## https://sploitus.com/exploit?id=47C5D05A-ACAB-5FC2-A386-DBA0D89B1919
# Local VulnLab Platform
The Local VulnLab Platform is a vulnerability reproduction platform designed for Kali Linux, local, CTF, and security training. It can manage local Docker, generate and run accompanying PoCs, extract PoC features, organize scan results, and index data from Vulhub, NVD, and CISA KEV. ## Security Statement
This project includes services with intentionally created vulnerabilities and executable PoCs. It can only be used for:
- Your own local environment;
- CTF, training, or research;
- Security tests with explicit authorization. Using this project on unauthorized targets is prohibited. The built-in `127.0.0.1`. The Web UI is a local management interface; it does not have user authentication by default and should not be exposed to the local network or the public internet. ## Project Functionality
The platform eliminates repetitive tasks in vulnerability research:
1. Describes vulnerability scenarios using a unified `lab.json` file;
2. Automatically generates Docker Compose files and starts isolated;
3. Generates executable Python PoCs based on scenario strategies;
4. Automatically executes PoCs, identifies outputs, and extracts flags;
5. Analyzes historical PoCs in bulk, extracting path, method, payload, and rule clues;
6. Indexes real CVE Compose scenarios from Vulhub;
7. Synchronizes vulnerability information from NVD, CISA KEV, and local reproducable vulnerabilities;
8. Manages deployment, verification, and cleanup processes via CLI or the local Web UI. ## Built-in
| ID | Type | Default Port | Vulnerability Type |
|---|---|---:|---|
| `nday-sqli` | n-day | 18080 | SQL injection and login bypass |
| `one-day-cmdi` | 1-day | 18081 | Command injection regression |
| `nday-path-traversal` | n-day | 18082 | Path traversal and file reading |
| `zero-mini-template` | 0-day simulated | 18083 | Template expression execution |
These are used for local training scenarios to verify the platform’s workflows. They do not represent undisclosed vulnerabilities of real products. ## Environment Requirements
- Kali Linux or other Debian-based Linux distributions;
- Python 3.8 or higher version;
- Docker Engine;
- Docker Compose V2, or compatible `docker-compose`;
- Optional tools: `git`, `curl`, `make`, `jq`. The core Python code of the platform only relies on standard libraries. For automatic deployment via SSH, Paramiko is required as an optional dependency. ## Quick Start
```bash
git clone https://github.com/YiXing-i/vulnlab-platform.git
cd vulnlab-platform
bash scripts/install_kali.sh
source.venv/bin/activate
python3 -m vulnlab doctor
python3 -m vulnlab list
python3 -m vulnlab selftest
```
`doctor` checks Python, Docker, and Compose; `list` displays built-in; `selftest` generates and compiles all built-in PoCs but does not start Docker. ## Reproducing a Built-in
You can easily reproduce “starting, generating PoCs, executing verifications, and extracting flags” with the following command:
```bash
python3 -m vulnlab reproduce nday-sqli
```
By default, the already started environment will be retained. To check the status and clean up:
```bash
python3 -m vulnlab status
python3 -m vulnlab down nday-sqli
```
To automatically stop after execution:
```bash
python3 -m vulnlab reproduce nday-sqli --no-keep
```
Step-by-step instructions:
```bash
python3 -m vulnlab show one-day-cmdi
python3 -m vulnlab compose one-day-cmdi
python3 -m vulnlab up one-day-cmdi
python3 -m vulnlab run-poc one-day-cmdi --target http://127.0.0.1:18081
python3 -m vulnlab down one-day-cmdi
```
To perform batch operations by day type:
```bash
python3 -m vulnlab up-day nday
python3 -m vulnlab reproduce-day nday --no-keep
python3 -m vulnlab down-day all
```
You can also use the Makefile:
```bash
```
make list
make selftest
make reproduce LAB=nday-sqli
make down LAB=nday-sqli
```
## Docker Desktop Unified Management
The `compose.yaml` file in the root directory groups the four built-in into a single `vulnlab-platform` Compose project:
docker compose up -d --build
After it starts, the Docker Desktop’s Containers page will display the `vulnlab-platform` project. Common management commands:
docker compose ps
docker compose logs -f
docker compose stop
docker compose start
docker compose down
To run only one:
docker compose up -d --build nday-sqli
Access addresses:
SQL Injection: http://127.0.0.1:18080
Command Injection: http://127.0.0.1:18081
Path Traversal: http://127.0.0.1:18082
Template Expression Execution: http://127.0.0.1:18083
The unified Compose mode and the `python -m vulnlab up` command for running individual use the same port and container name. Do not run them simultaneously. Stop the current mode before switching modes. ## Web UI
Secure startup method:
python3 -m vulnlab web --host 127.0.0.1 --port 8008
