shell弹不出来

[bansh2eBreak]

[atmozphera]

The PoC won't work because the included docker image here, will retrieve a commit (98fc3bb78) from the Nginx version that already has the patch (1.31.0), and what you need to test is a commit (inside the container) from version 1.30.0. You need to rebuild the image (Dockerfile) with version 1.30.0 (not to be confused with version 1.30.1, which also already has the patch too).

1.30.0 = vulnerable
1.30.1 = patched
1.31.0 = patched

to rebuild a docker container image:

docker run -d --name nginx-vuln -p 19321:80 ubuntu:22.04 bash -c "
apt-get update && apt-get install -y wget build-essential libpcre3-dev libssl-dev zlib1g-dev &&
cd /tmp &&
wget https://nginx.org/download/nginx-1.30.0.tar.gz &&
tar xzf nginx-1.30.0.tar.gz &&
cd nginx-1.30.0 &&
./configure &&
make -j$(nproc) &&
make install &&
cat > /usr/local/nginx/conf/nginx.conf << 'EOF'
worker_processes 1;
events { worker_connections 1024; }
http {
server {
listen 80;
location / {
rewrite ^/users/([0-9]+)/profile/(.*)$ /profile.php?id=$1&tab=$2 last;
}
location /profile.php {
set $test $1;
return 200 ok;
}
}
}
EOF
/usr/local/nginx/sbin/nginx -g 'daemon off;'
"

[jikui]

@atmozphera Your solution does not work either. The container exits after a while without sending any traffics.