVE-2025-68670/README.md:1-10CVE-2025-68670/lab-patched/docker-compose-asan.yml:1-21CVE-2025-68670/lab-patched/entrypoint-asan.sh:1-16
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

asan

vulnerability targetpatched xrdp server with ASAN instrumentation

A service built from a Dockerfile that installs xrdp 0.10.5 with ASAN instrumentation. It runs with privileged mode, disables ASLR, and listens on port 3389 for RDP connections. The healthcheck verifies the RDP port is open.

CVE-2025-68670/lab-patched/docker-compose-asan.yml:2-12CVE-2025-68670/lab-patched/entrypoint-asan.sh:1-16

lab-net

isolated bridge network

A user-defined bridge network for the lab environment.

CVE-2025-68670/lab-patched/docker-compose-asan.yml:17-18

stackforge_default

external network

An external network, presumably connecting to a broader lab infrastructure.

CVE-2025-68670/lab-patched/docker-compose-asan.yml:19-20
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-68670

Supported by supplied evidence

The README provides a detailed root cause analysis, crash PoC, control flow analysis, and exploitation methodology for CVE-2025-68670. The lab environment is explicitly named after the CVE and configured to test the vulnerability.

CVE-2025-68670/README.md:1-10CVE-2025-68670/README.md:50-100
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • The Docker build context must be available at /targets/CVE-2025-68670 on the host.CVE-2025-68670/lab-patched/docker-compose-asan.yml:4-5
  • The external network 'stackforge_default' must exist.CVE-2025-68670/lab-patched/docker-compose-asan.yml:19-20
  • The container must run in privileged mode to disable ASLR.CVE-2025-68670/lab-patched/docker-compose-asan.yml:7CVE-2025-68670/lab-patched/entrypoint-asan.sh:4

Evidence-described exercise path

  1. Build and start the patched xrdp ASAN container using Docker Compose.CVE-2025-68670/lab-patched/docker-compose-asan.yml:1-21
  2. Run the exploit script against the target IP and port 3389 to trigger the buffer overflow and observe ASAN reports or crashes.CVE-2025-68670/README.md:700-710
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability research lab. The privileged mode and ASLR disablement are necessary for the lab's purpose. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior beyond the intended target is present.

CVE-2025-68670/lab-patched/docker-compose-asan.yml:1-21CVE-2025-68670/lab-patched/entrypoint-asan.sh:1-16
Review boundaries

What the analysis did not establish

  • The Dockerfile is not included in the evidence, so the exact build steps and any additional software installed are unknown.
  • The external network 'stackforge_default' is not defined in the provided Compose file, and its purpose and security implications are unclear.
  • The exploit scripts referenced in the README are not included in the evidence packet.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

CVE-2025-68670/lab-patched

Created Vuln labCVE-2025-68670Standalone Multiple Dockerfiles

2 Dockerfiles

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

Two Dockerfiles and entrypoint scripts for a vulnerability research lab targeting CVE-2025-68670 in xrdp. One Dockerfile builds a patched xrdp v0.10.5 with AddressSanitizer, the other builds a patched version without hardening for comparison. Both expose port 3389 and disable ASLR at runtime.

CVE-2025-68670/lab-patched/Dockerfile.asan:1-52CVE-2025-68670/lab-patched/Dockerfile.patched:1-54CVE-2025-68670/lab-patched/entrypoint-asan.sh:1-16CVE-2025-68670/lab-patched/entrypoint-patched.sh:1-19

Lab assessment

Vulnerability lab

The README explicitly describes a vulnerability research report for CVE-2025-68670, and the Dockerfiles build xrdp with specific configurations (disabled ASLR, no stack protector, debug symbols) to facilitate exploit development and testing. The entrypoint scripts disable ASLR and start xrdp for analysis.

CVE-2025-68670/README.md:1-10CVE-2025-68670/lab-patched/Dockerfile.asan:1-52CVE-2025-68670/lab-patched/Dockerfile.patched:1-54
Lab shapeStandalone Multiple Dockerfiles
ServicesUnknown
Compose manifests0
Dockerfiles2
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

xrdp server (patched, ASAN)

vulnerability targetRDP server

xrdp v0.10.5 built with AddressSanitizer and debug flags, configured to listen on port 3389 with security_layer=rdp, crypt_level=none, and domain_user_separator=@. ASLR is disabled at runtime.

CVE-2025-68670/lab-patched/Dockerfile.asan:1-52CVE-2025-68670/lab-patched/entrypoint-asan.sh:1-16

xrdp server (patched, no hardening)

vulnerability targetRDP server

xrdp v0.10.5 built without hardening flags (no stack protector, no PIE, no FORTIFY) for comparison with the vulnerable version. Configured identically to the ASAN build and also disables ASLR at runtime.

CVE-2025-68670/lab-patched/Dockerfile.patched:1-54CVE-2025-68670/lab-patched/entrypoint-patched.sh:1-19

entrypoint-asan.sh

runtime configurationASLR disabler

Disables ASLR, enables core dumps, sets ASAN options, and starts xrdp in the foreground.

CVE-2025-68670/lab-patched/entrypoint-asan.sh:1-16

entrypoint-patched.sh

runtime configurationASLR disabler

Disables ASLR, enables core dumps, and starts xrdp in the foreground.

CVE-2025-68670/lab-patched/entrypoint-patched.sh:1-19
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-68670

Supported by supplied evidence

The README provides a detailed root cause analysis, crash PoC, and exploitation methodology for CVE-2025-68670 in xrdp. The Dockerfiles build xrdp v0.10.5 (the patched version) and configure it for vulnerability research, consistent with the CVE description.

CVE-2025-68670/README.md:1-784CVE-2025-68670/lab-patched/Dockerfile.asan:1-52CVE-2025-68670/lab-patched/Dockerfile.patched:1-54
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker build context must include the 'src' directory containing xrdp source code.CVE-2025-68670/lab-patched/Dockerfile.asan:17-18CVE-2025-68670/lab-patched/Dockerfile.patched:17-18
  • Container must run with sufficient privileges to disable ASLR (e.g., --privileged or CAP_SYS_ADMIN).CVE-2025-68670/lab-patched/entrypoint-asan.sh:4CVE-2025-68670/lab-patched/entrypoint-patched.sh:5
  • An RDP client or exploit script capable of sending crafted TS_INFO_PACKET with a malicious domain field.CVE-2025-68670/README.md:100-120

Evidence-described exercise path

  1. Build the Docker image using one of the provided Dockerfiles (e.g., Dockerfile.asan or Dockerfile.patched).CVE-2025-68670/lab-patched/Dockerfile.asan:1-52
  2. Run the container with appropriate privileges and port mapping (e.g., -p 3389:3389 --privileged).CVE-2025-68670/lab-patched/entrypoint-asan.sh:4
  3. Connect to the xrdp service on port 3389 using an RDP client or exploit script that sends a crafted domain field to trigger the buffer overflow.CVE-2025-68670/README.md:100-120
  4. Observe the crash or controlled execution via AddressSanitizer output, core dumps, or GDB.CVE-2025-68670/README.md:200-250
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfiles and entrypoint scripts only build and run xrdp within the container. There is no evidence of hidden payloads, external connections, host compromise, or destructive behavior. Disabling ASLR and using debug flags are expected for a vulnerability lab.

CVE-2025-68670/lab-patched/Dockerfile.asan:1-52CVE-2025-68670/lab-patched/Dockerfile.patched:1-54CVE-2025-68670/lab-patched/entrypoint-asan.sh:1-16CVE-2025-68670/lab-patched/entrypoint-patched.sh:1-19
Review boundaries

What the analysis did not establish

  • The 'src' directory referenced in COPY instructions is not included in the evidence packet, so the exact xrdp source code and any modifications cannot be verified.
  • The docker-compose files (docker-compose-asan.yml, docker-compose.yml) are listed in the file inventory but their content is not provided, so runtime configuration details like port mappings and privileges are unknown.
  • The README describes exploit scripts and binaries (e.g., exploit.py) that are not part of this lab unit's evidence, so their behavior cannot be assessed.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

CVE-2025-68670/vuln-lab

Created Vuln labCVE-2025-68670Standalone Multiple Dockerfiles

3 Dockerfiles

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A containerized vulnerability-research lab for CVE-2025-68670, a pre-authentication stack buffer overflow in xrdp v0.10.4. The lab provides three Dockerfiles: one building the vulnerable version, one building a patched version, and one building a patched version with AddressSanitizer. Each Dockerfile compiles xrdp from source with debugging symbols and disabled hardening to facilitate exploit development. Entrypoint scripts disable ASLR, enable core dumps, and start the xrdp daemon on port 3389.

CVE-2025-68670/README.md:1-784CVE-2025-68670/vuln-lab/Dockerfile:1-35CVE-2025-68670/vuln-lab/Dockerfile.patched:1-50CVE-2025-68670/vuln-lab/Dockerfile.patched-asan:1-51CVE-2025-68670/vuln-lab/entrypoint.sh:1-19CVE-2025-68670/vuln-lab/entrypoint-patched.sh:1-20CVE-2025-68670/vuln-lab/entrypoint-asan.sh:1-24

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a lab for CVE-2025-68670 exploit development. The Dockerfiles build xrdp with debugging symbols, disabled stack protector, no PIE, and disabled FORTIFY_SOURCE, and the entrypoint scripts disable ASLR and enable core dumps—all configurations tailored for vulnerability research and exploit testing.

CVE-2025-68670/README.md:1-784CVE-2025-68670/vuln-lab/Dockerfile:1-35CVE-2025-68670/vuln-lab/entrypoint.sh:1-19
Lab shapeStandalone Multiple Dockerfiles
ServicesUnknown
Compose manifests0
Dockerfiles3
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Vulnerable xrdp container (Dockerfile)

vulnerable targetexploit development environment

Builds xrdp v0.10.4 from source with debugging symbols, no stack protector, no PIE, and no FORTIFY_SOURCE. The resulting binary is intended to be run with ASLR disabled and core dumps enabled, as configured by entrypoint.sh. The container exposes port 3389 for RDP connections.

CVE-2025-68670/vuln-lab/Dockerfile:1-35CVE-2025-68670/vuln-lab/entrypoint.sh:1-19

Patched xrdp container (Dockerfile.patched)

patched targetcontrol environment

Builds xrdp from a fix merge commit (488c8c7d4d189514a366cd8301b6e816c5218ffa) with the same disabled hardening flags as the vulnerable build. Configures xrdp for lab use (security_layer=rdp, crypt_level=none, LogLevel=DEBUG) and starts via entrypoint-patched.sh, which also disables ASLR and enables core dumps.

CVE-2025-68670/vuln-lab/Dockerfile.patched:1-50CVE-2025-68670/vuln-lab/entrypoint-patched.sh:1-20

Patched+ASAN xrdp container (Dockerfile.patched-asan)

patched target with sanitizerheap overflow detection

Builds the patched xrdp with AddressSanitizer enabled (-fsanitize=address) to detect heap overflows. Configures xrdp similarly to the patched container but also enables domain_user_separator=@. The entrypoint-asan.sh script disables ASLR, enables core dumps, sets ASAN_OPTIONS, and starts xrdp.

CVE-2025-68670/vuln-lab/Dockerfile.patched-asan:1-51CVE-2025-68670/vuln-lab/entrypoint-asan.sh:1-24
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-68670

Supported by supplied evidence

The README provides a detailed root cause analysis of a stack buffer overflow in xrdp_wm_parse_domain_information() in xrdp v0.10.4, matching the CVE description. The Dockerfile builds the vulnerable version, and the entrypoint script explicitly labels the container as 'CVE-2025-68670 vulnerable'. The patched Dockerfiles reference the fix commit and apply the patch.

CVE-2025-68670/README.md:1-784CVE-2025-68670/vuln-lab/Dockerfile:1-35CVE-2025-68670/vuln-lab/entrypoint.sh:14CVE-2025-68670/vuln-lab/Dockerfile.patched:22
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the containers.CVE-2025-68670/vuln-lab/Dockerfile:1
  • The host must allow disabling ASLR (echo 0 > /proc/sys/kernel/randomize_va_space), which typically requires --privileged or specific capabilities.CVE-2025-68670/vuln-lab/entrypoint.sh:5
  • The xrdp source code must be present in a 'src' directory relative to the Dockerfile build context.CVE-2025-68670/vuln-lab/Dockerfile:17
  • An RDP client or exploit script is needed to trigger the vulnerability over TCP port 3389.CVE-2025-68670/README.md:1-784

Evidence-described exercise path

  1. Build the vulnerable Docker image using the provided Dockerfile.CVE-2025-68670/vuln-lab/Dockerfile:1-35
  2. Run the container with appropriate privileges to disable ASLR and expose port 3389.CVE-2025-68670/vuln-lab/entrypoint.sh:5
  3. Connect to the xrdp service on port 3389 using an RDP client or exploit script that sends a crafted TS_INFO_PACKET with a malicious domain field.CVE-2025-68670/README.md:1-784
  4. Observe the crash (DoS) or verify instruction pointer control via GDB or core dumps.CVE-2025-68670/README.md:1-784
  5. Optionally, build and run the patched or ASAN containers to compare behavior or verify the fix.CVE-2025-68670/vuln-lab/Dockerfile.patched:1-50CVE-2025-68670/vuln-lab/Dockerfile.patched-asan:1-51
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the contained lab target (xrdp). The Dockerfiles build xrdp from source and start it on port 3389. The entrypoint scripts disable ASLR and enable core dumps, which are standard configurations for exploit development. There is no evidence of host escape, external connections, credential theft, persistence, or destructive behavior beyond the intended vulnerability demonstration.

CVE-2025-68670/vuln-lab/Dockerfile:1-35CVE-2025-68670/vuln-lab/entrypoint.sh:1-19CVE-2025-68670/vuln-lab/Dockerfile.patched:1-50CVE-2025-68670/vuln-lab/Dockerfile.patched-asan:1-51
Review boundaries

What the analysis did not establish

  • The packet does not include the xrdp source code (src directory) or the exploit scripts referenced in the README.
  • The Docker Compose files listed in the file inventory are not included in the evidence files, so their contents cannot be analyzed.
  • The README describes exploit behavior (DoS, IP control) but the actual exploit payloads are not provided in the packet.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

CVE-2025-68670/vuln-lab/docker-compose.patched-asan.yml

Created Vuln labCVE-2025-68670Compose · builds

1 Compose manifest · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for a patched xrdp v0.10.5 instance with AddressSanitizer (ASAN) enabled, intended for vulnerability research on CVE-2025-68670. The service 'patched-asan' is built from a Dockerfile (not included in evidence) and runs in privileged mode with a healthcheck on port 3389.

CVE-2025-68670/vuln-lab/docker-compose.patched-asan.yml:1-21

Lab assessment

Vulnerability lab

The environment is explicitly named and structured for CVE-2025-68670 research. The README and multiple reports detail a vulnerability lab setup, exploit development, and validation for a stack-based buffer overflow in xrdp. The Compose file defines a service with a patched-asan build, consistent with a lab for testing a fix.

CVE-2025-68670/README.md:1-10CVE-2025-68670/vuln-lab/docker-compose.patched-asan.yml:1-5
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

patched-asan service

vulnerable target (patched xrdp with ASAN)

A Docker service built from a Dockerfile (not provided) that runs a patched version of xrdp with AddressSanitizer. It is configured with privileged mode, a healthcheck on port 3389, and connects to two networks: lab-net and stackforge_default.

CVE-2025-68670/vuln-lab/docker-compose.patched-asan.yml:2-12

exploit scripts

exploit deliveryproof-of-concept

Multiple Python scripts (exploit.py, crash_poc.py, bypass_poc.py, etc.) that implement the RDP handshake and send malicious payloads to trigger the CVE-2025-68670 overflow. They target the xrdp service on TCP/3389 and include modes for DoS, IP control, and code execution redirection.

CVE-2025-68670/exploit/exploit.py:1-30CVE-2025-68670/poc/crash_poc.py:1-30

documentation and reports

vulnerability analysisexploit development documentation

Markdown reports (README.md, poc_verification_report.md, exploit_development_report.md, etc.) that describe the vulnerability, lab setup, exploit methodology, and validation results. They provide context for the CVE and the lab's purpose.

CVE-2025-68670/README.md:1-50CVE-2025-68670/poc_verification_report.md:1-20
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-68670

Supported by supplied evidence

The evidence consistently describes a stack-based buffer overflow in xrdp's domain parsing function, matching the CVE. Exploit scripts and reports demonstrate triggering the overflow, achieving instruction pointer control, and validating the vulnerability in a lab environment.

CVE-2025-68670/README.md:1-10CVE-2025-68670/exploit/exploit.py:1-10
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Network access to the target xrdp service on TCP/3389.CVE-2025-68670/exploit/exploit.py:30-32
  • xrdp version < 0.10.5 compiled without stack canary and PIE (for the original vulnerability; the patched-asan service is a fixed version).CVE-2025-68670/README.md:50-60
  • Python 3.6+ to run the exploit scripts.CVE-2025-68670/poc/crash_poc.py:25-27

Evidence-described exercise path

  1. Run the exploit script against the target IP and port, e.g., 'python3 exploit.py 172.18.0.5 3389 --mode crash'.CVE-2025-68670/exploit/exploit.py:30-32
  2. The script performs a full RDP handshake (X.224, MCS, channel join) and sends a malicious TS_INFO_PACKET with an oversized domain field.CVE-2025-68670/exploit/exploit.py:200-250
  3. The overflow occurs in xrdp_wm_parse_domain_information(), corrupting the stack and potentially redirecting execution.CVE-2025-68670/README.md:100-120
  4. Observe the crash or redirected execution (e.g., via GDB or connection drop) to confirm the vulnerability.CVE-2025-68670/exploit/exploit.py:400-420
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior targets the lab's own xrdp service. The exploit scripts connect to the lab container's RDP port to trigger the overflow, which is expected for a vulnerability lab. There is no evidence of host escape, external connections, persistence, credential theft, or destructive actions outside the lab target.

CVE-2025-68670/exploit/exploit.py:1-621CVE-2025-68670/poc/crash_poc.py:1-394
Review boundaries

What the analysis did not establish

  • The Dockerfile referenced by the Compose file (lab/Dockerfile.patched-asan) is not included in the evidence, so the exact build and runtime configuration of the patched-asan service cannot be verified.
  • The Compose file uses 'privileged: true', which is a legitimate lab requirement for ASLR control but could be risky in other contexts; without the Dockerfile, the full impact cannot be assessed.
  • Multiple binary files (e.g., UTF-8-test.txt) are flagged as BINARY and not inspected, but they are test data and not executable.
  • The evidence packet includes many source files from the xrdp repository that are not directly part of the lab environment; their presence does not affect the safety assessment.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted · 1 binary file not inspected

Linked vulnerabilities

5