CVE-2024-4577 - PHP CGI Argument Injection Detection Lab

A complete detection engineering lab for CVE-2024-4577 (PHP CGI Argument Injection). Includes pre-built Vagrant boxes, Wazuh SIEM rules, and exploit tools for Blue Team training.

What's Included

• Windows Server 2022 VM - Vulnerable XAMPP + PHP-CGI, Sysmon, Wazuh Agent
• Kali Linux VM - Pre-installed exploit scripts
• Wazuh SIEM - Docker-based with 54 production detection rules
• Detection Rules - Wazuh XML, Sigma YAML, IOCs

Quick Start

Prerequisites

• Vagrant 2.3+
• VirtualBox 7.0+
• Docker
• 12GB RAM minimum

1. Start Wazuh SIEM

cd wazuh
docker compose up -d
# Dashboard: https://localhost:443 (admin / SecretPassword)

2. Start Lab VMs

vagrant up
# Downloads ~12GB on first run

3. Get VM IPs

VBoxManage guestproperty enumerate "DetectionLab-Windows" | grep IP
VBoxManage guestproperty enumerate "DetectionLab-Kali" | grep IP

4. Launch Attack

vagrant ssh kali
python3 ~/exploits/CVE-2024-4577.py --url http://<WINDOWS_IP>/ --cmd "whoami"

5. See Detection

Wazuh Dashboard -> Discover -> Filter: rule.id: 100442

Vagrant Boxes

Pre-built boxes on HCP Vagrant Registry:

• CVE-2024-4577/windows - Windows Server 2022 target
• CVE-2024-4577/kali - Kali Linux attacker

Detection Coverage (54 rules)

Credentials

Project Structure

CVE-2024-4577/
├── Vagrantfile           # Lab VM definitions
├── README.md             # This file
├── detections/           # Detection rules
│   ├── wazuh-rules.xml   # 54 Wazuh detection rules
│   ├── sigma-rules.yml   # Sigma format rules
│   ├── iocs.json         # Indicators of Compromise
│   └── detection-guide.md
└── wazuh/                # Wazuh SIEM stack
    └── docker-compose.yml

CVE Details

• CVE ID: CVE-2024-4577
• Type: Remote Code Execution
• CVSS: 9.8 (Critical)
• Affected: PHP 8.1 < 8.1.29, 8.2 < 8.2.20, 8.3 < 8.3.8 (Windows + CGI mode)
• Root Cause: Soft hyphen (0xAD) bypasses CVE-2012-1823 fix in Windows Best-Fit encoding

License

MIT