aratane Exploits and Proofs of Concept

Showing 3 PoCs on this page

GitHub

aratane/CVE-2026-42945

Repository PoC0Created 2026-07-01ExploitCVE-2026-429452 files

43.3 KiB

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Technical assessment

RIFT is a Python-based exploit framework targeting a heap buffer overflow (CVE-2026-42945) in NGINX's ngx_http_rewrite_module. It performs heap spraying, triggers the overflow via a crafted URI, corrupts a pool cleanup structure, and executes arbitrary commands or a reverse shell.

Backdoor review

No backdoor observed in reviewed code

The repository contains a PoC exploit for CVE-2026-42945 (NGINX rewrite module heap overflow). The Python script (rift.py) and README describe reconnaissance and exploitation techniques consistent with the claimed vulnerability. No concealed backdoor, unrelated payload, or deceptive behavior targeting the user running the PoC was observed. The tool's functionality is limited to exploiting a remote NGINX target; it does not install persistence, steal credentials, or execute hidden commands on the operator's machine.

ClassificationExploit

Model confidence98%

AuthenticationNot required

LanguagesPython

Target softwareNGINXngx_http_rewrite_module

Attack typesHeap-based Buffer OverflowRemote Code Execution

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact, rift.py, contains code that constructs and sends malicious HTTP requests to trigger a heap buffer overflow, corrupt memory, and execute arbitrary commands on a remote NGINX server. This constitutes an exploit.

rift.py:207-308rift.py:900-932README.md:134-141

Requirements

Target must be running a vulnerable version of NGINX (Open Source 0.6.27–1.30.0 or Plus R32–R36) with a specific rewrite+set configuration.README.md:115-131
The attacker must be able to send HTTP requests to the target.rift.py:207-308

Observed behavior

Sends multiple POST requests to /spray to fill the heap with fake ngx_pool_cleanup_s structures containing a system() address and a command string.rift.py:114-130rift.py:211-233
Triggers a heap buffer overflow by sending a GET request to /api/ with a long URI containing many '+' characters, which expand during escaping and overwrite adjacent pool metadata.rift.py:253-268
Executes an arbitrary shell command (e.g., 'id', 'whoami') or a reverse shell payload (Python, bash, nc, PHP) via the corrupted cleanup handler calling system().rift.py:900-932rift.py:996-1005
Includes reconnaissance features to fingerprint NGINX, detect endpoints, check for info leaks, and estimate worker count.rift.py:360-420rift.py:423-459rift.py:583-636

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Reverse Shell Listener: Payload withheldThe tool can start a local listener to receive reverse shell connections from the exploited target. This is a standard feature of exploitation frameworks and is explicitly documented in the README (lines 86-92). It does not represent a backdoor against the operator.rift.py:310-358README.md:86-92
Command Execution: Payload withheldThe exploit aims to execute arbitrary commands on the remote NGINX server by corrupting heap structures. This is the core of the claimed CVE-2026-42945 exploit and is not a backdoor against the PoC user.rift.py:207-308README.md:134-141

Review boundaries

What the analysis did not establish

Evidence coverage is limited to the README.md and rift.py files; no binary files or network captures were provided.
The analysis is based solely on static review of the source code; the exploit was not executed or verified against a live target.
Only the two text files (README.md, rift.py) were provided; no binary files or other artifacts were present in the evidence packet.
The review does not assess the safety or reliability of the exploit code when executed against a target; it only evaluates whether the PoC itself contains a backdoor or deceptive payload aimed at the operator.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub