lfi2rce-via-nginx-temp-files.md (7137B)
1 --- 2 title: "LFI2RCE via Nginx temp files" 3 section: "Web Pentesting" 4 sectionSlug: "pentesting-web" 5 sourcePath: "src/pentesting-web/file-inclusion/lfi2rce-via-nginx-temp-files.md" 6 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/file-inclusion/lfi2rce-via-nginx-temp-files.md" 7 sha: "188de82beb54e70956b2952367a0af91d26758b8" 8 isIndex: false 9 modified: true 10 license: "CC-BY-NC-4.0" 11 --- 12 13 # LFI2RCE via Nginx temp files 14 15 ## Vulnerable configuration 16 17 The original nginx-assisted LFI research showed that even the following one-liner is enough when PHP runs behind an nginx reverse proxy that buffers request bodies to disk:<sup>[[1]](#references)</sup> 18 19 ```php 20 <?php 21 $action = $_GET['action'] ?? 'read'; 22 $path = $_GET['file'] ?? 'index.php'; 23 $action === 'read' ? readfile($path) : include $path; 24 ``` 25 26 The nginx side typically keeps default temp paths such as `/var/lib/nginx/body` and `/var/lib/nginx/fastcgi`. When a request body or upstream response is larger than the in-memory buffer (≈8 KB by default), nginx transparently writes the data to a temp file, keeps the file descriptor open, and only unlinks the file name. Any PHP `include` that follows symbolic links (like `/proc/<pid>/fd/<fd>`) can still execute the unlinked contents, giving you RCE through LFI.<sup>[[1]](#references)</sup> 27 28 ## Why nginx temp files are abusable 29 30 * Request bodies that exceed the buffer threshold are flushed to `client_body_temp_path` (defaults to `/tmp/nginx/client-body` or `/var/lib/nginx/body`). 31 * The file name is random, but the file descriptor remains reachable under `/proc/<nginx_pid>/fd/<fd>`. As long as the request body has not completed (or you keep the TCP stream hanging), nginx keeps the descriptor open even though the path entry is unlinked. 32 * PHP’s include/require resolves those `/proc/.../fd/...` symlinks, so an attacker with LFI can hop through procfs to execute the buffered temp file even after nginx deletes it.<sup>[[1]](#references)</sup> 33 34 ## Classic exploitation workflow (recap) 35 36 1. **Enumerate worker PIDs.** Fetch `/proc/<pid>/cmdline` over the LFI until you find strings like `nginx: worker process`. The number of workers rarely exceeds the CPU count, so you only have to scan the lower PID space. 37 2. **Force nginx to create the temp file.** Send very large POST/PUT bodies (or proxied responses) so that nginx spills to `/var/lib/nginx/body/XXXXXXXX`. Make sure the backend never reads the entire body—e.g., keep-alive the upload thread so nginx keeps the descriptor open. 38 3. **Map descriptors to files.** With the PID list, generate traversal chains such as `/proc/<pidA>/cwd/proc/<pidB>/root/proc/<pidC>/fd/<fd>` to bypass any `realpath()` normalization before PHP resolves the final `/proc/<victim_pid>/fd/<interesting_fd>` target. Brute-forcing file descriptors 10–45 is usually enough because nginx reuses that range for body temp files. 39 4. **Include for execution.** When you hit the descriptor that still points to the buffered body, a single `include` or `require` call runs your payload—even though the original filename has already been unlinked. If you only need file read, switch to `readfile()` to exfiltrate the temporary contents instead of executing them.<sup>[[1]](#references)</sup> 40 41 ## Modern variations (2024–2025) 42 43 Ingress controllers and service meshes now routinely expose nginx instances with additional attack surface. CVE-2025-1974 ("IngressNightmare") is a good example of how the classic temp-file trick evolves:<sup>[[2]](#references)</sup><sup>[[3]](#references)</sup> 44 45 * Attackers push a malicious shared object as a request body. Because the body is >8 KB, nginx buffers it to `/tmp/nginx/client-body/cfg-<random>`. By intentionally lying in the `Content-Length` header (e.g., claiming 1 MB and never sending the last chunk) the temp file remains pinned for ~60 seconds. 46 * The vulnerable ingress-nginx template code allowed injecting directives into the generated nginx config. Combining that with the lingering temp file made it possible to brute-force `/proc/<pid>/fd/<fd>` links until the attacker discovered the buffered shared object. 47 * Injecting `ssl_engine /proc/<pid>/fd/<fd>;` forced nginx to load the buffered `.so`. Constructors inside the shared object yielded immediate RCE inside the ingress controller pod, which in turn exposed Kubernetes secrets. 48 49 A trimmed-down reconnaissance snippet for this style of attack looks like: 50 51 <details> 52 <summary>Quick procfs scanner</summary> 53 54 ```python 55 #!/usr/bin/env python3 56 import os 57 58 def find_tempfds(pid_range=range(100, 4000), fd_range=range(10, 80)): 59 for pid in pid_range: 60 fd_dir = f"/proc/{pid}/fd" 61 if not os.path.isdir(fd_dir): 62 continue 63 for fd in fd_range: 64 try: 65 path = os.readlink(f"{fd_dir}/{fd}") 66 if "client-body" in path or "nginx" in path: 67 yield pid, fd, path 68 except OSError: 69 continue 70 71 for pid, fd, path in find_tempfds(): 72 print(f"use ?file=/proc/{pid}/fd/{fd} # {path}") 73 ``` 74 75 </details> 76 77 Run it from any primitive (command injection, template injection, etc.) you already have. Feed the discovered `/proc/<pid>/fd/<fd>` paths back into your LFI parameter to include the buffered payload. 78 79 ## Practical tips 80 81 * When nginx disables buffering (`proxy_request_buffering off`, `client_body_buffer_size` tuned high, or `proxy_max_temp_file_size 0`), the technique becomes much harder—so always enumerate config files and response headers to check whether buffering is still enabled. 82 * Hanging uploads are noisy but effective. Use multiple processes to flood workers so that at least one temp file stays around long enough for your LFI brute force to catch it. 83 * In Kubernetes or other orchestrators, privilege boundaries may look different, but the primitive is the same: find a way to drop bytes into nginx buffers, then walk `/proc` from anywhere you can issue file system reads. 84 85 ## Labs 86 87 - The original downloadable lab archive.<sup>[[4]](#references)</sup> 88 - Two 2021 challenge instances preserved as historical lab targets.<sup>[[5]](#references)</sup><sup>[[6]](#references)</sup> 89 90 ## References 91 92 - [1] [PHP LFI with nginx assistance](https://bierbaumer.net/security/php-lfi-with-nginx-assistance/) 93 - [2] [IngressNightmare: CVE-2025-1974 - 9.8 Critical Unauthenticated Remote Code Execution Vulnerabilities in Ingress NGINX](https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities) 94 - [3] [IngressNightmare (CVE-2025-1974) Remote Code Execution Vulnerability Remediation](https://www.opswat.com/blog/ingressnightmare-cve-2025-1974-remote-code-execution-vulnerability-remediation) 95 - [4] [PHP LFI with nginx assistance - lab archive](https://bierbaumer.net/security/php-lfi-with-nginx-assistance/php-lfi-with-nginx-assistance.tar.xz) 96 - [5] [2021 CTF challenge - nginx LFI lab 1](https://2021.ctf.link/internal/challenge/ed0208cd-f91a-4260-912f-97733e8990fd/) 97 - [6] [2021 CTF challenge - nginx LFI lab 2](https://2021.ctf.link/internal/challenge/a67e2921-e09a-4bfa-8e7e-11c51ac5ee32/)