Published: 20/07/2013 Updated: 10/11/2021

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 772

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 up to and including 1.4.0 allows remote malicious users to cause a denial of service (crash) and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness error and a stack-based buffer overflow.

Vulnerable Product	Search on Vulmon	Subscribe to Product
f5 nginx
fedoraproject fedora 19

Nginx versions 139 through 140 suffer from a denial of service vulnerability ...

# Exploit Title: nginx v139-140 DOS POC (CVE-2013-2028) # Google Dork: CVE-2013-2028 # Date: 16052013 # Exploit Author: Mert SARICA - mert [ ] sarica [ @ ] gmail [ ] com - wwwmertsaricacom # Vendor Homepage: nginxorg/ # Software Link: nginxorg/download/nginx-140targz # Version: 139-140 # Tested on: Kali Li ...

#nginx 139/140 x86 brute force remote exploit # copyright (c) 2013 kingcope #---------------------------- #fix for internet exploitation, set MTU: #ifconfig <interface> mtu 60000 up # ### # !!! WARNING !!! # this exploit is unlikely to succeed when used against remote internet hosts # the reason is that nginx uses a non-blocking read() ...

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # web site for more information on licensing and terms of use # metasploitcom/ ## require 'msf/core' class Metasploit4 < Msf::Exploit::Remote include Exploit::Remote::Tcp def initiali ...

nginx <= 140 exploit for CVE-2013-2028 by sorbo Fri Jul 12 14:52:45 PDT 2013 /broprb 127001 for remote hosts: /fragsh ip /broprb ip rm statebin when changing host (or relaunching nginx with canaries) scanpy will find servers, reading IPs from ipstxt This is a generic exploit for 64-bit nginx which uses a new attack technique ...

For the analysis of CVE-2013-2028

nginx-140 For the analysis of CVE-2013-2028 exploit: exp-nginxrb binary (for rop build): nginx

Exploitation Training -- CVE-2013-2028: Nginx Stack Based Buffer Overflow

Exploitation Training -- CVE-2013-2028: Nginx Stack Based Buffer Overflow This repository contains the nginx 140 source code as well as precompiled binaries (with and without stack cookies) There's also a Vagrantfile for easy setup Announcement and patch: mailmannginxorg/pipermail/nginx-announce/2013/000112html Bug writeup: wwwvnsecuritynet/research/

non-controlflow-hijacking-datasets Introduction The aim of this readme file is introducing a dataset for utilizing low-level hardware information to detect Non-Control-Flow hijacking attacks Multiple traditional techniques have been proposed to defend computing systems against malware attacks that hijack the control-flow of the victim program (control-oriented attacks) Howeve

A CVE-2013-2028 implementation

This is a tool that uses an exploit called CVE-2013-2028 to excecute a bind shell on the target server that's running Nginx 139 or 140 It can be downloaded here (you will need to run it from the command line) Usage: nginxhack [target] [target port] [target bind port]

CVE-2013-2028 python exploit

CVE-2013-2028 Exploit Vulnerability details Vulnerable software: Nginx 139 < 140 Commit with fix: githubcom/nginx/nginx/commit/4997de8005630664ab35f27140e2077e818b21a7 Vulnerability exists in function ngx_http_parse_chunked This exploit triggers integer overflow in ngx_http_parse_chunked, and later using it overflows the stack to hijack control flow Exploi

Cyber Security Researcher Mert SARICA's Python codes (https://www.hack4career.com)

hack4career Homepage: wwwhack4careercom Description: Cyber Security Researcher Mert SARICA's Python codes Article: Malicious Image (December 1, 2022 @ 09:00) URL: wwwhack4careercom/malicious-image/ Tool: Decodes malicious PowerShell scripts encoded with Invoke-PSImage Article: Stolen Credit Card Hunt (March 1, 2022 @ 09:00) URL: wwwhack4career

Zeus Software Defender

Zeus can successfully mitigate real world cyber security attacks reported in CVE (Common Vulnerabilities and Exposures) Followings illustrate some demos regarding Zeus defense against real world cyber security attacks reported in CVE Zeus Defense Demo against Code Pointer Attack I Link: wwwyoutubecom/watch?v=1HL8bQ21_qs&feature=youtube CVE-2013-2028: Nginx

CWE-787 http://www.vnsecurity.net/2013/05/analysis-of-nginx-cve-2013-2028/http://www.osvdb.org/93037 http://nginx.org/download/patch.2013.chunked.txt https://github.com/rapid7/metasploit-framework/pull/1834 http://packetstormsecurity.com/files/121675/Nginx-1.3.9-1.4.0-Denial-Of-Service.html http://mailman.nginx.org/pipermail/nginx-announce/2013/000112.html http://security.gentoo.org/glsa/glsa-201310-04.xml http://secunia.com/advisories/55181 http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105176.html http://www.securityfocus.com/bid/59699 https://nvd.nist.gov https://packetstormsecurity.com/files/121675/Nginx-1.3.9-1.4.0-Denial-Of-Service.html https://github.com/danghvu/nginx-1.4.0 https://www.exploit-db.com/exploits/25499/

CVE-2013-2028

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect