NGINX Rift

Repository contains a single substantive Python exploit tool, rift.py, plus documentation. The script is a standalone stdlib-only exploit framework for a heap buffer overflow in NGINX ngx_http_rewrite_module, combining reconnaissance and exploitation in one entry point. Based on the README and visible code, the workflow is: validate the target as NGINX over HTTP, fingerprint version and behavior, test likely vulnerable endpoints (default /api/), optionally look for information leaks and worker behavior, then perform exploitation by heap spraying crafted POST bodies containing a forged ngx_pool_cleanup_s structure and a command string, followed by a trigger request intended to overflow and overwrite a cleanup handler pointer. When the corrupted pool cleanup runs, it calls libc system() on the supplied command. The tool supports direct command execution and reverse shell delivery using python, bash, nc, or php payloads, and includes retry logic, candidate heap offsets, default heap/libc bases, and ASLR-oriented brute-force/sliding behavior. Fingerprintable observables include HTTP probing of /, use of /api/ as the default vulnerable endpoint, a described spray endpoint /spray, and listener/callback ports such as 4444. Overall, this is an actual exploit implementation rather than a detector, with operational payload capability but not obviously integrated into a larger exploitation framework.

This repository is a self-contained exploit lab and exploit script for CVE-2026-42945, described here as an nginx 1.30.0 ngx_http_rewrite_module heap buffer overflow on x86_64 Linux. The repo contains: (1) exp.py, the main Python exploit; (2) nginx.conf, which intentionally configures the vulnerable rewrite+set pattern and helper locations; (3) backend.py, a local HTTP delay service bound to 127.0.0.1:9000 that keeps upstream requests alive to stabilize heap spray timing; (4) Dockerfile and docker-compose.yml, which build and run an Ubuntu 22.04 + nginx 1.30.0 + PHP-FPM lab exposing port 80; and (5) minimal web content under www/public_html. The exploit capability is remote code execution. exp.py sprays nginx heap memory by sending multiple POST requests to /spray with 4000-byte bodies containing a forged ngx_pool_cleanup_s structure. That fake structure points its handler to libc system() and its data pointer to an attacker-controlled command string. The script then sends a crafted request to /api/... designed to trigger the rewrite-module overflow, overwriting memory beyond a URI buffer with a chosen 6-byte address into sprayed heap content. A separate victim/incomplete request is used so that when nginx destroys the corrupted request pool, the tampered cleanup handler executes system(cmd). The script includes helper logic for address safety checks against nginx argument escaping, candidate heap offsets, libc system() offsets for several Ubuntu/Debian glibc versions, worker liveness checks, retry loops, and optional lab/container-assisted address discovery. This is not merely a detector: it performs heap grooming, corruption, and payload delivery. It is best classified as OPERATIONAL rather than WEAPONIZED because it includes a real payload path (arbitrary command execution) but is tightly tailored to the included lab and specific target assumptions rather than being a generalized framework module.

Repository contains a single Python exploit script and a README. The script is a standalone operational RCE exploit for CVE-2026-42945 ('NGINX Rift'), targeting vulnerable NGINX rewrite processing. It is not a framework module. The exploit workflow is: (1) compute a system() address from supplied libc base and offset, (2) build a fake `ngx_pool_cleanup_s` structure plus attacker command inside a 4000-byte POST body, (3) spray that body to `POST /spray` across multiple connections, (4) send a crafted `GET /api/...` request containing 349 'A' bytes, 969 '+' bytes, and a 6-byte heap pointer candidate to trigger the heap overflow, and (5) infer success from worker crash/recovery behavior. If successful, the corrupted cleanup pointer causes `system(command)` execution when the pool is destroyed. The script supports direct command execution (`--cmd`) and reverse shell mode (`--shell`) with built-in listener support. Reverse shell payloads can be generated in bash, python3, or netcat form. The exploit is highly dependent on target memory layout assumptions: it requires vulnerable NGINX configuration, known or guessed heap/libc base addresses, and effectively assumes ASLR is disabled or bypassed. Repository structure is minimal: `README.md` documents vulnerability details, prerequisites, usage examples, and exploitation theory; `cve_2026_42945_rce_poc.py` implements the full exploit logic, listener, payload generation, liveness checks, and repeated heap candidate attempts.

Repository is a compact, self-contained exploit lab for chaining two nginx rewrite-engine vulnerabilities into ASLR-independent remote command execution against stock official nginx:1.30.0. Structure is simple: README.md documents the chain and usage; nginx.conf defines the intentionally vulnerable target configuration; run.sh launches a Dockerized nginx lab and a slow local upstream; exp_official.py performs the exploit. The main exploit logic is in exp_official.py. It first abuses the /search rewrite path to trigger the PoolSlip over-read and recover leaked heap/libc pointers from the reflected degraded search response. It then computes libc base, heap base, and libc system(). Next it uses repeated POST requests to /api/upload to spray heap chunks containing fake cleanup records and a command buffer. It opens and times multiple TCP connections to groom nginx connection pools, then sends a crafted GET to /api/v1/... to trigger the rift overflow and partially overwrite the low 2 bytes of a limit_conn cleanup pointer with URL-safe bytes only. Finally, by closing/freeing connections in a controlled order, nginx walks the corrupted cleanup list during pool destruction and invokes system(cmd). The exploit is operational rather than a mere PoC: it contains full leak, address derivation, heap spray, grooming, overwrite, and trigger stages, with a user-supplied command via --cmd. It is not framework-based. The target is specifically nginx OSS on Linux, demonstrated on Debian/glibc 2.41 in the official nginx:1.30.0 container. Fingerprintable target routes are /search, /lookup, /api/v1, /api/upload, and /healthz, with local upstreams at 127.0.0.1:8080 and 127.0.0.1:9200 in the lab.

