# What Is nginx-ingress/exploit.go? Core Functions of the IngressNightmare Exploit

> Discover the core functions of nginx-ingress/exploit.go for IngressNightmare CVE-2025-1974. This Go file orchestrates RCE attacks on NGINX Ingress controllers via a two-phase upload-and-trigger method.

- Repository: [Esonhugh Skyworship/ingressnightmare-cve-2025-1974-exps](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps)
- Tags: internals
- Published: 2026-03-01

---

**The [`nginx-ingress/exploit.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/nginx-ingress/exploit.go) file implements the primary payload delivery, webhook manipulation, and orchestration logic for the IngressNightmare proof-of-concept (CVE-2025-1974), enabling remote code execution on vulnerable NGINX Ingress controllers through a two-phase upload-and-trigger attack pattern.**

The [`nginx-ingress/exploit.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/nginx-ingress/exploit.go) module serves as the central exploitation engine within the `esonhugh/ingressnightmare-cve-2025-1974-exps` repository. This Go source file drives the complete attack lifecycle against Kubernetes NGINX Ingress controllers by coordinating the delivery of malicious shared objects and their subsequent execution via crafted AdmissionReview requests.

## Payload Delivery Mechanisms

The file provides multiple low-level primitives to upload malicious `.so` files to the target controller's writable storage.

### Raw TCP and TLS Upload Functions

At lines 24–34, the `BadUploadHTTP` and `BadUploadHTTPS` functions establish raw TCP or TLS connections to the target URL. These functions bypass standard HTTP client libraries to manually control connection lifecycles, providing the granular timing control necessary for the race-condition-dependent exploit.

### Manual HTTP POST Construction

The `BadUploader` function (lines 52–85) constructs a manually crafted HTTP `POST` request with a hardcoded **1 MiB `Content-Length`** header. It streams the malicious payload directly over the wire, avoiding automatic chunked encoding or headers that might interfere with the target's file handling. This method targets endpoints that accept direct file uploads to `/tmp` or similar directories.

### Alternative Client Implementation

For environments where raw socket manipulation is unnecessary, the `Uploader` function (lines 94–104) provides an alternative delivery method using the third-party **gout** HTTP client. This offers a higher-level abstraction while maintaining compatibility with the exploit's payload requirements.

### Concurrent Upload Loop

The `UploadThread` routine (lines 106–118) executes uploads in a tight concurrent loop, continuously sending the payload until explicitly stopped via a Go channel. This saturation strategy ensures the malicious file remains resident in the target's temporary storage while the webhook-triggering phase executes.

## Webhook Abuse and AdmissionReview Manipulation

The second major capability involves crafting malicious Kubernetes AdmissionReview requests that force the ingress controller to load the uploaded shared library via directory traversal.

### Exploit Configuration Structure

The `ExploitMethod` struct (lines 21–26) encapsulates attack parameters including **TLS Common Name matching**, **secret-based authentication**, **URL-based authentication**, and **UID mirroring** options. These fields configure authentication against the target webhook endpoint, allowing the exploit to bypass validation checks that verify request origin.

### JSON Template Rendering

At lines 39–51, the `RenderValidateJSON` function processes the embedded [`validate.json`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/validate.json) template. It replaces the `foobar` placeholder string with a malicious path traversal sequence (e.g., `../../../../..../proc/<pid>/fd/<fd>`), constructing a valid AdmissionReview object that references the uploaded file descriptor through procfs.

### Webhook Validation Attack

The `ValidateWebhookSpecificFilePath` (lines 59–102) and `ValidateWebHook` (lines 104–145) functions transmit the crafted AdmissionReview objects to the target webhook endpoint. These functions parse the HTTP response body, searching for the success indicator **"Code Injected!"** or specific error messages to determine if the shared library was successfully loaded and executed by the controller process.

## Concurrent Exploit Orchestration

The `Exploit` function (lines 61–96) coordinates the complete attack sequence across configurable **process ID (`pid`)** and **file descriptor (`fd`)** ranges. It launches the `UploadThread` to maintain the payload in memory while systematically iterating through potential `/proc/<pid>/fd/<fd>` paths via the webhook validation functions. Upon detecting a successful injection response, the function immediately signals the upload channel to stop, terminating the concurrent workers and completing the exploitation chain.

