r0binak/xzk8s

GitHubRepository PoC

PoC files

8 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2024-3094Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Dockerfile and supporting files to build a container that runs an OpenSSH server on Debian experimental, preloading a patched liblzma library to reproduce CVE-2024-3094.

Dockerfile:1-20README.md:1-72

Lab assessment

Vulnerability lab

The README explicitly states the purpose is to reproduce CVE-2024-3094, and the Dockerfile builds an environment with a vulnerable xz utils version and a patched library to demonstrate the exploit.

README.md:1-3Dockerfile:1-20
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

builds the vulnerable lab container image

Uses Debian experimental as base, installs OpenSSH server, sets root password, disables password authentication, copies a patched liblzma library, and preloads it via LD_PRELOAD before starting sshd.

Dockerfile:1-20

liblzma.so.5.6.0.patch

patched vulnerable library for exploit demonstration

A binary file copied into the container to replace the original liblzma with a version that has a swapped public key, enabling the exploit.

Dockerfile:11-15README.md:7-9

README.md

documents the lab setup and exploit steps

Explains the build process, provides a Kubernetes pod manifest, and outlines the exploit demo using xzbot and port forwarding.

README.md:1-72
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-3094

Supported by supplied evidence

The lab is explicitly designed to reproduce CVE-2024-3094, using a vulnerable Debian base image and a patched liblzma library to demonstrate the backdoor.

README.md:1-3Dockerfile:1-2
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker or Kubernetes environment to build and run the container.README.md:5-6README.md:25-37
  • The xzbot exploit tool from the referenced repository.README.md:43-45

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile.README.md:5-6
  2. Deploy the image as a Kubernetes pod (or run the container).README.md:25-37
  3. Forward port 2222 to the container's port 22.README.md:39-41
  4. Run the xzbot exploit against the forwarded port.README.md:43-45
  5. Check the exploit results inside the container.README.md:47-49
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target (the container running the vulnerable SSH server). There is no evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the intended exploit demonstration.

Dockerfile:1-20README.md:1-72
Review boundaries

What the analysis did not establish

  • The patched library (liblzma.so.5.6.0.patch) is a binary and was not inspected.
  • The Kubernetes pod manifest (pod.yaml) is referenced but not included in the evidence files.
  • The exploit tool (xzbot) is referenced but not included in the evidence files.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: 1 binary file not inspected

Linked vulnerabilities

1