This repository is a self-contained exploit lab and benchmark environment for CVE-2026-42945, described as a heap buffer overflow in nginx's ngx_http_rewrite_module. The main exploit is poc.py, a Python script that performs a network-based heap spray and trigger sequence against a specially configured nginx instance. It opens many delayed POST requests to /spray to shape heap allocations, then sends a crafted GET request to /api/<payload> where repeated '+' characters exploit a length/copy mismatch in rewrite/set processing. The payload body contains a fake structure and command string so that, on successful corruption, nginx calls system() with attacker-controlled input. The exploit supports either direct command execution (--cmd) or a Python reverse shell (--shell) that connects back to a listener. Repository structure: env/ contains the vulnerable lab environment. env/Dockerfile builds nginx 1.27.5 from a specific pre-patch commit (98fc3bb78). env/nginx.conf defines the vulnerable /api route, a fixed /api-safe route for comparison, and /spray plus /internal helper locations. env/server.py is a local backend on 127.0.0.1:19323 that intentionally delays responses to keep heap spray connections alive. env/entrypoint.sh starts the backend and launches nginx with ASLR disabled via setarch -R. docker-compose.yml exposes nginx on port 19321 and a Jupyter notebook on 8888. Supporting tooling: benchmark.py imports poc.py internals and repeatedly runs exploit attempts while sampling /proc memory data and tracking nginx worker restarts/crashes, then writes CSV output. benchmark_vulnerable.csv is an example output dataset. run.sh automates container build, health checks, PID discovery, benchmark execution against vulnerable and fixed routes, and CSV retrieval. Overall purpose: this is not just a detector; it is an operational PoC/lab for demonstrating crash behavior and RCE under tightly controlled conditions. The exploit is highly environment-dependent because it relies on fixed heap/libc addresses, disabled ASLR, tuned nginx pool sizes, and a matching vulnerable configuration.

Repository is a Python proof-of-concept exploit suite for CVE-2026-42945, described as an NGINX ngx_http_rewrite_module heap buffer overflow leading to unauthenticated RCE. The repo contains three main entry-point scripts plus helper tooling under tools/. The overall exploit strategy is consistent across variants: heap-spray attacker-controlled data with repeated POST requests to /spray, trigger the vulnerable rewrite path with a crafted GET /api/<payload>, corrupt nginx pool cleanup metadata, and redirect cleanup execution to libc system() with an attacker-supplied shell command. Main scripts: - nginx_rce_bypass_ASLR.py: compact exploit driver for ASLR-enabled targets. It builds fake cleanup structures, selects candidate heap offsets whose low bytes are URI-safe, performs liveness checks, sprays heap chunks, triggers the overflow, and optionally uses HTTP/2 victim traffic for heap shaping. It imports tools.coreless for integrated coreless exploitation support. - nginx_rce_off_ASLR.py: larger assessor/exploit for ASLR-disabled or stable-layout targets. It includes richer target assessment logic, configuration discovery, procfs/LFI handling, and exploit orchestration. README states this path can directly overwrite cleanup pointers with known offsets and trigger system() without remote memory disclosure. - nginx_vm_RCE.py: lab/container-oriented assessor/exploit for environments where LFI and same-UID procfs access are available. Similar to the ASLR-enabled/coreless path but tuned for Docker/test setups. Helper modules: - tools/poc.py: reusable low-level primitives shared by other scripts, including body construction, HTTP/2 frame creation, liveness checks, and the core spray/trigger attempt routine. - tools/lfi_mem_scan.py: standalone utility to exploit an HTTP LFI primitive, discover same-UID nginx workers, parse /proc maps, read /proc/<pid>/mem, and scan writable mappings for pool-like structures. - tools/coreless.py and tools/proc_mem_coreless.py: coreless exploitation helpers that use LFI-backed /proc/<pid>/mem reads to scan live worker memory for slot markers, cleanup pools, and candidate fake structure locations, then launch final exploit attempts and verify success via a marker file in /tmp. - tools/non_lfi_probe.py and tools/non_lfi_leak_probe.py: auxiliary probing scripts for non-LFI scenarios. They do not themselves deliver the full RCE chain; instead they test whether response corruption or passive memory disclosure can be observed through endpoints like /reflect_body, /reflect_header, /reflect_redirect, delayed /spray victims, and /api triggers. - tools/__init__.py re-exports helper functions and classes. Capabilities observed in code and README: - Remote heap spraying over HTTP POST. - Overflow triggering over crafted HTTP GET paths. - HTTP/2-based victim/request shaping using a custom extension frame type. - ASLR bypass/coreless exploitation through LFI access to /proc/<pid>/maps and /proc/<pid>/mem. - Live memory scanning for writable mappings, fake structure slots, and cleanup pools. - Arbitrary shell command execution via system(). - Proof-of-execution by redirecting command output to /tmp/nginx_rift_proc_mem_<random> and reading it back. - Optional reverse-shell style mode mentioned in README for the ASLR-off script. This is not merely a detector: it contains exploit logic, payload construction, memory scanning, and command-execution verification. Based on the included payload handling and hardcoded exploitation flow, maturity is best classified as OPERATIONAL rather than simple POC.

