{
  "artifact_sha256": {
    "repro/evidence/fixed-1/attack-request.txt": "33024b0592de0183c4f5fc1815813b23d5ea55ad22038e4b41437a3f12156ded",
    "repro/evidence/fixed-1/package-identity.txt": "eb1d50aaab9e47f18ac22c17fa3ae768fdfd1afdd461e6e784313dbb557f92df",
    "repro/evidence/fixed-1/processes.txt": "bc936c73f0fa379e8f45b59039bbe7fc1b65263828e2818263c22d39b900bd1b",
    "repro/evidence/fixed-1/result.json": "2a1fa236e3ab2063862159b802614b8641b0fa537fd8938a1f891eda246739b2",
    "repro/evidence/fixed-1/smtp.transcript": "21446ea8df1f9f57937f4161d55a1045f6a0dbbf6905bee283f30fb88715127a",
    "repro/evidence/fixed-1/snmptrap.trace": "f93623a5fd68efcefdf2913cce0946dd0d0f9181b6a9086d24e92feb038db257",
    "repro/evidence/fixed-1/swatchrc.sha256": "cff670e2c3686f0872c6dfb55d2fdef357303dcc6d783f73f961ca973478fb46",
    "repro/evidence/fixed-1/zimbra.log": "e4d1b0aa7556dc0f633bd2b9b8662c8a18b6ffc359d1a5752ba86aaa8501451e",
    "repro/evidence/fixed-1/zmswatch.out": "63d7d1dc32646a3d81ad8a180fe2c52b8470873448715ead6cb48fe4a06db4d9",
    "repro/evidence/fixed-2/attack-request.txt": "6089e712782b067a7468601b7f9ec7c01e8da2a32a2f3dc4f0928d069645f18e",
    "repro/evidence/fixed-2/package-identity.txt": "eb1d50aaab9e47f18ac22c17fa3ae768fdfd1afdd461e6e784313dbb557f92df",
    "repro/evidence/fixed-2/processes.txt": "d862f70857b925fb0962b3fbafece5f763c8c55e817ea70fdf9a6113e6fb29bd",
    "repro/evidence/fixed-2/result.json": "a341a41ae5c8b460c2b1960b98da3d76a43c8ffbed342aefb55df5e6388b036e",
    "repro/evidence/fixed-2/smtp.transcript": "30759afb3a39d456cf384d94e4c5cfe837aebadc305b98913ba026a032852493",
    "repro/evidence/fixed-2/snmptrap.trace": "7050cd20c39c40de6d9e88a92f88832b2906457d793765825e61d9367c6996b7",
    "repro/evidence/fixed-2/swatchrc.sha256": "cff670e2c3686f0872c6dfb55d2fdef357303dcc6d783f73f961ca973478fb46",
    "repro/evidence/fixed-2/zimbra.log": "8fa0e801af538308a2bc347ff29aebbf70b7b64d856c1a6baf2444163e0a67a5",
    "repro/evidence/fixed-2/zmswatch.out": "8d4622f675ac3236623a75f7dd9ce02c9c9102934cbb3e1cda0615bcba6500e4",
    "repro/evidence/source-identity.txt": "45fa2ea971acba6eceae60d2681724e8c9cea6f013dee54e64ae35007e9ecebe",
    "repro/evidence/vulnerable-1/attack-request.txt": "6981afdecc15cb61578460cdbcb26a87e193f777ad3fbb96ad6355f33db93ccb",
    "repro/evidence/vulnerable-1/marker.txt": "85fe5f908055df71908e93700df6808558cda5b1e30d390f0247ec365f4d2803",
    "repro/evidence/vulnerable-1/package-identity.txt": "1865529588e890b562c30261eb80f25eb070fd442e65166293ca93cd385a2f54",
    "repro/evidence/vulnerable-1/processes.txt": "8ebe26fbb87ef0c6e76bf3b2fbe503f8c4928d077da72204606335f896511b8e",
    "repro/evidence/vulnerable-1/result.json": "2922fb6d531ab638cc8544305a673614c49d5c264f618d838a0eb34475809f07",
    "repro/evidence/vulnerable-1/smtp.transcript": "562a00021dbbd17498712c9d25b21409297be281457e85e1f33329b71a5c4904",
    "repro/evidence/vulnerable-1/swatchrc.sha256": "1fc9417c4bc5bd84507c1a72caaf708b38a1d0913dd86afd32cd7f359995648f",
    "repro/evidence/vulnerable-1/zimbra.log": "acff493722ae95ed7b932fe19061babd32309bea537b98be58ca5a0d7fb60055",
    "repro/evidence/vulnerable-1/zmswatch.out": "176e675ad97ad4812eb4943ea1a3114d64f8444c2ce66c9e679e74cb734bda7c",
    "repro/evidence/vulnerable-2/attack-request.txt": "9bea2ebea4927af2077fc7baf0ee4c2a82de454ce1e3a30e04634aeddb470364",
    "repro/evidence/vulnerable-2/marker.txt": "483742d1e7d96aab6b5fdab8ac45189bed7036ccc9ba3d1b0cf150dbb54bf7ba",
    "repro/evidence/vulnerable-2/package-identity.txt": "1865529588e890b562c30261eb80f25eb070fd442e65166293ca93cd385a2f54",
    "repro/evidence/vulnerable-2/processes.txt": "ef55bdf19e2c498709b881ed8796dcee7f392f470e8c514e6026ed338f215d47",
    "repro/evidence/vulnerable-2/result.json": "2244b3fef55efd154302e2544e5d2fc093b8f2a1410b5433405b1ebbd7cfd726",
    "repro/evidence/vulnerable-2/smtp.transcript": "1ae041957c1a803903a31ec6fb3330fe9dbd5829a36618cb26c8f8ebaa59b5c2",
    "repro/evidence/vulnerable-2/swatchrc.sha256": "1fc9417c4bc5bd84507c1a72caaf708b38a1d0913dd86afd32cd7f359995648f",
    "repro/evidence/vulnerable-2/zimbra.log": "4be3c0a46f1c42961fdb92a59aeccbdaf1c396a81915c19ed2bcefe97a83e87d",
    "repro/evidence/vulnerable-2/zmswatch.out": "33d6271b337c5f4b3afc8e3be35bebe12090f86e8932e4d9429a3f1deb48e8dd"
  },
  "entrypoint_detail": "external unauthenticated SMTP peer -> installed ZCS packaged Postfix TCP listener -> /var/log/zimbra.log -> installed packaged zmswatch as zimbra -> dosnmp",
  "entrypoint_kind": "tcp_peer",
  "healthcheck_passed": true,
  "notes": "Two clean installed vulnerable ZCS attempts produced unique zimbra-user command markers; two clean authentic ZCS 10.1.20 package controls reached the same SMTP/log/zmswatch path without markers.",
  "proof_artifacts": [
    "repro/evidence/source-identity.txt",
    "repro/evidence/vulnerable-1/attack-request.txt",
    "repro/evidence/vulnerable-1/smtp.transcript",
    "repro/evidence/vulnerable-1/zimbra.log",
    "repro/evidence/vulnerable-1/zmswatch.out",
    "repro/evidence/vulnerable-1/processes.txt",
    "repro/evidence/vulnerable-1/package-identity.txt",
    "repro/evidence/vulnerable-1/swatchrc.sha256",
    "repro/evidence/vulnerable-1/result.json",
    "repro/evidence/vulnerable-1/marker.txt",
    "repro/evidence/vulnerable-2/attack-request.txt",
    "repro/evidence/vulnerable-2/smtp.transcript",
    "repro/evidence/vulnerable-2/zimbra.log",
    "repro/evidence/vulnerable-2/zmswatch.out",
    "repro/evidence/vulnerable-2/processes.txt",
    "repro/evidence/vulnerable-2/package-identity.txt",
    "repro/evidence/vulnerable-2/swatchrc.sha256",
    "repro/evidence/vulnerable-2/result.json",
    "repro/evidence/vulnerable-2/marker.txt",
    "repro/evidence/fixed-1/attack-request.txt",
    "repro/evidence/fixed-1/smtp.transcript",
    "repro/evidence/fixed-1/zimbra.log",
    "repro/evidence/fixed-1/zmswatch.out",
    "repro/evidence/fixed-1/processes.txt",
    "repro/evidence/fixed-1/package-identity.txt",
    "repro/evidence/fixed-1/swatchrc.sha256",
    "repro/evidence/fixed-1/result.json",
    "repro/evidence/fixed-1/snmptrap.trace",
    "repro/evidence/fixed-2/attack-request.txt",
    "repro/evidence/fixed-2/smtp.transcript",
    "repro/evidence/fixed-2/zimbra.log",
    "repro/evidence/fixed-2/zmswatch.out",
    "repro/evidence/fixed-2/processes.txt",
    "repro/evidence/fixed-2/package-identity.txt",
    "repro/evidence/fixed-2/swatchrc.sha256",
    "repro/evidence/fixed-2/result.json",
    "repro/evidence/fixed-2/snmptrap.trace"
  ],
  "runtime_instances": {
    "fixed_image_id": "sha256:0328b5ca93ab63dc75aff76d9674a1cc41e01090d0b21e390b05f56b87d4fd80",
    "vulnerable_image_id": "sha256:dd4fa85025601e1126e32ddd643f544567b000040df2e0b166e2189e08bac5ae"
  },
  "runtime_stack": [
    "installed ZCS 10.1.0.GA.4655 UBUNTU22",
    "zimbra-postfix 3.6.14-1zimbra8.7b7.22.04",
    "zimbra-perl-swatchdog 3.2.4-1zimbra8.7b2.22.04",
    "zimbra-snmp 10.1.0.GA.4655",
    "authentic zimbra-mta-patch 10.1.20.1783342495-1.u22 fixed control"
  ],
  "service_started": true,
  "target_identity": {
    "architecture": "x86_64",
    "commit_sha": null,
    "platform": "linux",
    "repository_url": "https://files.zimbra.com/downloads/10.1.0_GA/",
    "runtime_digest": "sha256:dd4fa85025601e1126e32ddd643f544567b000040df2e0b166e2189e08bac5ae",
    "target_digest": "08ec3a1715ec9eb584da39d5cf2cba12ae24eb0beca8f57e5a3a46b07455ce88"
  },
  "target_path_reached": true
}