Full Chain Vulnerability Testbed: Nginx RCE → GhostLock LPE

Overview

This repository provides a Vagrant environment designed to demonstrate a complete two-stage exploitation chain. The testbed automatically provisions an isolated Ubuntu 22.04 LTS virtual machine that is intentionally configured to be vulnerable to the following CVEs:

1. Initial Access: CVE-2026-42533 — Nginx PCRE capture-clobbering vulnerability leading to Remote Code Execution (RCE).
2. Privilege Escalation: CVE-2026-43449 (GhostLock) — Linux kernel Local Privilege Escalation (LPE) vulnerability allowing an unprivileged user to obtain root privileges.

The environment is intended for exploit development, automated penetration testing, security research, and educational use within an isolated lab.

Technical Details

Environment Architecture

The provisioning script configures the machine to support a complete attack chain consisting of remote code execution followed by local privilege escalation.

Stage 1 — Nginx Initial Access (CVE-2026-42533)

The provisioning process configures a vulnerable Nginx server in:

/etc/nginx/sites-available/default

The configuration intentionally triggers the vulnerable code path by forcing Nginx to evaluate a PCRE map directive during a VALUE pass. This corrupts the shared r->captures state, resulting in a heap buffer overflow that can be leveraged to obtain code execution as the www-data user.

Stage 2 — GhostLock Privilege Escalation (CVE-2026-43449)

To preserve the vulnerable kernel required for GhostLock, the provisioning process:

• Disables the unattended-upgrades service.
• Prevents automatic kernel upgrades.
• Freezes the installed kernel packages using apt-mark hold.

This ensures the VM remains in a reproducible vulnerable state for privilege escalation research.

After obtaining an initial foothold through the Nginx vulnerability, researchers can execute a GhostLock exploit to elevate privileges to root.

Usage

Start the environment with:

vagrant up

After provisioning completes, the target machine will be available at:

192.168.56.10

Attack Workflow

The intended evaluation workflow is:

1. Exploit the vulnerable Nginx service to obtain remote code execution.
2. Gain an initial shell as the www-data user.
3. Execute the GhostLock local privilege escalation exploit.
4. Obtain root privileges on the target system.

Intended Use

This testbed is intended for:

• AI-assisted penetration testing benchmarks
• Automated exploit validation
• Local privilege escalation research
• Red team training
• Security education
• Capture-the-Flag (CTF) and HTB-style practice

Warning: This environment intentionally contains vulnerable software and disables automatic security updates. Deploy and use it only within isolated laboratory or virtualized environments.