Talk is cheap, just look at the code.
Detailed can be found at https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities
- Change the ip in
shell.c - Check the docker is available and run
make shell.so. (We need to build so in alpine to make sure it can works in nginx-ingress-controller which is base on musl-libc) - Run
python3 exploit.pyto get your shell.
You may need to change the range at line 25 and 26, which indicates the range of the pid and fd. The default value is a compromise between the speed and the success rate. You can get the target value by running
kpexec -n ingress-nginx ingress-nginx-controller-xxxxxxxxx-xxxxx -it -- bashto get into container by root and runls -ahl /proc/*/fd/* | grep bodyin container, when you are in proofing env.