
Environment Blueprint
Operating System Container: ubuntu:22.04 (running under Windows WSL2).
Web Server Layer: Apache2 with mod_actions, mod_cgi, and mod_cgid forced globally into the main apache2.conf.
Language Interpreter: PHP 8.1.2 running strictly under CGI/FastCGI mode (Server API).
File Architecture: A functional app/ directory hosting execution code (index.php) and a simulated challenge asset.
Core Vulnerability Mechanics Studied
The Target Flaw (CVE-2024-4577): An argument injection issue that targets systems where unauthenticated parameters pass directly into the php-cgi executable engine.
The OS Encoding Constraint: lab successfully demonstrates the legacy CGI processing path, it highlights a platform difference. The real-world exploit depends on Windows Best-Fit Mapping (where code pages like CP936 or CP950 interpret soft hyphens as standard hyphens after web application checks). Because container runs on an Ubuntu/UTF-8 baseline, it remains natively immune to that specific character conversion technique.
