## https://sploitus.com/exploit?id=8C0198AE-4C8B-5087-8890-C1B0700E4A92
# CVE-2013-2028 Exploit
## Vulnerability Details
**Vulnerable software:** Nginx 1.3.9
**Vulnerable function:** `ngx_http_parse_chunked`
CVE-2013-2028 is an integer overflow vulnerability in Nginx's HTTP chunked transfer encoding parser. Under the conditions targeted by this laboratory environment, the vulnerability can result in memory corruption and can be used to influence control flow.
This repository provides an isolated Docker-based environment for studying the vulnerability and reproducing the exploitation workflow.
## Exploitation Details
The complete exploit consists of four main phases:
1. **Stack canary recovery**
Recover the stack canary through byte-by-byte probing.
2. **Memory protection manipulation**
Calculate the relevant address information and construct the required control-flow sequence to invoke `mprotect` on the controlled memory region.
3. **Shellcode placement**
Copy the payload into the controlled memory region.
4. **Control-flow transfer**
Transfer execution to the controlled memory region.
The complete exploit demonstrates the progression from triggering the vulnerable parser through memory corruption and control-flow manipulation to controlled code execution.
## Requirements
* Docker
* Docker Compose
* Python 3
* The Python dependencies required by `exploit.py`
* `netcat` for the listener used by the complete lab
## How to Reproduce
### 1. Start the Listener
On the host system, start a listener on the configured port:
```bash
nc -lvp 4345
```
Use the same port with the `--listenerport` (`-lp`) argument when running the exploit.
### 2. Start the Vulnerable Nginx Container
Build and start the Docker environment:
```bash
sudo docker-compose up --build
```
The vulnerable target runs Nginx 1.3.9 inside the container.
You can verify the Nginx version with:
```bash
docker-compose exec cve-2013-2028 /usr/local/nginx/sbin/nginx -v
```
### 3. Run the Complete Exploit
Run:
```bash
python3 exploit.py \
-ra 127.0.0.1 \
-rp 8081 \
-la \
-lp
```
The exploit performs the canary-recovery and payload-construction stages before sending the final payload to the vulnerable target.
If a previously recovered canary is available, it can be supplied using:
```bash
python3 exploit.py \
-ra 127.0.0.1 \
-rp 8081 \
-la \
-lp \
-c ''
```
### 4. Intermediate Task
The repository also provides an intermediate task for evaluating progress through the vulnerability-research workflow.
Run:
```bash
python3 intermediate_task.py \
-ra 127.0.0.1 \
-rp 8081 \
-la \
-lp
```
The intermediate task performs its checks directly against the running Docker target. It does not rely on manually created evidence files or manually supplied JSON assertions.
The task verifies two areas:
#### Vulnerability Identification
The task:
* Confirms that the target container is running.
* Detects the installed Nginx version.
* Determines whether the detected version corresponds to the vulnerable Nginx release used by the lab.
#### Configuration Validation
The task:
* Confirms that the Docker container is running.
* Confirms that Nginx is running.
* Validates the Nginx configuration using `nginx -t`.
The configuration check establishes that the Nginx configuration is syntactically valid. It should not by itself be interpreted as proof that CVE-2013-2028 has been mitigated.
Example output:
```text
============================================================
CVE-2013-2028 INTERMEDIATE TASK
============================================================
Target:
nginx running: True
nginx version: 1.3.9
vulnerable build: True
Progress:
[x] vulnerability_identified
[x] configuration_validated
All required checks completed.
Exercise complete.
```
The intermediate task stores the results of these runtime checks in:
```text
grader_state.json
```
This file is used only to persist the state produced by the checks. It is not the source of the vulnerability determination.
## Docker Target
The laboratory environment intentionally uses **Nginx 1.3.9**, an old Nginx release affected by CVE-2013-2028.
The Docker environment provides an isolated target for vulnerability research and exploitation exercises. The vulnerable service should be accessed only through the interfaces exposed by the laboratory configuration.
## Disclaimer
This repository is intended solely for educational and authorized security-research purposes in an isolated laboratory environment.
Do not run the exploit against systems that you do not own or do not have explicit authorization to test.