React2Shell: Pre-authentication RCE in React Server Components

This 36-file repository is a self-contained React2Shell lab for CVE-2025-55182. The main exploit is exploit-poc.py, a Python requests-based proof of concept that sends a crafted multipart POST with Next-Action: x and a malicious React Flight object to a caller-supplied target URL. The object uses prototype/constructor gadget fields and injects server-side JavaScript, causing Node.js child_process.execSync to run a hard-coded cat /etc/passwd command. It parses a returned error digest to display command output, demonstrating unauthenticated RCE rather than merely detecting a vulnerable version. The repository also includes parallel minimal Next.js applications: vulnerable-app pins Next.js 15.5.6 with React/React DOM 19.1.0, while patched-app uses Next.js 15.5.7 with React/React DOM 19.1.2. Both expose a simple Server Action, echoAction, through a form. Docker Compose builds and runs these apps as react2shell-vulnerable and react2shell-patched, binding them only to loopback ports 3000 and 3001 respectively. Dockerfiles use Node 20 Alpine multi-stage builds and standalone Next.js output. The remaining files are standard Next.js/Tailwind configuration, static assets, lockfiles, and basic UI sources. No external command-and-control, callback listener, persistence mechanism, or non-local network destination is present.

This three-file repository is an operational DockerLabs attack chain rather than a detection-only proof of concept. README.md is a Spanish walkthrough documenting reconnaissance of an exposed Node.js Inspector on TCP/9229 and a root-run Next.js 15.0.0-rc.1 portal bound to localhost:3000. node_rce.py is a Python command-execution utility: it retrieves the Inspector's debugger WebSocket from /json/list, submits a Chrome DevTools Protocol Runtime.evaluate request, and causes Node's child_process.execSync to execute an attacker-provided Bash command. Commands are Base64-wrapped and their output is returned to the operator. react2shell.py embeds the same Inspector access as an initial foothold, creates two malicious serialized RSC payload files in /tmp, and uses curl running through the compromised Node process to POST them to the local Next.js application with Next-Action: x. The payload is intended to exploit the stated React2Shell/CVE-2025-55182 deserialization/prototype-pollution path, execute JavaScript via a Function-constructor chain in the Next.js process, and exfiltrate execSync output through an x-action-redirect header. The documented chain yields webuser-level RCE first and root-level RCE second.

edu-recon is a Python 3.10+ reconnaissance, vulnerability-triage, and active assessment orchestrator aimed at education-sector engagements. It has 38 files, primarily Python modules, with `recon.py` as the CLI entry point and `run.sh` as a one-command launcher. Its stdlib web UI (`edurecon/webui.py`) exposes scan submission, live logs, findings, report/reproduction generation, and dump functions; it defaults to localhost but can be bound to all interfaces without authentication. The engine expands CIDRs through nmap ping sweeps and domains through subdomain enumeration, then concurrently runs Shodan enrichment, nmap service/version scanning, dirsearch web discovery, exposure checks, secret/API-key scanning, Moodle auditing, reflected-XSS and SQLi checks, Hydra credential attacks, and WordPress wp2shell processing. Full intensity actively invokes sqlmap and Hydra; recon mode lists those candidates instead. It uses external repositories installed by `setup` for PHP-CGI, React2Shell, WordPress, and directory-scanning capabilities. Built-in CVE probes target PHPUnit eval-stdin RCE (CVE-2017-9841), Apache traversal/LFI (CVE-2021-41773), Struts S2-045 (CVE-2017-5638), Confluence OGNL RCE (CVE-2022-26134), Drupalgeddon2 (CVE-2018-7600), Next.js middleware bypass (CVE-2025-29927), PHP-CGI (CVE-2024-4577/CVE-2024-8926), and React Server Components RCE (CVE-2025-55182). Several internal checks use benign confirmation markers/arithmetic oracles, but the overall repository is an active exploitation platform: full mode can perform credential guessing and injection, external wp2shell can pursue SQLi-to-shell, and React2Shell can be configured away from safe-check mode to run a command. Notable collection functionality includes downloading exposed files and backups, scanning their contents for cloud/VCS/payment/API credentials, and `gitdump.py`, which mirrors an exposed `.git` directory, retrieves reachable loose Git objects, and reconstructs source files. Artifacts, reports, findings, and potentially sensitive material are stored under `runs/<run-id>/`; report code serializes evidence and can therefore retain sensitive values. ScopeGuard supports target/CIDR and subdomain allowlisting, but supplied documentation/configuration describe scope enforcement as disabled by default, materially increasing operator-supplied target risk.

