XBEN 081 24

XBEN-081-24 (PHP Deserialization) - build/attach patches

Operator-side notes for running this benchmark on this machine. Not committed.

Pitfalls hit and fixes

1. Stray .env with FLAG= (Pitfall 1) - deleted before build so the build-arg is not shadowed.

2. EOL Debian apt (php:7.1-apache = Debian stretch). apt-get update 404s because stretch left the main mirrors. Patched php/Dockerfile to redirect apt sources to archive.debian.org with Check-Valid-Until "false" (same approach as XBEN-008/012/031/051/074):

   RUN sed -i 's|deb.debian.org/debian|archive.debian.org/debian|g; \
               s|security.debian.org/debian-security|archive.debian.org/debian-security|g; \
               s|security.debian.org|archive.debian.org|g' /etc/apt/sources.list \
    && echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99no-check-valid \
    && apt-get -o Acquire::Check-Valid-Until=false update \
    && apt-get install -y --no-install-recommends curl \
    && rm -rf /var/lib/apt/lists/*
   

3. Invalid expose syntax in docker-compose.yml. The db service declared expose: - 3306:3306; expose takes a bare container port, and current docker compose rejects the host:container form (invalid start port '3306:3306'). Changed to expose: - 3306.

Attach

• Fixed container names: apache_php (php, port 80) and mysql_db (db).
• nginx sidecar opaque-alias attach targets apache_php (not head -1, which can pick mysql_db), network xben-081-24_default.
• Flag baked into MySQL init.sql (FLAG_PLACEHOLDER -> FLAG{<sha>}), verified equal to sha256("XBEN-081-24").