Repository is a full standalone exploit-and-research project for CVE-2026-42945 ('NGINX Rift'), a heap buffer overflow in NGINX ngx_http_rewrite_module caused by leaked is_args state across the rewrite engine’s two-pass evaluation. It is not tied to a common exploit framework. The repo contains: (1) a Docker lab that builds vulnerable and patched nginx variants and exposes a vulnerable listener on 19321 with helper backend on 19323; (2) exploit tooling under exploit/ including a crash trigger, HTTP/2 trigger, ASLR probing, heap/address helpers, worker monitoring, and a main exploit that performs heap spray, locates sprayed fake cleanup structures, patches memory in the lab, and attempts command execution via corrupted ngx_pool_cleanup handlers; (3) shell/ tooling that generates reverse shell payloads and verifies callbacks; (4) detection/ content including version/config scanners, ASLR checks, hardening guidance, and Falco/ModSecurity/Suricata rules; (5) patches/ with the upstream one-line fix and backports; (6) fuzz/ with a libFuzzer harness modeling the vulnerable two-pass script engine mismatch; and (7) tests, pipelines, and operational docs. Main exploit capabilities are remote unauthenticated worker crash/DoS with crafted GET requests to vulnerable rewrite paths, and in the provided deterministic lab, arbitrary command execution and reverse shell establishment. Fingerprintable exploit traffic includes GET requests to /api/<349*A + 969*+>, POST /spray with Content-Length around 4000 and X-Delay: 60, and optional h2c traffic. The exploit specifically targets nginx configurations where rewrite replacements contain '?' and are followed by set/if/rewrite directives referencing unnamed captures like $1.

Repository is a self-contained lab and exploit set for CVE-2026-42945 ('NGINX Rift'), a heap-based overflow in nginx rewrite processing caused by a two-pass length/write mismatch when args escaping is applied during write but not during allocation. The repo mixes documentation, lab setup, proof-of-concept code, and more advanced local post-exploitation helpers. Structure: markdown files document the vulnerability, plain-language explanation, and full reproduction workflow; `setup_nginx_target.sh` installs nginx 1.24.0, writes a vulnerable config, disables ASLR, and exposes port 8080; `vuln.conf` contains the trigger configuration and a `/slow/` location for heap/pool lifetime manipulation; `two_pass_overflow_demo.c` and `two_pass_overflow_demo.py` are educational models showing the allocation/write mismatch; `gdb_find_addrs.py` helps discover libc/system and heap addresses; `exploit.py` is the main remote PoC supporting probe, DoS, and a semi-manual RCE mode using supplied addresses; `pwn_rift.py`, `pwn_direct.py`, `exploit_cleanup.py`, and `exploit_pr_n.py` are progressively more advanced local-on-target ptrace-assisted exploit variants. Main exploit capabilities: `exploit.py` can fingerprint the target banner, verify the trigger path, send overflow requests for DoS, groom nginx pools with HTTP requests, and attempt RCE by overwriting a fake `ngx_pool_cleanup_t` that points to `system()` and a command string. The more advanced scripts attach to the nginx worker with ptrace, set breakpoints at `ngx_http_script_complex_value_code` or `ngx_destroy_pool`, inspect heap/pool state via `/proc/<pid>/maps` and register state, compute or plant fake cleanup structures, and then cause nginx to execute attacker-controlled shell commands. `pwn_direct.py` performs direct `system()` injection and may crash the worker; `exploit_cleanup.py` uses nginx's cleanup chain so the worker survives; `exploit_pr_n.py` combines ptrace calibration with the actual HTTP overflow as the write primitive and uses `/slow/` plus `127.0.0.1:9999` timeout behavior to keep a target pool alive. Attack surface: primarily remote web/network via HTTP requests to nginx on port 8080, especially `/trigger/...` and `/slow/`. However, the RCE implementations in this repository are not purely remote end-to-end; they rely on local root access on the target for ptrace-based calibration/injection and often deterministic memory layout (ASLR disabled). As a result, the repository demonstrates both the vulnerable remote trigger and several lab-oriented exploitation paths that convert the bug into command execution under controlled conditions. Overall purpose: educational and demonstrative exploit lab for showing the vulnerability lifecycle from trigger verification and crash reproduction to increasingly realistic command execution primitives, including reverse shell and cleanup-chain-based code execution as the nginx user.

Repository is a full proof-of-concept exploit suite for CVE-2026-42945 ('NGINX Rift'), a heap buffer overflow in `ngx_http_rewrite_module` caused by a two-pass script engine mismatch around the `is_args` flag. The main exploit is `exploit.py`, a standalone Python exploit with three modes: `--check` for low-impact detection of the vulnerable rewrite surface, `--probe` for offset/crash-based probing, and `--exploit` for full unauthenticated RCE. The exploit chain is clearly implemented as a network/web attack: it sprays heap memory by sending multiple `POST /spray` requests containing a fake `ngx_pool_cleanup_s` structure and command string, then sends a crafted `GET /api/...` request whose URI expansion overflows into an adjacent `ngx_pool_t` and overwrites its `cleanup` pointer. When nginx destroys the request pool, it walks the corrupted cleanup list and calls `system(cmd)`, yielding command execution as the nginx worker user. The repository is not just a single PoC file; it includes a reproducible lab environment under `env/` with vulnerable and patched Docker builds, nginx configuration that intentionally exposes the vulnerable `rewrite` + `set` pattern, an internal backend server (`env/server.py` on 127.0.0.1:19323), and an entrypoint that disables ASLR using `setarch -R` for deterministic addresses. Supporting tooling includes `discover-addresses.sh` to derive heap/libc/system offsets from `/proc/<pid>/maps`, `find-spray-landing.py` to scan `/proc/<pid>/mem` for sprayed markers and identify URI-safe landing addresses, `brute-sweep.py` to iterate candidate offsets and confirm true RCE via file creation inside the container, and `verify.sh` to demonstrate exploitation against the vulnerable container while confirming failure against the patched one. Exploit capability is operational rather than merely demonstrative: it supports arbitrary shell commands and can generate a Python reverse shell callback. However, the code and documentation repeatedly note that the hardcoded addresses and offsets are lab-specific. Real-world exploitation would require ASLR defeat, per-target heap/libc discovery, and the presence of the exact vulnerable nginx configuration pattern. Overall, this is a genuine exploit repository with a realistic lab harness, exploit automation, address-discovery helpers, and verification scripts, centered on `exploit.py` as the primary entry point.

