mephi42/CVE-2016-8863

GitHubRepository PoC

PoC files

491 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

i386-xenial/image

Created Vuln labCVE-2016-8863Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A multi-stage Docker build that compiles libupnp 1.6.18 in an i386/ubuntu:xenial stage, then creates an ubuntu:focal analysis container with debugging tools (gdb, gdbserver, pwntools, gef) and copies the i386 root filesystem into it.

i386-xenial/image/Dockerfile:1-47

Lab assessment

Vulnerability lab

The README explicitly links the environment to CVE-2016-8863, a known vulnerability in libupnp, and the Dockerfile builds the vulnerable release-1.6.18 of pupnp alongside exploit-development tools (pwntools, gef).

README.md:1-10i386-xenial/image/Dockerfile:1-47
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

i386-xenial build stage

vulnerable target compilation

Builds libupnp 1.6.18 from source on i386/ubuntu:xenial with debug flags (-g -O0) and downloads glibc source for debugging.

i386-xenial/image/Dockerfile:1-24

ubuntu:focal analysis stage

exploit development environment

Installs gdb, gdbserver, pwntools, and gef; copies the i386 root filesystem from the build stage; creates a debug symlink for glibc.

i386-xenial/image/Dockerfile:26-47
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2016-8863

Supported by supplied evidence

The README states the target is pupnp release-1.6.18 and references the fix commit for CVE-2016-8863. The Dockerfile builds that exact release and includes exploit-development tooling.

README.md:1-10i386-xenial/image/Dockerfile:17-19
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker build environment capable of multi-stage builds and pulling i386/ubuntu:xenial and ubuntu:focal base images.i386-xenial/image/Dockerfile:1-2
  • Network access during build to download apt packages, pupnp source, pwntools, and gef.i386-xenial/image/Dockerfile:5-14i386-xenial/image/Dockerfile:17-19i386-xenial/image/Dockerfile:37-38

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile.i386-xenial/image/Dockerfile:1-47
  2. Run a container from the built image to obtain a shell with gdb, pwntools, and the vulnerable libupnp binaries available under /i386-xenial.i386-xenial/image/Dockerfile:26-47
  3. Use the included debugging tools to analyze or exploit the out-of-bound access vulnerability (CVE-2016-8863) in the compiled libupnp.README.md:1-10
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile only builds a vulnerable library and installs standard debugging tools. No RUN, CMD, or ENTRYPOINT executes any exploit or connects to external systems at runtime. The environment is self-contained for vulnerability research.

i386-xenial/image/Dockerfile:1-47
Review boundaries

What the analysis did not establish

  • No runtime CMD/ENTRYPOINT is defined; the intended exploitation workflow is not fully specified.
  • The pwntools fork (mephi42/pwntools) and gef script are fetched from external URLs without integrity verification.
  • The analysis container runs as root by default, which is typical for debugging but could be hardened.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1