Lab — Read a Sample CVE and Write a Fix Note

Open exactly one advisory. Type the URL yourself (nvd.nist.gov/vuln/detail/CVE-2014-0160 or CVE-2021-44228, or a vendor page those entries reference for patches). Stay on description, affected products, CVSS literacy, and links that look like vendor patch notes. If a reference title looks like exploit code, a weaponized GitHub tree, or a crash PoC, do not follow it for this course. You already know from Lesson 1 that the ID does not include an exploit. The lab is to prove you can leave that link alone and still finish.

The system in the note is hypothetical and owned: “If I ran OpenSSL 1.0.1 on a TLS service I deploy” or “If I ran a Java app I own that logged untrusted input through a vulnerable log4j.” Label it hypothetical. Do not pretend you scanned the internet and found victims. Do not put a classmate’s hostname in the file. Do not use the café gateway. Inventory and exposure stay imaginary-but-honest: you invent a version and a bind (loopback vs LAN vs internet) so you can practice Lesson 2 context and Lesson 3 verbs. Invention is allowed because the host is labeled as yours. Hunting is not allowed.

cat > "$NOTES" << 'EOF'
=== CVE FIX NOTE (Cyberlium M05 L04) ===
DISCLAIMER: original Cyberlium — not official CEH, not a cert
CVE_ID:
OWNED_SYSTEM: (MY lab VM / hypothetical I own — not a stranger)
IMPACT_IN_WORDS:
CONDITIONS:
TREATMENT: (PATCH or COMPENSATE or ACCEPT — one primary verb)
REFUSE: no weaponized check, no Metasploit PoC, no dump
EOF

Required rows: (1) legal line — original Cyberlium, not an exam dump. (2) cve_id and source_url you typed. (3) affected_in_plain_words — product family and version range from the page, not a paste of the whole HTML. (4) impact_in_plain_words — CIA from Topic 1: disclosure, integrity, availability, plus the advisory’s conditions (network vs local, feature flags). (5) cvss_literacy — score/vector if shown; “9.8 network” is a serious conversation, still not automatic RCE on your laptop. (6) scanner_row_is_not_rce — one sentence from Lesson 2. (7) treatment — patch, compensate, or accept for the hypothetical owned system, with owner (you), date, and a check that is not a PoC. (8) ethics — no exploit clone, no searchsploit run, no scanning random IPs, no Nessus-against-the-internet, no Metasploit, localhost http.server is not this CVE.

Forbidden rows: exploit source, payload strings, Metasploit module names as “the fix,” lists of live IPs, searchsploit output, hashcat lines, nmap greps, café hostnames, campus 10.x. If a sentence would be useful to attack a stranger, delete it. If a sentence would be useful to a future you patching YOUR app, keep it. chmod 600 so another local account on a shared PC does not read your lab tree. Same path habit as cve-literacy-notes.txt, scanner-vs-risk-notes.txt, and risk-treatment-notes.txt — you may copy sentences across those files; this lab’s filename is specifically cve-fix-note.txt.

sudo apt install curl

curl -sS -m 10 -I "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228" | head -n 12

grep -E "CVE_ID|IMPACT_IN_WORDS|CONDITIONS|TREATMENT" "$NOTES"

For Heartbleed literacy on a hypothetical TLS service you own, patch is usually the honest verb: upgrade OpenSSL (or the vendor build that embeds it) to the fixed line the advisory names, restart the service you administer, confirm the version bit — not “run a disclosure tool against random hosts.” Compensate would be: take the service off the untrusted network until the bump, or disable TLS on that listener if you can afford to. Accept would be rare and would need a review date; do not accept “because writing a patch sentence was boring.”

For Log4Shell literacy on a hypothetical Java app you own, patch is bump the logging library (or the vendor image) to a fixed version the advisory names. Compensate is: remove the lookup feature the vendor documented, isolate the app, stop logging untrusted input, extra front-door control — still described as config, not as an exploit attempt. Accept needs residual risk in words (“if isolation fails, untrusted data might still reach the logger”) and a date. Mapping either CVE to python -m http.server on 127.0.0.1 is a failing lab even if the rest of the file is pretty. The teaching listener is the wrong species. Write that refusal explicitly.

sudo apt install sqlmap
sudo apt install python3

brew install sqlmap
brew install python3

pip install sqlmap

python3 - << 'PY'
from pathlib import Path
t = (Path.home()/'cyberlium-lab'/'cve-fix-note.txt').read_text(encoding='utf-8', errors='replace').lower()
banned = ('msfconsole', 'exploit/', 'hashcat', 'sqlmap -u')
print('FAIL recipe' if any(b in t for b in banned) else 'PASS: no weaponized recipe strings')
PY

The advisory is read in a browser. You do not need curl of NVD for a grade; typing the URL is enough. If the page fails to load, use a vendor postmortem you can open, still for the same CVE ID, still no exploit mirrors. Windows: create c:\Users\YOU\cyberlium-lab\cve-fix-note.txt (or WSL $HOME/cyberlium-lab) and restrict NTFS ACLs if you lack chmod. Git Bash and WSL can run the script below. Do not “fix” a blocked NVD by searching exploit-db and pasting a module. Do not switch CVE because someone on a forum said a different ID has a cooler demo.

If you already filled cve-literacy-notes.txt in Lesson 1, reuse the ID and rewrite impact plus the new treatment columns — this lab is the fuller ticket, not a second exploit. If Lesson 2 and 3 notes exist, you may reference them (“see scanner-vs-risk-notes: hypothesis”). The file this mission checks is still cve-fix-note.txt. World-writable 777 fails. Public gists fail. A screenshot of Metasploit titled “lab 4” fails even if you never fired a session.

Follow the block on a computer you own. The script only creates a template; you fill it after reading. It never clones exploits, never calls a scanner, never probes an IP. After filling, chmod 600 and read the file back. Stop. There is no second host.

cd "$HOME/cyberlium-lab"

{

You read a named bug on a public page, wrote impact without a payload, and chose a treatment for a system that is yours even when it is hypothetical. The file is locked. The teaching listener is still not that CVE. This is original Cyberlium teaching mapped to the CEH v13 vulnerability-analysis domain — not official EC-Council training, not a cert, not exam dumps. Next — Quiz — Vulnerability Analysis — ten APPLY items on CVE/CVSS and ethical handling of findings. After that, Module 6 conceptually: access, credentials, and why hashes matter, with MFA as defense — still no payloads, still no hashcat.