This six-file standalone Python repository combines two related but independent offensive utilities. Its principal component, react2shell-poc.py (approximately 23.6 KB and described as vendored unchanged), is a CVE-2025-55182 proof of concept targeting purported prototype-pollution-based React Server Components Flight deserialization leading to child_process.execSync execution in vulnerable Next.js App Router applications. It accepts an operator-provided HTTP(S) target and command, supports vulnerability checking, blind command execution, error-based command-output extraction, callback-based output exfiltration with an embedded threaded HTTP server, interactive operation, and a configurable reverse shell. The target URL and callback URL/port are operator supplied rather than hardcoded. cdp_privesc.py is a separate local post-exploitation helper, explicitly CVE-agnostic. It accesses a Node.js Inspector exposed on localhost port 9229, retrieves its dynamic target ID from /json, performs a manual WebSocket handshake, and sends Chrome DevTools Protocol Runtime.evaluate requests. The evaluated expression escapes through process.mainModule.require('child_process') and executes a supplied shell command in the inspector process context. Its default command makes /bin/bash SUID and runs id, which is impactful if that Node process is root-owned. cdp_privesc_note.txt documents forwarding the otherwise loopback-only inspector over SSH and using bash -p afterward. README.md provides installation and usage examples; LICENSE and .gitignore are ancillary. No common exploit framework is used.

This is a small standalone Bash proof-of-concept repository, not a Metasploit, Nuclei, or other framework module. It contains a README describing the alleged React Server Components/Next.js Server Actions deserialization RCE tracked as CVE-2025-55182 and CVE-2025-66478, a `.gitignore`, and `exploit.sh`, the sole executable entry point. The script parses target, callback, port, interface, timeout, verbosity, and custom-command options; validates curl; optionally discovers a non-loopback local IPv4 address with `ip` or `ifconfig`; and creates a temporary working directory that is removed on exit. It generates two files used as multipart form fields and sends them in one HTTP POST to `http://<target>:<port>` with `Next-Action: dontcare`. The crafted RSC references attempt to traverse `__proto__ -> constructor -> constructor` and inject an `execSync` expression through `_response._prefix`. Successful exploitation runs a supplied command as the Next.js process. Its operational default is a BusyBox netcat reverse shell back to the operator, while `-c` supports command substitution. The script suppresses curl errors unless verbose mode is enabled and does not independently verify successful exploitation; it instructs the operator to inspect their listener.

This is a small standalone Python proof-of-concept repository containing README.md and exploit.py. The Python script accepts a target URL, attacker IP, and optional listener port, then submits a crafted multipart POST request to the target root path with a Next-Action: x header. Its multipart fields contain a serialized React Server Components/Flight object designed to traverse __proto__, constructor, and constructor properties and inject a process.mainModule.require('child_process').exec(...) expression. The injected command launches a background FIFO/netcat reverse shell using /bin/sh and connects to the supplied attacker address. The script reports the HTTP result and treats a 10-second request timeout as a possible indication that execution occurred. It is an active unauthenticated RCE exploit attempt rather than a scanner or detection-only script, with a basic configurable reverse-shell payload.

This repository is a standalone Python exploit for CVE-2025-55182, described as a Next.js/React Server Components remote code execution issue via prototype pollution. The main exploit logic is entirely in exploit.py; the rest of the repository provides documentation and a Dockerized lab with vulnerable and patched sample applications for validation. The exploit works by sending a crafted multipart/form-data POST request to the target root path (/). The body contains a malicious serialized React Server Components structure that abuses __proto__ and constructor references to influence server-side processing and inject JavaScript into the Node.js runtime. In command mode, it executes arbitrary shell commands through child_process.execSync(), base64-encodes stdout, and forces a NEXT_REDIRECT error whose digest causes the output to appear in the X-Action-Redirect response header as /login?a=<encoded>. In reverse-shell mode, it uses child_process.exec() with detached execution and supports several hardcoded payload templates: nc, nc-mkfifo, sh, bash, and perl. Operational capabilities include URL normalization, randomized multipart boundaries and request headers, command execution, output parsing from redirect headers, reverse-shell listener creation, and interactive shell I/O over TCP. SSL verification is disabled by default. The exploit is operational rather than a simple PoC because it includes working payload delivery, output recovery, and reverse-shell automation, though payloads are still basic and hardcoded. Repository structure: - exploit.py: primary exploit entry point and all offensive logic. - README.md: usage instructions, examples, and lab setup. - pyproject.toml / requirements.txt: Python dependencies (requests, rich, rich-click, fake-useragent). - lab/docker-compose.yml: launches vulnerable and patched test environments. - lab/vulnerable/: vulnerable Next.js app using React 19.2.0 / Next 15.4.0 with a server action form. - lab/patched/: patched comparison app using React 19.2.1 / Next 15.4.8. - lab/packages/README.md: documents vulnerable and patched react-server-dom package versions. The lab confirms intended targeting: vulnerable React Server Components package lines include react-server-dom-webpack 19.0.0, 19.1.0, 19.1.1, and 19.2.0, plus corresponding parcel/turbopack variants listed in the package README. The vulnerable demo app exposes a server action and a root page suitable for testing the crafted request, while the patched app serves as a negative control.

This repository is a small standalone Python exploit for CVE-2025-55182 targeting vulnerable Next.js Flight / Server Actions deserialization behavior. The repo contains only two files: a README describing the vulnerability and usage, and a single executable script, exploit.py, which is the main entry point. The exploit works by sending a crafted multipart POST request to a user-supplied target URL. In build_exploit(), it constructs a malicious Flight chunk designed to abuse prototype-chain properties (notably then and constructor) so that server-side JavaScript reaches process.mainModule.require('child_process').execSync(). The supplied command is executed on the target with an 8-second timeout. Output is converted to string and embedded into a thrown NEXT_REDIRECT error's digest field, which the client then parses from the HTTP response body. Core capabilities include: single arbitrary command execution, an interactive stateless semi-shell where each command triggers a fresh exploit request, and a reverse shell mode. The reverse shell mode cycles through five hardcoded payload variants for resilience: python3, legacy python, bash /dev/tcp, nc -e, and busybox nc. The fire() function performs the HTTP POST, sets a random Next-Action header, handles read timeouts, and extracts command output from lines containing digest:`...`. There are no framework dependencies beyond the requests library, and no detection-only logic; this is direct exploitation code. The exploit is operational rather than merely demonstrative because it includes working payload delivery, output parsing, and multiple post-exploitation shell options. Fingerprintable artifacts include the target URL supplied by the operator, the Next-Action header, the use of NEXT_REDIRECT as an output channel, and reverse-shell-related endpoints such as attacker IP/port values and /bin/sh.

Repository is a standalone Python exploit/assessment tool named ReactRCE-Scanner for the claimed CVE-2025-55182 affecting React Server Components. The repo contains one large primary code file (exploit.py), configuration (config.yaml), install scripts for Windows and Unix, dependency manifests, and a detailed README. The main capability set described and partially evidenced in code includes target fingerprinting, multi-stage verification, concurrent scanning, command execution, pseudo-interactive shell access, DNS-based exfiltration/verification, reporting, proxy support, and additional modes for DoS and persistence. The Python file is substantial (~71 KB) and includes CLI parsing, async execution, HTTP request handling via requests/urllib3, rich terminal UI support, configuration loading, fingerprinting models, and operational modes such as exec, shell, dos, and persist. This is not merely a detector: the code paths shown indicate active exploitation routines and post-exploitation-style features. No hardcoded victim URL/IP is embedded in the provided content; targets are operator-supplied at runtime. Notable repository inconsistencies exist (e.g., requirements.txt header references an unrelated LuaStorm/Apache CVE), but the main script and README are aligned around React/Next.js RCE exploitation. Overall, this appears to be an operational standalone exploit framework rather than a simple proof-of-concept.

This repository is a small standalone Python exploit for unauthenticated RCE against vulnerable Cal.com deployments. It contains two files: a README describing the vulnerability, affected versions, usage, and remediation; and a single executable script, exploit.py, which is the main entry point. The exploit targets Cal.com <= 5.9.8 by abusing vulnerable React Server Components / Next.js Flight deserialization behavior described as react2shell. The Python script sends a crafted multipart POST request to the supplied base URL with a Next-Action header and a malicious serialized object. The payload uses prototype-pollution and constructor gadgets (notably __proto__:then and constructor:constructor) to cause server-side evaluation of attacker-controlled JavaScript. That JavaScript imports Node's child_process module and invokes execSync. Capabilities are straightforward but effective: in command mode (-c/--cmd), it executes an arbitrary shell command on the target and extracts the output from the returned response body by regex-matching the digest field. In reverse shell mode (--shell HOST:PORT), it launches a detached bash reverse shell using /dev/tcp to connect back to the attacker. The reverse shell is hardcoded to bash semantics and assumes outbound connectivity from the target. Repository structure is minimal and purpose-built: no framework, no auxiliary modules, and no detection-only logic. The exploit is operational rather than just demonstrative because it includes working payload delivery and post-exploitation options, but payload customization is manual and limited to command strings or callback host:port arguments.

