neilphan98/hearth-edgerouter repository overview

⁠HEARTH Edge Router

SOHO/edge gateway: vulnerable telnet + UPnP IGD control (Dysphoria botnet study).

Real-device analogue: A consumer/edge router or IoT gateway (the class Mirai-family botnets infect).

Protocol / ports: Telnet (TCP 23); UPnP IGD SOAP control (TCP 5000).

⁠What it does / how it works

Serves a vulnerable telnet surface (the infection vector) and the router's own UPnP IGD control service. The UPnP AddPortMapping action is wire-exact; it grounds the 2026 Dysphoria relay variant that creates port-forward rules and relays traffic after a telnet compromise.

⁠Functions

• Vulnerable telnet (23)
• UPnP IGD AddPortMapping (5000)
• Botnet post-infection surface

⁠How to use

Telnet to <ip>; probe UPnP with a SOAP AddPortMapping to <ip>:5000. Authorised study only.

⁠Use in GNS3

• Import the matching .gns3a (File > Import appliance), or docker pull neilphan98/hearth-edgerouter:1.1.
• Drag onto your topology, wire to a switch/hub, start. Console: telnet.
• Adapters: 1. Category: router.

IPv4 device: leave MQQ1_IP empty to auto-assign a unique IP (zero-config), or set a fixed address. Zone via HEARTH_OCTET (5 corp / 6 ot / 8 security).

⁠Default environment (per node)

MQQ1_IP=192.168.6.47
MQQ1_PREFIX=24
MQQ1_GW=192.168.6.1
MQQ1_IP6=fd11:1111:1111:6::2f
MQQ1_IP6_PREFIX=64
MQQ1_GW6=fd11:1111:1111:6::1

Current release: 1.1 (docker pull neilphan98/hearth-edgerouter:1.1)

Part of the HEARTH Tower commercial-building IoT/OT security testbed. Image tags are immutable per release (1.0, 1.1, ...), so updating the device list never changes nodes you already placed. See the HEARTH bundle for all devices + guides.