{
  "entrypoint_kind": "tcp_peer",
  "entrypoint_detail": "real curl 8.22.0 tool invoked with -Z -T against a malicious TLS/HTTP/2 TCP peer; peer sends REFUSED_STREAM, creates a resurrected stream, grooms/reclaims Curl_easy, leaks fresh libc/libcurl addresses, and triggers system() to create a marker",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "curl 8.22.0 non-ASAN PIE",
    "libcurl 8.22.0",
    "nghttp2 1.59.0",
    "OpenSSL 3.0.13",
    "glibc 2.39",
    "Python malicious HTTP/2 peer",
    "Docker pinned Ubuntu 24.04 runtime"
  ],
  "target_identity": {
    "repository_url": "https://github.com/curl/curl",
    "commit_sha": "01346829096c61b372692f6dc43ffa778c6caccd",
    "target_digest": "087a02404318590388746a19e0cfe8fb54506bda7baa81634a3c5b495966dce8",
    "runtime_digest": "7ac35861a781df66d920d9fca9bd40075a86185437405825ff023132637984a4",
    "platform": "linux",
    "architecture": "x86_64"
  },
  "proof_artifacts": [
    "repro/rce-vuln-1/server.log",
    "repro/rce-vuln-1/victim.log",
    "repro/rce-vuln-1/victim-exit.txt",
    "repro/rce-vuln-1/victim-cwd-ls.txt",
    "repro/rce-vuln-1/marker-name.txt",
    "repro/rce-vuln-1/marker.txt",
    "repro/rce-vuln-1/leak.bin",
    "repro/rce-vuln-1/leak-size.txt",
    "repro/rce-vuln-1/observation.json",
    "repro/rce-vuln-2/server.log",
    "repro/rce-vuln-2/victim.log",
    "repro/rce-vuln-2/victim-exit.txt",
    "repro/rce-vuln-2/victim-cwd-ls.txt",
    "repro/rce-vuln-2/marker-name.txt",
    "repro/rce-vuln-2/marker.txt",
    "repro/rce-vuln-2/leak.bin",
    "repro/rce-vuln-2/leak-size.txt",
    "repro/rce-vuln-2/observation.json",
    "repro/rce-fixed-1/server.log",
    "repro/rce-fixed-1/victim.log",
    "repro/rce-fixed-1/victim-exit.txt",
    "repro/rce-fixed-1/victim-cwd-ls.txt",
    "repro/rce-fixed-1/marker-name.txt",
    "repro/rce-fixed-1/observation.json",
    "repro/rce-fixed-2/server.log",
    "repro/rce-fixed-2/victim.log",
    "repro/rce-fixed-2/victim-exit.txt",
    "repro/rce-fixed-2/victim-cwd-ls.txt",
    "repro/rce-fixed-2/marker-name.txt",
    "repro/rce-fixed-2/observation.json"
  ],
  "artifact_sha256": {
    "repro/rce-vuln-1/server.log": "30c5ea9d148ebd1694e218a71750b1f1e732d97c30dd3ef83f3db14093d67e6a",
    "repro/rce-vuln-1/victim.log": "80633a84fa1ec9a6c3e01125e9398983ed7119abe979a9757b9ba63a89a5c906",
    "repro/rce-vuln-1/victim-exit.txt": "e726b440cc164001999e718b51780d80314709efe06e7857282377be9111127b",
    "repro/rce-vuln-1/victim-cwd-ls.txt": "a8cbd20f017ca5f0696cf5263995cef299084ae9e580ca650801663e3a1544bb",
    "repro/rce-vuln-1/marker-name.txt": "f72e4daa6654a3d4b7e14767e61c629e85bdda8f309f9ef2831ad33958671e1e",
    "repro/rce-vuln-1/marker.txt": "490dc88c49f6538b0d3b2512b6f121891b3e2bb6a6c13d253cb8438a78d02540",