This repository is a small Next.js lab environment built to demonstrate CVE-2025-55182, a React Server Components / Flight deserialization issue leading to server-side JavaScript execution. The codebase itself is minimal: app/actions.js defines a server action, app/page.js exposes a form that triggers that action, and app/layout.js provides standard layout scaffolding. package.json runs the app in development mode on 0.0.0.0:3000, while package-lock.json pins vulnerable-looking dependencies including next 15.0.0 and react/react-dom 19.0.0. The actual exploit logic is not implemented as executable code in the repository; instead, the README contains the exploit analysis and a full proof-of-concept HTTP multipart request. That request targets the root path / with Next.js-specific headers and abuses React Flight serialization markers such as $1:constructor:constructor and $B1337. The described technique forges an internal Chunk-like object, poisons _response fields, and causes deserialization to resolve Function via prototype/property traversal. The payload then invokes process.mainModule.require('child_process').execSync(...) to achieve arbitrary command execution in the Node.js server process. Operationally, this is a proof-of-concept lab rather than a weaponized exploit toolkit. It demonstrates how a remote attacker can send a crafted POST request to a vulnerable Next.js/React Server Action endpoint and obtain RCE. The README also discusses detection ideas such as Snort and OSQuery, but the repository's primary purpose is educational reproduction of the vulnerability, not automated scanning or exploitation at scale.

This repository is a small standalone Python exploit containing one executable script (`exploit.py`) and a descriptive `README.md`. It is not part of a larger exploitation framework. The script targets CVE-2025-55182, described here as a React Server Components deserialization issue affecting vulnerable React/Next.js deployments. Core capability: the exploit sends a crafted multipart/form-data POST request to the target application's root path (`/`). The multipart body contains a malicious serialized structure intended to reach JavaScript constructor access and execute Node.js code via `child_process.execSync('id')`. The payload is hardcoded to run the Unix `id` command with a 5-second timeout. It then throws a `NEXT_REDIRECT` error whose `digest` field contains the command output, allowing the Python client to recover execution results by regex-parsing the HTTP response body. Operational behavior: the script supports single-target mode (`-u`) and bulk mode (`-f`). If a target is provided without a scheme, it automatically generates both `http://` and `https://` variants. It removes duplicates, disables TLS certificate verification, uses a 10-second timeout, and executes requests concurrently with a `ThreadPoolExecutor` using 30 worker threads. On success, it prints the target and extracted command output. It can also append results to a local output file and optionally POST result metadata (`time`, `target`, `status`, `command_output`) to a user-supplied remote log server. Repository structure is minimal and purpose-built: the README documents vulnerable versions, usage examples, and the exact HTTP request format; `exploit.py` implements argument parsing, target normalization, static headers, the exploit body, response parsing, optional logging, and multithreaded execution. Overall, this is an operational proof-of-concept RCE exploit with a fixed payload rather than a generalized framework module.

This repository is a small standalone Python proof-of-concept exploit for the claimed CVE-2025-55182 'React2Shell' issue. It contains two files: a README describing the alleged vulnerability, affected products, and usage, plus a single executable script, exploit.py, which is the only code file and clear entry point. The exploit's core capability is unauthenticated remote command execution against web applications exposing React Server Components / Flight-related endpoints. The script accepts a target URL, port, and arbitrary command, builds a JSON-encoded payload that imitates a React serialized object with a nested react.module.reference pointing at module 'os', and inserts the operator-supplied command into props.command. It then iterates over several hardcoded candidate endpoints (/_rsc/, /_flight/, /__rsc, /server-actions, /api/__rsc) and sends HTTP POST requests with Content-Type text/plain;charset=UTF-8. For each request it prints the HTTP status and the first 500 bytes of the response body. Structurally, the code is simple: craft_payload() creates the serialized body; exploit() constructs the base URL, sets headers, and POSTs to each candidate endpoint; main() parses CLI arguments and launches exploitation. There is no shell listener, staging logic, persistence, or framework integration. The payload is operator-controlled but basic and hardcoded in structure, so the repository is best classified as OPERATIONAL rather than weaponized. Notable limitations: the script does not verify vulnerability beyond observing responses, does not adapt payload format per framework/version, and relies on a speculative deserialization/import-hijack model described in comments and README. Even so, the code is clearly intended as an exploit rather than a detector, because it actively delivers a command-bearing payload to likely target endpoints.

This repository is a small standalone Python proof-of-concept exploit for CVE-2025-55182 ('React2Shell'). The repo contains only four files: a standard .gitignore, MIT LICENSE, README with usage/examples, and the main exploit script react2shell_exploit.py. The exploit is not part of a larger framework. The Python script uses requests to send a crafted multipart/form-data POST request to an operator-supplied target URL. Its core logic is split into two functions: react2shell_prepare_payload(), which base64-encodes the supplied shell command and embeds it into a malicious serialized form-data structure, and react2shell_run_exploit(), which transmits the payload with verify=False. The payload abuses a deserialization / object-manipulation primitive described in the README, setting fields such as __proto__:then and constructor:constructor and injecting a Node.js expression that calls process.mainModule.require('child_process').execSync(...). The command executed on the target is 'echo <base64> | base64 -d | bash', allowing arbitrary shell execution. Primary capability: unauthenticated or low-friction remote code execution against a vulnerable React/Next.js application endpoint, depending on target exposure. The exploit supports arbitrary operator commands, including reverse shells and simple command execution for validation. It does not include persistence, privilege escalation, lateral movement, or automated target discovery. Because it includes a working hardcoded execution primitive but relies on user-supplied commands, it is best classified as OPERATIONAL rather than a mere POC. Fingerprintable observables include the custom HTTP header 'Next-Action: x', multipart boundary '----X', the serialized gadget strings, and the Node.js child_process.execSync execution primitive. The README also includes example target and callback endpoints that are demonstrative rather than hardcoded operational infrastructure.

This repository is a Wails-based desktop exploit application for CVE-2025-55182, described as a Next.js RSC remote code execution issue. It is not just a detector: the Go backend in pkg/core/exploit.go implements the exploit transport and payload generation, while the React/TypeScript frontend provides a GUI for operators. Structure: main.go and app.go initialize the Wails desktop app and expose backend methods to the frontend. The frontend contains tabs for detection, command execution, raw JavaScript execution, and module loading. The core exploit logic lives in pkg/core/exploit.go, with helper code in pkg/utils/crypto.go and pkg/utils/encoding.go. Main exploit behavior: SendComplexPayload() builds crafted multipart/form-data requests intended to abuse the Next.js RSC processing chain. It supports two payload styles: 'Array Map Chain' and 'Prototype Chain'. The injected JavaScript is wrapped so that execution results are converted to strings/JSON and then exfiltrated by throwing a forged NEXT_REDIRECT error whose digest includes '/login?a=' + encodeURIComponent(res). This indicates the exploit expects the target to process the malicious RSC structure and leak output through redirect handling. Capabilities exposed in the GUI: DetectVulnerability() sends arithmetic probe '7*3+1' and expects '22'; on success it collects process.version, process.platform, and process.arch. ExecCommand() supports synchronous or asynchronous command execution. ExecJS() runs arbitrary JavaScript. LoadModule() invokes process.mainModule.require('module')._load(path). The backend code also includes file-system operations such as WriteFile(), and the truncated exploit.go clearly shows directory listing and file handling support using fs and JSON parsing of remote results. Evasion and transport features: the tool can Unicode-escape JSON strings, encode multipart fields as UTF-16LE, and wrap the JavaScript in an AES-256-CBC decrypt-and-eval stub. It also supports configurable HTTP/HTTPS/SOCKS5 proxying and disables TLS verification when verifySSL is false. Assessment: this is a real exploit tool with operational payload delivery and post-exploitation helpers, packaged as a desktop GUI. It targets vulnerable Next.js RSC endpoints over HTTP(S), and its most fingerprintable exploit artifact is the forged NEXT_REDIRECT digest containing the /login path and query parameter a for result exfiltration.

This repository is a real exploit toolkit for CVE-2025-55182, not just a detector. Its primary component is `react2shell.mjs`, a standalone Node.js exploit that crafts malicious multipart React Server Components / Next.js Server Actions requests to achieve unauthenticated RCE. The exploit sends POST requests directly to a supplied target URL with a `Next-Action` header and `multipart/form-data` body, abusing Flight protocol references such as `$1:__proto__:then` and `$1:constructor:constructor` to reach the JavaScript `Function` constructor. It then executes attacker-controlled JavaScript that invokes `child_process.execSync()` for command execution with output capture, or `child_process.spawn()` for detached/background execution. Capabilities in the main exploit include: single command execution (`-c`), blind execution (`--blind`), interactive pseudo-shell (`-i`), and binary deployment (`--deploy`). Deployment mode is more advanced than a simple PoC: it auto-selects or accepts an LHOST, starts a temporary HTTP server on the attacker side, instructs the target to download the binary via `curl`/`wget`, chmod it, and execute it detached so it survives the built-in 5-second synchronous execution timeout. Output is exfiltrated by parsing the RSC error `digest` field from the server response. The repository also contains a separate Bash scanner, `cve-2025-55182-check.sh`, which is a detection utility rather than the exploit itself. It tests one or more URLs using crafted multipart payloads and classifies targets based on HTTP behavior: 500 as vulnerable, 400 as patched, and 404 as not found. Additional detection templates are provided for Nuclei, Burp Suite, and OWASP ZAP under `templates/`. Supporting material includes `TECHNICAL.md`, which documents the exploit chain in detail; `poc/vuln-app/`, a deliberately vulnerable Next.js 15.0.0 / React 19.0.0 demo application exposing a server action; and `test/fixture/` plus `test/exploit.test.mjs`, which provide an automated integration-test environment validating command execution and deployment behavior against a local vulnerable instance. Overall, the repository is structured as a practical offensive toolkit with both exploitation and detection components centered on vulnerable Next.js/React Server Actions deployments.

This repository is a multi-file Python exploitation toolkit for a claimed Next.js Server Actions RCE issue labeled React2Shell / CVE-2025-55182, plus an intentionally vulnerable lab application. It is not just documentation: the repo contains working exploit orchestration, post-exploitation helpers, a reverse-shell listener, and a demo lab. Core structure: - react2shell_exploit.py: main exploit engine. It performs target page retrieval, JavaScript scraping, Action ID discovery, router-state handling, vulnerability checking, command execution, and reverse-shell generation/deployment. - interactive_shell.py: wraps the exploit engine in a cmd-based operator shell with execute/enum/escalate/upload/download/shell/info commands. - demo_exploit.py: scripted end-to-end attack chain from discovery to RCE, enumeration, privilege-escalation attempts, and proof-of-access commands. - reverse_shell_handler.py: TCP listener for incoming shells with PTY upgrade and file transfer helpers. - post_exploit/linux_enum.py: Linux enumeration module for users, groups, SUID/SGID binaries, writable paths, capabilities, kernel info, and Docker/container context. - post_exploit/priv_esc.py: automated privilege-escalation attempts using sudo, GTFOBins/SUID, writable /etc files, capabilities, and Docker socket abuse. - simple_test.py: direct proof-of-concept that extracts an executeCommand action ID from the lab page and invokes it with crafted headers and multipart form data. - lab/: intentionally vulnerable Next.js application and deployment artifacts (Dockerfile, docker-compose, Kubernetes manifest, setup scripts). Main exploit capability: The exploit targets a web application over HTTP, discovers Server Action identifiers from HTML/JS, then sends crafted requests using React/Next-specific headers such as RSC and Next-Action to invoke server-side actions. The intended outcome is arbitrary shell command execution on the Next.js server. The toolkit then expands this into interactive access, reverse shells, file transfer, and Linux post-exploitation. Target/lab details: The included lab is a Next.js 16.0.6 app with React/React DOM/react-server-dom-webpack 19.2.0, exposed on port 3000. Its app/actions.js intentionally exports executeCommand(command) and executeTask(taskData), both of which call child_process.exec on attacker-controlled input. That means the lab itself contains explicit command-execution backdoors, making exploitation straightforward even aside from the claimed framework/parser bug. Notable observables: - Primary target URL throughout docs and scripts: http://127.0.0.1:3000 - Reverse shell listener default: 0.0.0.0:4444 - Next.js-specific request indicators: RSC: 1 and Next-Action headers - Sensitive file targets and escalation paths: /etc/passwd, /etc/shadow, /etc/sudoers, /root, /var/run/docker.sock Assessment: This is a real exploit-oriented repository rather than a detector. It is best classified as OPERATIONAL: it includes hardcoded but functional payloading and post-exploitation logic, though it is not integrated into a major exploitation framework. One caveat is that the repository mixes a claimed Next.js vulnerability exploit with an intentionally vulnerable demo app that directly executes commands, so the lab proves command execution but does not by itself validate the underlying claimed CVE mechanics.

Small standalone Python proof-of-concept repository for CVE-2025-55182 ('React2Shell'). The repo contains only a license, a minimal README, and one executable script: react2shell.py. The script accepts a target URL and arbitrary command, builds a malicious multipart/form-data POST body, and sends it directly to the supplied target using the requests library with TLS verification disabled. The injected payload is JavaScript intended for a vulnerable server-side React/Next.js-like runtime: it abuses object/prototype manipulation fields and a crafted _response/_prefix structure to reach process.mainModule.require('child_process').execSync(), execute the attacker command, and convert stdout to a single-line string. It then throws a NEXT_REDIRECT-style error object so the application places the command output into a redirect destination (/login?a=<output>), which the exploit extracts from the X-Action-Redirect response header and prints. This is a real exploit rather than a detector: its primary capability is unauthenticated remote command execution with output retrieval. The code is concise, single-file, and operational, but not heavily weaponized or generalized beyond basic command execution.

Small standalone Go exploit repository with 3 files: MIT LICENSE, minimal README, and a single executable source file cve-2025-55182.go. The Go program is the sole entry point and implements an interactive RCE client for CVE-2025-55182, branded in the banner as 'React2Shell RCE'. It prompts the operator for a target URL, normalizes it to HTTP(S), performs a vulnerability check by sending a crafted multipart/form-data POST request, and then enters a loop that accepts arbitrary commands. Core exploit logic is split across four functions: payload() builds a malicious multipart body containing JavaScript intended for server-side evaluation; exploit() sends the POST request with TLS verification disabled and redirects suppressed; isVuln() tests exploitation using 'echo test' and checks whether the response contains an X-Action-Redirect header matching /login?a=; exec() sends operator-supplied commands and extracts command output from the redirect value. The payload abuses a JavaScript constructor/prototype chain and invokes process.mainModule.require('child_process').execSync(...) to run shell commands on the remote host. Output is encoded into a forced NEXT_REDIRECT digest targeting /login?a=<output>, then recovered from the response header. This is a real exploit rather than a detector-only script because it provides post-check command execution capability. It is operational but not heavily weaponized: payloads are hardcoded, target path is simply the supplied base URL, and there is no automation for mass scanning, persistence, or lateral movement. The main fingerprintable behaviors are POST requests to the target root URL, use of Next-Action and X-Nextjs-Request-Id headers, multipart form submission, and reliance on the X-Action-Redirect header containing /login?a= data.

Single-file Python exploit targeting CVE-2025-55182 in Next.js React Server Components. The repository contains one async script, CVE-2025-55182.py, which uses httpx to send a crafted multipart/form-data POST request to a user-supplied target URL with the Next-Action header set. The payload abuses server-side object/prototype manipulation fields and injects a Node.js expression into the _response._prefix field, ultimately invoking child_process.execSync on the server. The hardcoded command creates a FIFO at /tmp/f and launches a netcat-based reverse shell to attacker-supplied lhost/lport values. The exploit is not a scanner or detector; it is an operational unauthenticated RCE proof-of-concept with a built-in payload. Repository structure is minimal: one Python entry-point script, no framework integration, no auxiliary files, and no defensive checks or target validation logic.

Small standalone PoC repository with 2 files: one Python exploit script and one README. The main exploit file, CVE-2025-55182-React2Shell.py, uses Python requests to send a single crafted multipart/form-data POST request to a user-supplied target URL. The payload is structured as JSON fields intended to abuse React Server Components / Next.js Flight deserialization, including prototype-chain manipulation markers such as __proto__ and constructor references. The malicious object injects a JavaScript snippet into the _response._prefix field that calls process.mainModule.require('child_process').execSync(...) on the server. The hardcoded command launches a reverse shell using busybox netcat to the attacker-controlled LHOST on port 4444. The exploit is operational but basic: it has a fixed payload and no target validation, reliability checks, or alternate shell options beyond manual code editing. The README documents the claimed target as CVE-2025-55182 affecting React Server Components versions 19.0, 19.1.0, 19.1.1, and 19.2.0, with Next.js mentioned as an affected deployment context. Overall purpose: unauthenticated remote code execution against vulnerable Node.js/React server endpoints by sending one crafted HTTP request that triggers server-side command execution and a reverse shell callback.

This repository is a minimal proof-of-concept exploit consisting of two files: a short README naming 'React2Shell' and CVE-2025-55182, and a single raw HTTP request file named `react2shell`. The exploit is not source code in a traditional language but a crafted multipart/form-data POST request intended for replay through Burp Suite or a similar HTTP testing tool. The main capability is remote code execution against a vulnerable Next.js / React Server Components request handler. The request abuses specially structured form fields and object properties such as `__proto__` and `constructor:constructor`, indicating prototype/deserialization-style manipulation of server-side JavaScript objects. The injected JavaScript payload uses `process.mainModule.require('child_process').execSync('id', {'timeout':5000})` to execute a shell command on the server. It then throws a `NEXT_REDIRECT` error with the command output embedded in the `digest` field, which appears intended to leak execution results back in the HTTP response. Repository structure is extremely small and operational: there is no automation, scanner, or exploit framework integration. The `react2shell` file is the sole entry point and contains a complete replayable exploit request. The sample target is `localhost:3000` at path `/`, suggesting testing against a local development server, but the request can likely be adapted to any reachable vulnerable deployment. Because the payload is hardcoded to run `id` yet clearly demonstrates command execution and output retrieval, this is best classified as an operational exploit rather than a mere detection script.