Access `http://127.0.0.1:8008`. When accessing Kali remotely, do not open port `8008`; use an SSH tunnel:
ssh -L 8008:127.0.0.1:8008 kali@
Then access `http://127.0.0.1:8008` locally. The PoC storage and execution interfaces are disabled by default on the web side. The CLI can still generate, analyze, and execute PoCs normally. Only in a temporary trusted environment should you enable them:
VULNLAB_ENABLE_UNSAFE_POC_API=1 python3 -m vulnlab web
Non-loopback address bindings are rejected by default. Even if `VULNLAB_ALLOW_REMOTE_WEB=1` is set, it must be placed after a reverse proxy with strong authentication and TLS; an SSH tunnel is recommended. ## PoC Generation, Modification, and Analysis
Generate individual or all built-in PoCs:
python3 -m vulnlab generate-poc nday-sqli --target http://127.0.0.1:18080 --overwrite
Modify generated PoCs:
python3 -m vulnlab patch-poc./generated_pocs --output./generated_pocs_patched --target http://127.0.0.1:18080 --timeout 5
Extract PoC features and export detection rules:
python3 -m vulnlab poc-analyze./generated_pocs --out./reports/poc-features.json
Export rules:
python3 -m vulnlab rule-export./reports/poc-features.json --out./reports/detector-rules.json
The rule outputs are analysis clues and should not be used as vulnerability conclusions without manual verification. ## Authorized Target Batch Verification
For each target file, one URL per line:
http://127.0.0.1:18080
http://127.0.0.1:18083
Run:
python3 -m vulnlab scan --pocs./generated_pocs --targets./examples/targets.txt --timeout 10 --out-dir./reports
Results will be written in JSON and CSV formats. This command can only be executed on local or targets explicitly authorized. ## Vulnerability Intelligence
Use only the built-in seed data, without accessing the network:
python3 -m vulnlab sync-vulns --seed-only
```
Synchronize recent NVD and CISA KEV instances:
```bash
python3 -m vulnlab sync-vulns --days 30 --limit 120
python3 -m vulnlab vulns --day-type nday
python3 -m vulnlab vulns --reproducible
```
Vulnerability intelligence entries do not equal environments that can be deployed, nor do they mean that the vulnerabilities have been successfully reproduced. ## Vulhub Scenarios
First synchronization and index creation:
```bash
python3 -m vulnlab vulhub-sync
```
Querying, deploying, and cleaning up:
```bash
python3 -m vulnlab vulhub-list --query CVE-2021-41773
python3 -m vulnlab vulhub-up CVE-2021-41773
python3 -m vulnlab vulhub-down CVE-2021-41773
```
Vulhub scenarios are defined by their respective Compose files. Read the corresponding README before running them, and check the images, ports, and resource consumption. ## Deploying from Windows to Kali
It is recommended to configure an SSH key first, and use the system’s `ssh` command to connect once to verify and record the host key:
```powershell
ssh kali@
```
Installing deployment dependencies (optional):
```powershell
python -m pip install ".[deploy]"
```
Deploying using an SSH key:
```powershell
python.\scripts\deploy_to_kali.py `
--host `
--user kali `
--sync-now `
--start-web
```
If password authentication is required, use interactive prompts instead of entering the password directly in the command line:
```powershell
python.\scripts\deploy_to_kali.py `
--host `
--user kali `
--ask-password `
--ask-sudo-password
```
The deployer will automatically bind the web to Kali’s `127.0.0.1:8008`, and then access it via an SSH tunnel. ## Adding a New
Directory structure:
```text
labs//
lab.json
Dockerfile
app/server.py
```
Minimum `lab.json`:
```json
{
"id": "my-lab",
"title": "My Local Vulnerability",
"day_type": "0day-simulated",
"category": "template-eval",
"default_host_port": 18100,
"container_port": 8000,
"flag": "flag{my_lab_demo}",
"poc": {
"strategy": "http_eval_template",
"endpoint": "/render",
"param": "tpl",
"health_path": "/health"
}
}
```
When adding a new PoC strategy, add a renderer in `vulnlab/generator.py` and register it in `STRATEGIES`. Also update `pyproject.toml`’s `tool.setuptools.data-files` to ensure that the released wheel includes the new. ## Project Structure
```
vulnlab/ Python CLI, Web UI, and core logic
labs/ Built-in local vulnerability
scripts/ Kali installation, service, and deployment scripts
skills/ Automated vulnerability reproduction skills
docs/ Design descriptions and architectural decisions
examples/ Secure local example inputs
tests/ Standard library unittest tests
```
Running tests:
```bash
python -m unittest discover -s tests -v
python -m vulnlab selftest
```
## Cleaning Up
Stop all built-in environments:
```bash
python3 -m vulnlab down-day all
```
Clean up the running environment, images, and generated PoCs:
```bash
python3 -m vulnlab cleanup --images --generated
```
## Security Issues
- Security issues: See `SECURITY.md`. Please use GitHub private vulnerability reports.
- Open-source license: MIT, see `LICENSE`.
[source-iocs-preserved url=http://127.0.0.1:8008`。]