    "repro/rce-vuln-1/leak.bin": "b3fe3608259016eef4c15241913d7941b6a0ce4acfd80ea4c9b92c83b3d42ca4",
    "repro/rce-vuln-1/leak-size.txt": "dedb3ecf6c0bd28aa77e945617c569ebf68f52a1a5dbf5d0d5fb42dda60e0cdd",
    "repro/rce-vuln-1/observation.json": "78af9d71f96c09ac173d9e1d75be660f62241ca05121696e7f7b4ef0755af3c6",
    "repro/rce-vuln-2/server.log": "74fe01fd20648a47357d9e9587e8ab2631adffb4d7132f6f7cdad1b64dcfa210",
    "repro/rce-vuln-2/victim.log": "876776357c72b97a6e2fb1ff5cd1aa7d07a38c27d26d28d8abf596be24c80d8d",
    "repro/rce-vuln-2/victim-exit.txt": "e726b440cc164001999e718b51780d80314709efe06e7857282377be9111127b",
    "repro/rce-vuln-2/victim-cwd-ls.txt": "a8cbd20f017ca5f0696cf5263995cef299084ae9e580ca650801663e3a1544bb",
    "repro/rce-vuln-2/marker-name.txt": "f72e4daa6654a3d4b7e14767e61c629e85bdda8f309f9ef2831ad33958671e1e",
    "repro/rce-vuln-2/marker.txt": "e74d2ed3b90bebfd340af20ed806a64cd2005f130a7b2e51e077df94ab106a5d",
    "repro/rce-vuln-2/leak.bin": "d1d412ad505e006b53d385b4c7afc479f29e70f26d7e677f1dfdf53a2afe0450",
    "repro/rce-vuln-2/leak-size.txt": "dedb3ecf6c0bd28aa77e945617c569ebf68f52a1a5dbf5d0d5fb42dda60e0cdd",
    "repro/rce-vuln-2/observation.json": "2154bdb2d27a01dfd4b2b31a4d0b175da41037848770d5ec4559cda7d0dadb06",
    "repro/rce-fixed-1/server.log": "8d329adeb29a34150bf8571cc2c789535b9c3c57e94879a896c87386d3f060c9",
    "repro/rce-fixed-1/victim.log": "5e74349c9bb9b9c04d8d150e25e800cee4b824e5f2edbec3b115775dfe34052d",
    "repro/rce-fixed-1/victim-exit.txt": "ca2ebdf97d7469496b1f4b78958f9dc8447efdcb623953fee7b6996b762f6fff",
    "repro/rce-fixed-1/victim-cwd-ls.txt": "fd76661ba9861e70d8e2b08d26b25d400b3cb6d693fed0611f2a9c8e2afa0727",
    "repro/rce-fixed-1/marker-name.txt": "01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b",
    "repro/rce-fixed-1/observation.json": "4d88e85bce1633e83bd26a6cdf4405625f37c5a4ec169103b1297abe4454974a",
    "repro/rce-fixed-2/server.log": "cd06059556ef0a57c9931b0a956c691aab537d8c7213298345c03f880bf929ad",
    "repro/rce-fixed-2/victim.log": "a91187b720db1f5b6aa613c424c6b4fb52e0ad525bca648aa5bd00479c162a0a",
    "repro/rce-fixed-2/victim-exit.txt": "ca2ebdf97d7469496b1f4b78958f9dc8447efdcb623953fee7b6996b762f6fff",
    "repro/rce-fixed-2/victim-cwd-ls.txt": "20650ef71bf548e8c45ea752918135e37099806f018e33ada14d9cecfa171e5a",
    "repro/rce-fixed-2/marker-name.txt": "01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b",
    "repro/rce-fixed-2/observation.json": "b9b0fafba54decc9c73e758b5600fcc2c7005fd1d37da2b31a2772037e156027"
  },
  "notes": "RCE marker created in 2/2 vulnerable processes after fresh in-band ASLR disclosures; fixed commit 8b0744af5b1b631da5b938ca31c3f9895ad5a321 reached the same reset/stall TCP path but created no resurrected stream, leak, or marker in 2/2 controls. Primary RCE proof is non-sanitized."
}