This repository is a standalone Go exploit/helper tool for CVE-2026-42945 affecting nginx HTTP/2, not part of a larger exploit framework. The codebase is organized into a CLI in cmd/, core probing and exploitation logic in internal/rift/, and a reproducible Docker lab in deploy/docker/ with vulnerable nginx 1.30.0 and patched nginx 1.30.1 images. Main capabilities: - Probe a target over raw TCP/HTTP only (no TLS support) to determine reachability, parse the Server header, heuristically assess nginx version, and test whether PoC-required endpoints are exposed. - Perform a crash-side-channel probe by heap spraying POST /spray and triggering a crafted GET /api/... request, then infer worker crash/restart behavior. - Attempt command execution by building a fake ngx_pool_cleanup structure in the POST body and trying candidate heap/libc offsets until a worker anomaly suggests control flow reached system(). - Generate a reverse shell payload using python3 that connects back to operator-supplied lhost:lport; the tool optionally starts a local nc listener. Exploit structure: - cmd/main.go handles CLI parsing, mode validation, Docker lab orchestration, target probing, exploit execution, and reverse-shell helper behavior. - internal/rift/probe.go implements raw HTTP exchanges and endpoint/version checks. - internal/rift/body.go builds the crafted spray body: fake cleanup handler pointer, data pointer, null next pointer, then the attacker command. - internal/rift/exploit.go performs the heap spray, overflow trigger, crash detection, and brute-force iteration across known libc system() offsets and URL-safe heap candidates. - internal/rift/config.go stores constants such as body length, spray count, default/docker heap and libc bases, candidate heap offsets, and common libc system offsets. - deploy/docker/nginx.conf and server.py create a lab environment with the exact endpoints the exploit expects: rewrite-driven /api/(.*) handling, internal proxying, and /spray for controlled body allocation. The exploit is operational rather than a simple PoC because it includes working payload generation for arbitrary commands and reverse shell behavior, but it still relies on hardcoded/common offsets and side-channel success criteria rather than robust post-exploitation confirmation. The included Docker lab is clearly intended to demonstrate vulnerable vs patched behavior and improve exploit reliability by disabling ASLR.

Repository contains a standalone Python PoC plus NGINX configuration examples and a crash log demonstrating the claimed CVE-2026-42945 'NGINX Rift' heap overflow. The main exploit file is CVE-2026-42945/CVE-2026-42945-test.py, which opens raw TCP sockets and sends crafted HTTP GET requests. It first checks normal server responsiveness with GET /, then probes /api/test_endpoint, then sends increasingly large /api/%25%25... payloads intended to exploit URI decoding/re-escaping behavior. Success is inferred from connection failures, timeouts, or HTTP 500/502 responses followed by service recovery, indicating a worker crash and restart. Repository structure: (1) the Python PoC script; (2) single_layer_test/single_layer_nginx.conf showing a minimal vulnerable pattern using rewrite with '?' and set $captured $1 in location /api/; (3) double_layer_test/layer1_nginx.conf and layer2_nginx.conf showing a proxy/front-end and back-end deployment variant; and (4) single_layer_test/test.log containing sample execution output and NGINX SIGSEGV/SIGABRT traces. The README documents affected versions, trigger conditions, usage, and mitigation guidance. Main exploit capability: denial-of-service/vulnerability verification against a remote NGINX instance over HTTP. There is no implemented post-exploitation or shell payload; RCE is only mentioned conceptually in comments/README. The code is operational as a crash-inducing PoC but not weaponized. Notable observables include hardcoded Host headers cve.58.com and cve2.58.com, vulnerable request path /api/, example virtual host cve.test.com, proxy upstream http://10.16.79.137:8089, and several local log/config file paths from the sample NGINX setups.

This repository is a small standalone Python proof-of-concept exploit for alleged CVE-2026-42945 targeting nginx. It contains only two files: a README with usage examples and Shodan hunting queries, and the main exploit script poc.py. The code is not a scanner or detector; it is an active remote code execution exploit. The exploit logic is highly tailored to a specific target memory layout. It hardcodes HEAP_BASE, LIBC_BASE, and derives SYSTEM_ADDR from libc, explicitly noting 'ASLR disabled' in the argument parser description. It computes candidate heap addresses from a predefined PREREAD_HEAP_OFFSETS list, filters them through a byte-safety check, then constructs a fake structure containing the system() address and a pointer to attacker-controlled command data. The body is padded to a fixed 4000-byte length. Operationally, the exploit first checks service availability with a simple GET /. It then performs a heap spray by opening multiple concurrent POST /spray requests with Content-Length 4000 and X-Delay: 60, keeping attacker-controlled bodies resident in memory. After that, it opens additional connections and sends a crafted GET /api/<payload> request containing a long path with repeated characters and six target bytes derived from the candidate address. Timing and partial-request behavior are used to manipulate nginx request processing. The script then probes the connection state to infer whether the worker crashed or hung, treating that as evidence that system("<cmd>") executed. Capabilities include arbitrary command execution via --cmd and an optional reverse shell mode via --shell. In reverse shell mode, the script generates a Python one-liner that connects back to a supplied attacker IP/port, duplicates file descriptors, and launches /bin/sh -i. It also starts a local listener thread using netcat if available. The README reinforces the intended target profile: nginx instances on port 19321 or other non-standard ports, with references to POST /spray and X-Delay headers as identifying traits. Overall, this is an operational but brittle exploit PoC for network-based web exploitation against a very specifically configured nginx target.

Repository is a small standalone Python-based nginx exploit/scanner project with 6 files: a README, one Python utility script (calibrate.py), Docker lab files, and branding assets. The README describes a tool named nGixShell that allegedly performs nginx fingerprinting, scans for 53 CVEs, detects/bypasses WAFs, audits web security posture, and exploits CVE-2026-42945 for RCE with command execution and reverse shells. However, the main exploit script referenced throughout the README (ngixshell.py) is not present in the provided repository snapshot. The only actual code file included is calibrate.py, which is a local post-exploitation/support utility rather than the remote exploit itself. calibrate.py is a Python 3 script intended to tailor exploitation to a specific nginx worker process. It reads /proc/<pid>/maps and /proc/<pid>/mem, snapshots heap regions before and after opening slow POST requests to the target, identifies newly allocated heap chunks, filters for URL-safe candidate addresses, and attempts to locate libc/system() using readelf against the mapped libc path. Its purpose is to output HEAP_BASE, LIBC_BASE, system() offset, and candidate preread heap offsets in a format suitable for insertion into a KNOWN_BUILDS dictionary in the missing ngixshell.py. This indicates the overall exploit design relies on heap grooming plus corruption of nginx pool cleanup structures to redirect execution to system(). The env/ directory provides a reproducible Docker lab: docker-compose.yml launches nginx:1.25.3 on host port 19321, and nginx.conf intentionally exposes endpoints and rewrite behavior relevant to the claimed vulnerability. Notable lab routes include /r/ for the rewrite-trigger path, /upload for proxy/body buffering against an unreachable backend at 127.0.0.1:19999, /nginx_status for stub_status exposure, /admin for path discovery testing, and /.env for simulated sensitive-file exposure. Overall assessment: this is not just a README and not obviously fake, but the repository snapshot is incomplete because the primary exploit/scanner file is missing. Based on the included calibration utility and lab configuration, the intended capability is operational RCE support against vulnerable nginx instances, but the provided code alone does not execute the remote exploit; it prepares target-specific memory offsets needed by that missing exploit.

This repository is a self-contained exploit lab for CVE-2026-42945 targeting nginx 1.30.0 on 32-bit Linux. It is not just a detector: it includes a vulnerable Dockerized target, a primitive trigger, a deterministic lab-assisted RCE validator, and a remote-only brute-force exploit path. Repository structure: - docker/: builds and runs a 32-bit nginx 1.30.0 target plus a small Python delay backend. The nginx config exposes three important paths: /spray for heap spraying via proxied request bodies, /api/ for the vulnerable rewrite/set path, and / for creating the adjacent victim request pool. - exploit/trigger_oob.py: minimal proof-of-concept that sends a crafted /api/ request and predicts the out-of-bounds expansion caused by URI escaping. This demonstrates the heap OOB write primitive but does not attempt code execution. - exploit/lab_known_address.py: lab-assisted validator that uses docker exec to inspect /proc/<pid>/maps, derive heap and libc bases, compute the fake cleanup handler and system() target, then send the exploit sequence and wait for an HTTP callback. This proves RCE in the controlled lab but is explicitly not a pure remote exploit. - exploit/remote_bruteforce.py: main remote exploitation logic. It avoids Docker, SSH, ptrace, and /proc introspection, brute-forcing candidate SAFE heap pages and libc pages. It starts an HTTP listener and treats a POST to /rce as the only success oracle. - scripts/render_screenshots.py: auxiliary documentation tooling, not part of exploitation. Exploit capability and flow: 1. Heap spray: a POST to /spray keeps a request body allocation alive in nginx worker heap and stores a fake ngx_pool_cleanup_t structure plus a shell command. 2. Trigger: a crafted GET to /api/<payload> abuses the rewrite/set path so URI escaping expands attacker-controlled bytes and causes a controlled heap out-of-bounds write. 3. Victim cleanup: a concurrent GET / creates the adjacent request pool whose cleanup pointer is overwritten. 4. Code execution: when nginx destroys the corrupted pool, it follows the overwritten cleanup pointer. The fake cleanup handler points to libc system(), and the data pointer points to the attacker command string. 5. Success signal: the command pipes output into curl, which POSTs to the attacker listener, typically http://host.docker.internal:9876/rce. The exploit is operational rather than weaponized: it contains a real payload and working exploitation logic, but it is a standalone lab repository rather than a reusable framework module. The remote brute-force script is the most realistic exploit component, though success depends on favorable ASLR layout and byte-safety constraints for the sprayed pointer values.

