wordpress-vulnerable-lab/docker-compose.matrix.yml at main · ayinedjimi/wordpress-vulnerable-lab · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
# docker-compose.matrix.yml
# Phase F — Multi-WordPress-version benchmarking matrix.
# Author: Ayi NEDJIMI <ayinedjimi@users.noreply.github.com>
#
# Usage:
#   docker compose -f docker-compose.yml -f docker-compose.matrix.yml up -d
#
# Reuses the existing `db` (mysql:5.7) service from docker-compose.yml.
# Each WP container gets its own database inside that single MySQL server:
#   wp52 / wp53 / wp61 / wp68
#
# Port allocation:
#   31352 -> WP 5.2  (CVE-2019-17671 REST API user leak)
#   31353 -> WP 5.3  (already exposed by main lab on 31338; mirrored here for parity)
#   31361 -> WP 6.1  (CVE-2023-2745 directory traversal)
#   31368 -> WP 6.8  (latest hardened baseline; cleanest target for false-positive testing)
#
# Each WP container ships with admin/admin and reuses the host's pre-built
# vulnerable plugin set via bind mount where versions are compatible.

services:

  db-matrix-init:
    image: mysql:5.7
    container_name: wpvl-matrix-init
    depends_on:
      - db
    entrypoint: ["/bin/sh", "-c"]
    command: >
      "until mysqladmin ping -h db -uroot -proot --silent; do sleep 2; done;
       mysql -h db -uroot -proot -e
         'CREATE DATABASE IF NOT EXISTS wp52;
          CREATE DATABASE IF NOT EXISTS wp53;
          CREATE DATABASE IF NOT EXISTS wp61;
          CREATE DATABASE IF NOT EXISTS wp68;
          GRANT ALL ON wp52.* TO wpuser@%;
          GRANT ALL ON wp53.* TO wpuser@%;
          GRANT ALL ON wp61.* TO wpuser@%;
          GRANT ALL ON wp68.* TO wpuser@%;
          FLUSH PRIVILEGES;'"
    restart: "no"
    networks:
      - default

  wp52:
    image: wordpress:5.2-php7.2-apache
    container_name: wpvl-wp52
    depends_on:
      - db-matrix-init
    ports:
      - "31352:80"
    environment:
      WORDPRESS_DB_HOST: db:3306
      WORDPRESS_DB_NAME: wp52
      WORDPRESS_DB_USER: wpuser
      WORDPRESS_DB_PASSWORD: wppass
      WORDPRESS_TABLE_PREFIX: wp_
      WORDPRESS_DEBUG: 1
    volumes:
      - wp52-data:/var/www/html
      - ./plugins:/var/www/html/wp-content/plugins:ro
    networks:
      - default

  wp53:
    image: wordpress:5.3-php7.4-apache
    container_name: wpvl-wp53
    depends_on:
      - db-matrix-init
    ports:
      - "31353:80"
    environment:
      WORDPRESS_DB_HOST: db:3306
      WORDPRESS_DB_NAME: wp53
      WORDPRESS_DB_USER: wpuser
      WORDPRESS_DB_PASSWORD: wppass
      WORDPRESS_TABLE_PREFIX: wp_
      WORDPRESS_DEBUG: 1
    volumes:
      - wp53-data:/var/www/html
      - ./plugins:/var/www/html/wp-content/plugins:ro
    networks:
      - default

  wp61:
    image: wordpress:6.1-php8.0-apache
    container_name: wpvl-wp61
    depends_on:
      - db-matrix-init
    ports:
      - "31361:80"
    environment:
      WORDPRESS_DB_HOST: db:3306
      WORDPRESS_DB_NAME: wp61
      WORDPRESS_DB_USER: wpuser
      WORDPRESS_DB_PASSWORD: wppass
      WORDPRESS_TABLE_PREFIX: wp_
      WORDPRESS_DEBUG: 1
    volumes:
      - wp61-data:/var/www/html
      - ./plugins:/var/www/html/wp-content/plugins:ro
    networks:
      - default

  wp68:
    image: wordpress:6.8-php8.2-apache
    container_name: wpvl-wp68
    depends_on:
      - db-matrix-init
    ports:
      - "31368:80"
    environment:
      WORDPRESS_DB_HOST: db:3306
      WORDPRESS_DB_NAME: wp68
      WORDPRESS_DB_USER: wpuser
      WORDPRESS_DB_PASSWORD: wppass
      WORDPRESS_TABLE_PREFIX: wp_
      WORDPRESS_DEBUG: 0
    volumes:
      - wp68-data:/var/www/html
      # No legacy-plugin bind mount: 6.8 should stay clean for false-positive baselining.
    networks:
      - default

  # One-shot installer: runs `wp core install` and creates admin/admin on each box.
  matrix-install:
    image: wordpress:cli
    container_name: wpvl-matrix-install
    depends_on:
      - wp52
      - wp53
      - wp61
      - wp68
    user: "33:33"
    entrypoint: ["/bin/sh", "-c"]
    command: >
      "for target in wp52:31352 wp53:31353 wp61:31361 wp68:31368; do
         host=\\\$(echo \\\$target | cut -d: -f1);
         port=\\\$(echo \\\$target | cut -d: -f2);
         echo Installing \\\$host on internal port 80;
         until wp --path=/var/www/html --allow-root --url=http://\\\${host} core is-installed 2>/dev/null; do
           wp --path=/var/www/html --allow-root --url=http://\\\${host} core install \
             --title=\\\"wpvulnlab-\\\${host}\\\" \
             --admin_user=admin --admin_password=admin --admin_email=admin@wpvulnlab.local \
             --skip-email || sleep 3;
         done;
       done"
    volumes:
      - wp52-data:/var/www/html
    restart: "no"
    networks:
      - default

volumes:
  wp52-data:
  wp53-data:
  wp61-data:
  wp68-data: