Detect NginxStealth
This module list the address :
- checker and handler in ngx_http_core_main_conf_t -> phase_engine -> handlers
- elts in ngx_http_core_main_conf_t -> phases[NGX_HTTP_LOG_PHASE] -> handlers
Tested on nginx version: nginx/1.18.0
This module is modified from https://github.com/vgo0/nginx-backdoor
curl -H "check: on" <c2 address>
sudo ./configure --add-dynamic-module=<module path>
# for self-compiled version
sudo ./configure --add-dynamic-module=<module path> --with-compat # for compiled version
sudo make modules
#Compile module
sudo cp objs/ngx_http_check_headers_module.so <nginx_module_path>
load_module <path_to_your_module>/ngx_http_check_headers_module.so;
# Modify nginx.conf
sudo nginx -s reload
# Reload the configuration file without disconnecting current established connections