## Practical Implementation Examples

### Example 1: Direct Payload Upload

Execute a simple one-shot upload using the raw HTTP uploader:

```go
import (
    "github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/nginx-ingress"
)

func main() {
    // `payload` holds the compiled .so binary (type alias defined in payload.go)
    var p nginx_ingress.Payload = loadSO("danger.so")
    // Direct upload to the vulnerable Ingress service
    err := nginx_ingress.BadUploader("http://target-ingress.example.com/upload", p)
    if err != nil {
        log.Fatalf("upload failed: %v", err)
    }
    log.Println("payload uploaded")
}

```

### Example 2: Full Exploit Loop

Coordinate the concurrent uploader and webhook validator across fd/pid ranges:

```go
import (
    "github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/nginx-ingress"
)

func main() {
    webhook := "https://target-ingress.example.com/validate"
    upload  := "http://target-ingress.example.com/upload"
    payload := loadSO("danger.so")                     // see payload.go for helper
    // Scan fd 0-255 and pid 1-500 (adjust ranges for your environment)
    nginx_ingress.Exploit(webhook, upload, payload,
        0,   // fdRangeStart
        1,   // pidRangeStart
        256, // fdRangeEnd
        500) // pidRangeEnd
}

```

### Example 3: Single Path Admission Test

Validate a specific file path against the webhook without full orchestration:

```go
nginx_ingress.OnlyAdmissionRequest(
    "https://target-ingress.example.com/validate",
    "/etc/kubernetes/manifests/evil.yaml", // arbitrary path to test
)

```

## Summary

- **[`nginx-ingress/exploit.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/nginx-ingress/exploit.go)** is the core exploitation driver for CVE-2025-1974 in the IngressNightmare repository, implementing the complete attack chain.
- **Payload delivery** combines raw socket manipulation (`BadUploadHTTP`/`BadUploadHTTPS`), manual HTTP construction (`BadUploader`), and concurrent upload loops (`UploadThread`) to place malicious `.so` files on the target controller.
- **Webhook abuse** functions (`RenderValidateJSON`, `ValidateWebhookSpecificFilePath`) craft AdmissionReview objects with path traversal payloads to force the controller to load the uploaded library from procfs file descriptors.
- **Orchestration** via the `Exploit` function coordinates concurrent upload and validation threads, scanning ranges of file descriptors and process IDs to locate the uploaded payload in memory and trigger execution.

## Frequently Asked Questions

### What is the primary function of nginx-ingress/exploit.go?

The file serves as the main exploitation engine implementing the IngressNightmare attack chain for CVE-2025-1974. It provides the programmatic interface for uploading malicious shared objects to vulnerable NGINX Ingress controllers and triggering their execution through crafted Kubernetes AdmissionReview requests targeting the validation webhook.

### How does the payload delivery system work in exploit.go?

The implementation offers three delivery mechanisms: `BadUploadHTTP` and `BadUploadHTTPS` for raw TCP/TLS connections, `BadUploader` for manually crafted HTTP POST requests with a 1 MiB Content-Length, and `Uploader` using the gout client library. The `UploadThread` function runs these uploads in a continuous loop to ensure the payload persists in the target's temporary storage during the attack window.

### What role does the AdmissionReview webhook play in the exploit?

The webhook functions as the trigger mechanism. `RenderValidateJSON` generates a malicious AdmissionReview request by substituting the `foobar` placeholder with a directory traversal path (e.g., `../../../../..../proc/<pid>/fd/<fd>`). When the ingress controller processes this request via `ValidateWebhookSpecificFilePath`, it attempts to load the referenced file descriptor as a shared library, executing the attacker's code if successful.

### How does the Exploit function coordinate the attack?

The `Exploit` function manages concurrent goroutines, launching an upload thread to maintain the payload while systematically testing combinations of process IDs and file descriptors through the webhook validation endpoint. It monitors responses for the "Code Injected!" success indicator and immediately terminates the upload loop upon successful exploitation, preventing unnecessary network traffic while ensuring reliable code execution.