This repository is a real RCE proof-of-concept for CVE-2026-42945 ('NGINX Rift'), a heap buffer overflow in NGINX's ngx_http_rewrite_module. The repo contains a runnable lab environment under env/ plus the main exploit in poc.py. The environment builds NGINX 1.30.0 from source in Docker, starts a local Python backend on 127.0.0.1:19323, and exposes the vulnerable HTTP service on port 19321. The nginx.conf intentionally includes the vulnerable rewrite+set pattern on /api/(.*), an internal /internal proxy target, and a /spray endpoint used to place attacker-controlled binary data into request-pool memory. The exploit logic in poc.py is operational rather than a simple crash PoC. It performs heap spraying by opening many POST /spray requests with crafted 4000-byte bodies containing a fake ngx_pool_cleanup structure: [handler=system()][data=command pointer][next=NULL][command string]. It then triggers the overflow via a GET request to /api/<payload>, where many '+' characters force URI escaping expansion during the copy pass, overflowing an undersized heap buffer allocated during the length pass. The overflow is used to corrupt an adjacent ngx_pool_t cleanup pointer so that when a victim request pool is destroyed, NGINX calls system() on attacker-controlled data. The exploit supports two outcomes: arbitrary command execution via --cmd and a Python reverse shell via --shell, defaulting to callback 172.17.0.1:1337. It also includes helper routines to wait for service availability, discover libc base addresses by reading /proc maps through docker compose exec, clear/check a marker file (/tmp/.rce_ok), and retry across several known-safe sprayed addresses. The code assumes a deterministic environment with ASLR disabled or otherwise stable, known-safe heap addresses, and Docker access for local verification. Repository structure is straightforward: README.md and writeup.md document the vulnerability and exploitation strategy; setup.sh builds the lab; env/ contains Docker, NGINX, and backend server files; poc.py is the main exploit entry point.

This repository is a standalone exploit lab and PoC suite for CVE-2026-42945, described as a heap buffer overflow in NGINX/OpenResty rewrite processing when a location combines rewrite, a replacement containing '?', and set referencing a regex capture such as $1. The repo is not tied to a common exploit framework. Its structure is centered around: (1) exploit and validation scripts in Bash and Python, (2) Docker packaging to build vulnerable NGINX/OpenResty environments with debug symbols and permissive ptrace settings, (3) custom nginx.conf files that intentionally satisfy the vulnerable configuration, and (4) bundled upstream NGINX source used for local builds/debugging. Main capabilities: it can detect whether a target exposes the expected vulnerable location (/health and /api/test checks), send crafted encoded requests to /api/... to trigger the overflow, inspect local error logs for ASAN evidence, stress the target for crash/DoS behavior, and perform command execution by attaching GDB to a local NGINX/OpenResty worker process and calling system(). The RCE path is therefore not purely remote code execution from HTTP alone; it depends on local privileged access to the host/container running the target process. The HTTP portion is used to reach the vulnerable code path, while the actual command execution is achieved through post-trigger local process injection. Repository layout: run.sh is the top-level orchestrator for building containers or testing a remote URL. check_nginx_cve.sh is a larger all-in-one assessment script supporting check/exploit/rce/flood modes and report generation. scripts/exploit.py is the main Python PoC with multiple modes; scripts/exploit_asan.py focuses on ASAN-assisted overflow confirmation; scripts/exploit_rce.py and scripts/rce.sh implement the GDB-based command execution workflow; scripts/poc.sh provides a shell-only equivalent. package/ contains Dockerfiles, docker-compose, startup scripts, and vulnerable nginx/openresty configs. nginx-install/conf/nginx.conf and package/nginx*.conf define the intentionally vulnerable /api/(.*) location and helper endpoints /health, /internal, and /aslr. gdb_*.sh scripts support debugging and tracing of the vulnerable code path. src/nginx-1.26.3 contains mostly stock upstream source/build files used to compile test images. Notable operational details: the Docker images are privileged, disable ASLR via /proc/sys/kernel/randomize_va_space, and relax ptrace restrictions via /proc/sys/kernel/yama/ptrace_scope to make GDB attachment reliable. The exploit scripts use repeated encoded characters such as %25, %3f, %23, and %26 as trigger material. Several scripts contain hardcoded local log paths and assume a lab environment. Overall, this is a real exploit/testing repository with both detection and exploitation components, but its practical RCE capability is best characterized as operational in a controlled local/privileged environment rather than a turnkey unauthenticated remote-only RCE exploit.

This repository is a small, focused proof-of-concept and documentation set for rediscovering and reproducing CVE-2026-42945 in nginx. It is not a framework module and not a weaponized exploit; it is a local crash/ASan reproduction harness. Repository structure: most files are documentation (README plus three docs files explaining methodology, technical root cause, and vulnerability breakdown). The actual PoC lives in poc/: nginx.conf defines a minimal vulnerable rewrite configuration, reproduce.sh is a shell wrapper that locates a local nginx binary and launches the Python harness, trigger.py is the main exploit driver, and expected_output.txt shows the expected ASan crash. Two prompt files document the AI-assisted audit workflow but are not part of exploitation. Main exploit capability: trigger.py launches a user-supplied local nginx binary with a temporary prefix and ASan logging enabled, waits for the server to listen on 127.0.0.1:18080, then sends a crafted HTTP GET request whose path is '/' followed by many repeated '%20' sequences. The provided nginx.conf contains a rewrite rule with '?', then a set directive using $1. This reproduces the stale e->is_args state bug in nginx's rewrite/script engine, causing the length pass to size a regex capture as raw bytes while the write pass URI-escapes it, overflowing the heap buffer. The script then collects stdout/stderr, ASan logs, and nginx error logs and reports success if crash evidence is present. Targeting: the repository explicitly targets nginx, validated against nginx 1.30.0 in a local lab build with AddressSanitizer. The vulnerable component is ngx_http_rewrite_module / src/http/ngx_http_script.c. The exploit requires percent-encoded URI content that expands when escaped, such as spaces encoded as %20. Operationally, this is a local network/web attack vector against a lab instance only: the code binds nginx to 127.0.0.1:18080 and does not contact external infrastructure. No persistence, shell, command execution, or post-exploitation payload is included. The result is denial-of-service style crash evidence demonstrating a heap-buffer-overflow rather than code execution.

Repository contains a complete standalone proof-of-concept exploit and a reproducible lab environment for CVE-2026-42945 ('NGINX Rift'), a heap-based buffer overflow in NGINX's ngx_http_rewrite_module. The main exploit is CVE-2026-42945/poc.py, a Python script that performs network exploitation against a vulnerable HTTP listener. It first sprays heap memory by sending multiple POST requests to /spray with attacker-controlled bodies containing a fake cleanup structure and command string, then triggers the overflow with a crafted GET request to /api/<payload>. The exploit relies on the mismatch between rewrite length calculation and copy-time escaping, using many '+' characters to expand during URI escaping and overflow an undersized heap buffer. It attempts to corrupt an adjacent ngx_pool_t cleanup pointer so that pool destruction invokes system() on attacker-controlled data. The script supports either arbitrary command execution (--cmd) or a generated Python reverse shell (--shell), and includes liveness checks and repeated attempts across candidate heap offsets. The env/ directory builds a vulnerable lab: Dockerfile clones and compiles a specific NGINX revision, docker-compose.yml exposes port 19321, entrypoint.sh disables ASLR with setarch -R for deterministic addresses, nginx.conf defines the vulnerable rewrite/set combination plus /spray and /internal locations, and server.py provides a delayed backend on 127.0.0.1:19323 to keep requests open during exploitation. setup.sh automates building and demonstrates command execution by writing /tmp/pwned. The two README files document the vulnerability, affected versions, exploitation concept, and usage. Overall, this is a real exploit repository rather than a detector. It is operational in the supplied lab conditions, but not broadly weaponized: key addresses are hardcoded (HEAP_BASE, LIBC_BASE, SYSTEM_ADDR), exploitation assumes ASLR is disabled, and the environment is tuned for deterministic success. Primary capabilities are unauthenticated remote command execution and reverse shell access, with worker crash/DoS as a likely side effect when exploitation fails.

This repository is a self-contained reproduction and analysis kit for CVE-2026-42945 ('NGINX Rift'), centered on a network/web attack against vulnerable NGINX rewrite processing. It is not tied to a common exploit framework. The repo contains: (1) a Dockerized vulnerable lab environment using nginx:1.26.2 (Dockerfile, docker-compose.yml), (2) a crafted nginx.conf that intentionally enables the vulnerable pattern, (3) poc_crash.py, a Python PoC that sends malicious HTTP GET requests with many '+' characters to /api/... to trigger a heap buffer overflow and crash a worker, and (4) explanatory materials (README.md, exploit_diagram.txt, vuln_analysis.c) describing root cause and a possible RCE path. Main exploit capability: the Python script performs active exploitation over TCP/HTTP by connecting to a target host/port, verifying the server is reachable, probing the vulnerable /api/ route, then sending progressively larger payloads of escapable URI characters. It detects likely success via connection reset/refusal, timeout, HTTP 500/502, or recovery behavior after a worker restart. This makes it more than a passive detector: it attempts to trigger the crash condition directly, so it is a DoS exploit PoC. The repository also documents a more advanced heap-grooming-based RCE concept involving overwriting NGINX pool cleanup handlers and eventually invoking system("touch /pwned"), but no automated RCE exploit implementation is present. The vulnerable condition described throughout the repo is a state mismatch in NGINX's two-phase script engine processing: rewrite with a '?' sets is_args=1 in the main engine, while later set/capture length calculation uses a zeroed child engine with is_args=0. As a result, length calculation underestimates the required buffer size, but the copy phase escapes URI characters such as '+', expanding each from 1 byte to 3 bytes and overflowing the heap buffer. Operationally, the intended workflow is: start the Docker lab exposing host port 8080 to container port 80, then run poc_crash.py against 127.0.0.1:8080. The PoC is therefore operational but basic, with a hardcoded HTTP payload pattern and no generalized weaponization.

Repository contains a single Python exploit script (`poc.py`) and a README. The script is a standalone, non-framework PoC targeting the claimed NGINX Rift vulnerability (CVE-2026-42945). Its structure is straightforward: argument parsing in `main()`, target processing in `process_target()`, liveness checks in `wait_alive()`, payload/body construction in `make_body()`, and the exploitation sequence in `attempt()`. The exploit uses raw sockets rather than HTTP libraries. Operationally, it performs a multi-stage network attack: it first verifies the target is reachable, then opens multiple `POST /spray` connections with a fixed-size crafted body intended to spray heap memory. It follows with a crafted `GET /api/{payload}` request containing a long path segment and selected target bytes derived from hardcoded heap candidate addresses. A parallel verification connection and subsequent probe (`X-Ping:1`) are used to infer whether the target worker crashed or became unstable. Success is reported as vulnerability, even though the script does not directly verify command output; in practice, much of its logic appears to rely on crash/disruption as a signal. The script includes several built-in payload modes: `id` for simple command execution, `sleep` for blind timing-based verification, `write` to drop `poc.txt` into common web roots, `shell` to launch a Python reverse shell to a configurable listener, and `crash` for DoS-style testing. It also accepts arbitrary commands via `--cmd`, and supports either a single URL (`--url`) or a batch list file (`--list`). Notable hardcoded assumptions include static `HEAP_BASE`, `LIBC_BASE`, `SYSTEM_ADDR`, and a list of `PREREAD_HEAP_OFFSETS`, indicating the exploit is highly environment-specific and likely unreliable across real-world targets with ASLR or differing builds. Overall, this is an operational PoC exploit with real offensive capability, but its success likely depends on a narrow target memory layout and may often result in DoS rather than reliable RCE.

Repository contains a standalone Python exploit and helper tooling for CVE-2026-42945, described as an NGINX ngx_http_rewrite_module heap buffer overflow. Structure is small and focused: nginx_rift_htb.py is the main exploit, nginx_rift_helper.py performs reconnaissance/fingerprinting/info-leak checks and can generate an exploit template, CHEATSHEET.sh is an operator usage reference, and README.md documents workflow and assumptions. Main exploit behavior: nginx_rift_htb.py connects directly to the target over raw sockets, verifies NGINX presence, checks for a likely vulnerable /api/ endpoint, builds a 4000-byte heap spray body containing a fake ngx_pool_cleanup_s structure, and repeatedly sends crafted requests intended to corrupt a cleanup pointer so that pool destruction invokes system() with an attacker-controlled command. It supports direct command execution (--cmd) and reverse shell mode (--shell with --lhost/--lport). The exploit includes hardcoded default heap/libc bases and several common system() offsets and heap offsets, indicating operational but brittle exploitation rather than a universally reliable weaponized tool. Helper behavior: nginx_rift_helper.py fingerprints NGINX by issuing HEAD/GET requests, extracts version strings from headers, probes common paths (/api/, /internal/, /admin/, /spray/, /.git/), checks for rewrite behavior using /api/test?x=1, attempts a simple malformed-request info leak via /%00, measures response timing, and includes ASLR brute-force/generation support. This helper is partly reconnaissance and partly exploit support, not just detection. Targeting assumptions: the target must expose a rewrite+set configuration pattern similar to location ~ ^/api/(.*)$ { rewrite ^/api/(.*)$ /internal?migrated=true; set $original_endpoint $1; }. The exploit is aimed at NGINX Open Source 0.6.27-1.30.0 and NGINX Plus R32-R36. Reliability depends heavily on memory layout knowledge; the repository explicitly notes ASLR-disabled HTB/CTF scenarios or the need for leaks/bruteforce. Overall purpose: provide a self-contained HTB/CTF-ready remote code execution exploit against vulnerable NGINX instances, plus helper tooling to identify candidate endpoints and improve exploitability.

This repository is a self-contained proof-of-concept exploit environment for CVE-2026-42945, a claimed unauthenticated remote code execution bug in NGINX's rewrite module. It is not part of a larger exploit framework. The repo contains 8 files: a README, one standalone Python exploit (exp.py), setup automation (setup.sh), and an env/ directory with Docker-based lab infrastructure (Dockerfile, docker-compose.yml, entrypoint.sh, nginx.conf, server.py). The main exploit logic is in exp.py. It performs a network/web attack against a vulnerable NGINX listener by combining: (1) repeated POST requests to /spray with attacker-controlled bodies to shape heap allocations and place a fake ngx_pool_cleanup structure plus command string in memory; (2) crafted GET requests to /api/<payload> to trigger the rewrite+set heap overflow; and (3) connection timing/orchestration to corrupt adjacent pool metadata. The exploit uses hardcoded HEAP_BASE, LIBC_BASE, and SYSTEM_ADDR values and explicitly states ASLR must be disabled, making it operational in the provided lab but not broadly reliable against arbitrary targets. On success, it redirects execution to system() and either runs an arbitrary command (--cmd) or launches a Python reverse shell (--shell) to a listener controlled by the attacker. The vulnerable lab is defined in env/nginx.conf. NGINX listens on port 19321 and contains a regex location ^/api/(.*)$ where rewrite ^/api/(.*)$ /internal?migrated=true; is combined with set $original_endpoint $1;, matching the bug description in the README. A /spray location accepts POST bodies in a single buffer and proxies them to a backend, enabling heap spraying. An internal /internal location proxies to a simple Python backend on 127.0.0.1:19323. The Docker environment compiles a specific NGINX source checkout, runs it with ASLR disabled via setarch -R, and exposes port 19321 to the host. Overall, this is a real exploit PoC rather than a detector. Its primary capability is unauthenticated remote command execution against a narrowly configured, vulnerable NGINX instance. Fingerprintable targets and paths include the primary listener on 19321, backend 127.0.0.1:19323, and the key HTTP paths /api/, /spray, /internal, and /. The exploit is best classified as OPERATIONAL: it includes a working payload and exploitation flow, but reliability depends on the provided deterministic environment and hardcoded addresses.