---
# System prepended metadata

title: Docker-composes with docker containers for CVE Vulnerabilities Exploitation Project

---

# Docker-composes with docker containers for CVE Vulnerabilities Exploitation Project
## Team Members:
- Kamil Rizatdinov 
- Rufina Talalaeva
- Evgeniy Trantsev
- Renat Valeev
## DomainMod admin panel stored XSS
Docker-compose for running the DomainMod admin panel.
1. create docker-compose.yml file
2. insert there configuration below and save
    ```yaml
    version: '3.7'

    services:

      app:
        image: rizatdinov/domainmod_app
        container_name: 'domainmod_app'
        depends_on:
          - 'db'
        ports:
          - '80:80'
          - '443:80'
        restart: 'unless-stopped'

      db:
        image: rizatdinov/domainmod_db
        container_name: 'domainmod_db'
        environment:
          TZ: 'America/Vancouver'
          MYSQL_ALLOW_EMPTY_PASSWORD: 'no'
          MYSQL_ROOT_PASSWORD: 'password'
          MYSQL_DATABASE: 'domainmod'
          MYSQL_USER: 'domainmod'
          MYSQL_PASSWORD: 'password'
        expose:
          - '3306'
        restart: 'unless-stopped'
        volumes:
          - './database:/var/lib/mysql'
    ```
3. run `docker-compose up` in command line to run the application.

Additional:
* Application Image - https://hub.docker.com/repository/docker/rizatdinov/domainmod_app
* Database Image - https://hub.docker.com/repository/docker/rizatdinov/domainmod_db

## phpMyAdmin CSRF exploitation in HTTP GET requests
1. create docker-compose.yml file
2. insert there configuration below and save
    ```yaml
    version: '3'

    services: 
      web:
        image: vsplate/pmasa-2017-9:latest 
        ports:
          - "80:80"
      kitten:
        image: nufusrufus/kitten 
        ports:
          - "8080:80"
    ```
3. run `docker-compose up` in command line to run the application.
Additional:
* Vulnerable version of phpMyAdmin - https://hub.docker.com/r/vsplate/pmasa-2017-9
* Web app with buttons to perform GET requests- https://hub.docker.com/r/nufusrufus/kitten

## Python3 ctypes buffer overflow in string representation
1. run `docker pull r0ach20/python_dos` in command line to pull the image of the small program written on vulnerable version of python
2. run `docker run -it r0ach20/python_dos` in order to run the container

Additional:
* The image of the small program written on vulnerable version of python
https://hub.docker.com/r/r0ach20/python_dos
* Source code of the image could be found at https://github.com/TAPAKAH20/python_dos_demo 

## GitLab Remote Code Execution
1. Create docker-compose.yml file
2. Copy the content of the file below
    https://gist.github.com/LiveOverflow/8bf92dd86e5c481fb484af83c64e83b3#file-docker-compose-yml
3. Run `touch flag steg0_initial_root_password && docker-compose up` in order to run the application

Additional:
* Docker-compose of vulnerable version of the gitlab - https://gist.github.com/LiveOverflow/8bf92dd86e5c481fb484af83c64e83b3#file-docker-compose-yml