# README
Talk is cheap, just look at the code.
Detailed can be found at https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities
## Usage
1. Change the ip in `shell.c`
2. Check the docker is available and run `make shell.so`. (We need to build so in alpine to make sure it can works in nginx-ingress-controller which is base on musl-libc)
3. Run `python3 exploit.py` to get your shell.
> You may need to change the range at line 25 and 26, which indicates the range of the pid and fd. The default value is a compromise between the speed and the success rate.
> You can get the target value by running `kpexec -n ingress-nginx ingress-nginx-controller-xxxxxxxxx-xxxxx -it -- bash` to get into container by root and run `ls -ahl /proc/*/fd/* | grep body` in container, when you are in proofing env.
[4.0K] /data/pocs/c44039e0f75baeb9b97cd720e1342426add28046
├── [ 328] build.sh
├── [2.2K] exploit.py
├── [ 100] Makefile
├── [ 183] pyproject.toml
├── [ 812] README.md
├── [1.8K] req.json
├── [ 425] req.yaml
├── [ 728] shell.c
├── [2.4K] shell.o
├── [1.6K] shell.S
├── [ 10K] shell.so
└── [5.3K] uv.lock
0 directories, 12 files