本仓库为 CVE-2025-32433（Erlang/OTP SSH 缺失身份验证漏洞）提供了一个完整、可直接提交、容器化的安全研究实验室。它允许安全工程师、审查人员和研究人员在严格隔离的环境中独立部署、复现、分析和检测该漏洞。
该实验室通过自定义隔离桥接网络（cve-lab-bridge）编排 3 个 Docker 容器：
┌─────────────────────────────────────────┐
│ Isolated Docker Bridge │
│ (cve-lab-bridge) │
└────┬──────────────────────────────┬─────┘
│ │
┌──────────────┴──────────────┐┌──────────────┴──────────────┐
│ target_vulnerable ││ target_patched │
│ Erlang/OTP 26.2.5 ││ Erlang/OTP 26.2.5.11 │
│ Host Port: 127.0.0.1:2222 ││ Host Port: 127.0.0.1:2223 │
│ Logs: ./logs/target_vulnerable/ ││ Logs: ./logs/target_patched/ │
└─────────────────────────────┘└─────────────────────────────┘
│
┌──────────────┴──────────────┐
│ attacker │
│ Python 3 + Scapy/Paramiko │
│ Workdir: /work │
└─────────────────────────────┘
v20.10+ 与 Docker Compose v2.20+）paramiko 和 scapy）克隆仓库并启动所有实验室服务：
# 1. Clone the repository
git clone <repository_url>
cd INE_CYBER_ASSIGNMENT_JOB
# 2. Build and start all 3 lab containers in detached mode
docker compose up -d --build
# 3. Verify all containers are running and healthy
docker ps
使用单条命令运行完整的 4 层诊断与检测套件：
python detection/run_all_detections.py
# Enter the attacker container
docker exec -it cve-2025-32433-attacker bash
# Run the master detector inside container
python3 /work/detection/run_all_detections.py
# Connect to Vulnerable Target (Port 2222)
ssh -p 2222 [email protected]
# Password: LabPass2026!Secured
# Connect to Patched Target (Port 2223)
ssh -p 2223 [email protected]
# Password: LabPass2026!Secured
docker exec -it cve-2025-32433-attacker bash）：# Connect to Vulnerable Target (Internal Port 2222)
ssh -p 2222 labuser@target_vulnerable
# Password: LabPass2026!Secured
# Connect to Patched Target (Internal Port 2222)
ssh -p 2222 labuser@target_patched
# Password: LabPass2026!Secured
# Test Vulnerable Target
python scripts/baseline_auth_test.py 127.0.0.1 2222
# Test Patched Target
python scripts/baseline_auth_test.py 127.0.0.1 2223
# Test Vulnerable Target
python3 /work/scripts/baseline_auth_test.py target_vulnerable 2222
# Test Patched Target
python3 /work/scripts/baseline_auth_test.py target_patched 2222
# Scan Vulnerable Target
python detection/detect_cve_2025_32433.py 127.0.0.1 2222
# Scan Patched Target
python detection/detect_cve_2025_32433.py 127.0.0.1 2223
# Scan Vulnerable Target
python3 /work/detection/detect_cve_2025_32433.py target_vulnerable 2222
# Scan Patched Target
python3 /work/detection/detect_cve_2025_32433.py target_patched 2222
监控 TCP 端口 2222 上的预认证 SSH_MSG_CHANNEL_OPEN（类型 90 / 0x5A）数据包。
# Run inside Attacker Container shell
python3 /work/detection/network_behavior_detect.py
监控易受攻击容器的进程表（ps aux）中生成的子 shell。
# Run from Host PowerShell
python detection/host_process_monitor.py
Erlang SSH 日志写入每个容器内的磁盘，并直接挂载到你的主机文件系统：
./logs/target_vulnerable/ssh.log./logs/target_patched/ssh.log在 PowerShell 中实时跟踪：
Get-Content -Path .\logs\target_vulnerable\ssh.log -Wait -Tail 20
有关日志架构的详细信息，请参阅 LOGGING.md。
CVE-2025-32433 已在 Erlang/OTP 26.2.5.11（提交 b1924d3）和 27.3.3（提交 6eef041）中修复。
在已修复的目标（lab_patched/）中，ssh_connection.erl 明确强制执行连接状态验证：
handle_msg(#ssh_msg_channel_open{}, #state{authenticated = false} = State) ->
{disconnect, {error, unauthenticated}, State};
停止并移除所有实验室容器和网络：
docker compose down