Off-by-One Memory Overwrite in nginx ngx_resolver_copy()

This repository contains three Python proof-of-concept (PoC) scripts (poc.py, poc2.py, poc3.py) targeting CVE-2021-23017, a critical vulnerability in NGINX's DNS resolver (versions 0.6.18–1.20.0). The exploit aims to cause a Denial of Service (DoS) by sending specially crafted DNS responses with an excessively long domain name, triggering a buffer overflow and crashing the NGINX server. - The scripts use the scapy library to sniff for DNS queries from the target and respond with malicious DNS packets. They also use curl and dig to trigger DNS queries from the target to the attacker's DNS server. - poc.py is a basic PoC that listens for DNS queries and sends malicious responses. - poc2.py adds direct DNS packet sending, subnet checking, and triggers DNS queries using both curl and dig. It also sets the system resolver to the attacker's DNS server. - poc3.py is the most advanced, running all attack components in parallel (sniffing, sending malicious DNS, and triggering queries) for maximum efficiency and firewall evasion. The repository includes a README with detailed setup and usage instructions, including configuring dnsmasq and verifying the attack's success. The exploit is operational and can reliably crash vulnerable NGINX servers if the attacker can control or spoof DNS responses to the target. The main fingerprintable endpoint is the long domain name used in the attack, and the exploit requires network access to the target's DNS traffic.

This repository contains a single Python script that demonstrates a proof-of-concept exploit for CVE-2021-23017, a heap corruption vulnerability in Nginx 1.14's DNS resolver. The script acts as a UDP server on port 1053, waiting for incoming DNS requests. Upon receiving a request, it parses the DNS query and crafts a malicious CNAME response with a specially constructed payload (a long string of 'A's) designed to trigger the vulnerability in the target Nginx server. The script is self-contained, does not require external dependencies, and is intended for local testing or demonstration of the vulnerability. No hardcoded external endpoints are present, but the script itself listens on all interfaces (0.0.0.0) and port 1053. The exploit is a POC and does not provide a shell or advanced post-exploitation capabilities.

This repository is a proof-of-concept (POC) exploit for CVE-2021-23017, a vulnerability in nginx's DNS resolver. The exploit targets nginx instances configured with the 'resolver' directive and relies on the attacker's ability to spoof UDP packets from the DNS server. The main script, 'poc.py', uses Python and the Scapy library to perform ARP poisoning between the target and its DNS server, intercept DNS requests, and send a specially crafted DNS response designed to trigger a 1-byte memory overwrite in nginx. The exploit requires network access to the target and the ability to manipulate ARP and DNS traffic. The repository includes a README describing the vulnerability, the exploit script, and a requirements file specifying the Scapy dependency. No hardcoded IP addresses or domains are present; the script takes the target and DNS server IPs as arguments. The exploit demonstrates the vulnerability's impact (potential crash or other effects) but does not provide a weaponized or post-exploitation payload.

This repository is a proof-of-concept (PoC) exploit for CVE-2021-23017, a DNS parsing vulnerability in NGINX. The main file, 'poc.py', is a Python script that uses Scapy to perform ARP poisoning between a target and its DNS server, allowing the attacker to intercept and modify DNS traffic. Once the ARP poisoning is successful, the script listens for DNS requests from the target and injects a specially crafted DNS response designed to trigger the vulnerability. The exploit requires the attacker to have network access to both the target and its DNS server. The repository also includes a README with usage instructions and a requirements.txt specifying the Scapy dependency. No hardcoded IP addresses are present in the code; the user must supply them as arguments. The exploit demonstrates the vulnerability but does not provide a weaponized or fully automated attack chain.