Repository contains a Python-based scanner/exploit (`scanner.py`), dependency file, README, and a Dockerfile for building/running a vulnerable Next.js demo application. The core capability is exploitation of the claimed React2Shell / CVE-2025-55182 issue in React Server Components / Next.js Flight handling. The Python script is not just a passive detector: it builds multipart/form-data payloads intended to reach vulnerable server-side React/Next.js parsing logic and trigger JavaScript execution through crafted model fields (`__proto__`, `constructor:constructor`) and a `_prefix` snippet that calls Node.js `child_process.execSync`. The hardcoded commands are benign arithmetic checks for Unix-like and Windows targets, making this an operational PoC rather than a fully weaponized framework. Notable exploit features visible in the code include: host normalization, custom header parsing, multithreaded scanning with progress display, optional safe-check mode, optional Windows mode, optional WAF-bypass padding, and a dedicated Vercel WAF-bypass payload variant. The payload attempts to force a `NEXT_REDIRECT` and embed command output into `/login?a=${res}` so the scanner can infer successful code execution from HTTP behavior (README examples show 303 responses). This indicates the exploit relies on application-layer response side effects rather than an interactive shell. The README describes scanning single hosts or host lists, saving results, using custom headers/cookies, and targeting Windows. It also references a separate shell script (`datscan.sh` / `scanner.sh`) and a Nuclei template, but those files are not present in the repository, so the actionable code here is the Python scanner only. The Dockerfile appears unrelated to the Python scanner itself and is meant to containerize a vulnerable Next.js app for lab testing. Overall, the repository’s purpose is to validate and demonstrate pre-auth RCE against vulnerable React/Next.js deployments over HTTP(S), with both detection-oriented and active command-execution checks.

This repository is a small standalone proof-of-concept exploit for CVE-2025-55182, branded 'React2Shell'. It contains two files: a README with usage examples and one Python script, hehe.py, which is the actual exploit entry point. The script uses requests to send a crafted multipart/form-data POST request to a user-supplied target URL, disables TLS verification warnings, and parses the HTTP response for command output. The exploit’s core capability is remote command execution against a vulnerable Next.js/React Server Components server. It builds a malicious JSON structure embedded in multipart form fields that injects JavaScript into the server-side processing flow. The injected code calls process.mainModule.require('child_process').execSync(...) with an operator-controlled command and a 5-second timeout, converts the output to a string, and places that output into an error digest field by throwing a crafted NEXT_REDIRECT error object. The client then extracts the digest value from the response body using regex patterns and prints the recovered command output. Operationally, the script supports both one-shot execution and an interactive shell-like loop. In interactive mode it repeatedly accepts commands, sends them to the target, and prints returned output. It also includes convenience text showing reverse shell command examples, but it does not automatically deploy a reverse shell payload itself. Because the payload is operator-controlled but basic and hardcoded into the exploit logic, the maturity is best classified as OPERATIONAL rather than framework-grade weaponized. Notable request characteristics useful for fingerprinting include the custom Next.js-related headers Next-Action, X-Nextjs-Request-Id, and X-Nextjs-Html-Request-Id; a fixed multipart boundary string; and a browser-like User-Agent ending with Assetnote/1.0.0. The exploit targets a web/network attack surface and is clearly an exploit rather than a detector, README-only artifact, or fake sample.

This repository is a self-contained Dockerized CTF challenge that intentionally implements a Node.js/Express remote code execution flaw simulating CVE-2025-55182 in a React/Next.js-style server action flow. The core logic is in server.js, which starts an Express app on port 5555, parses multipart form data with multer, and on POST / reads form field "0" as JSON. It then extracts payload._response._prefix and passes it directly to eval(), creating a deliberate arbitrary JavaScript execution sink. The exploit capability is real within the challenge environment: an attacker can send a crafted multipart/form-data POST request to / containing a JSON object with _response._prefix set to malicious JavaScript. The walkthroughs demonstrate two main payload classes: (1) command execution using process.mainModule.require('child_process').execSync(...) and (2) a reverse shell using Node's net module plus child_process.spawn('/bin/sh', []). The server is designed to catch a thrown NEXT_REDIRECT error and reflect attacker-controlled data into X-Action-Redirect and Location headers, which serves as an exfiltration channel for command output. Repository structure: server.js contains the vulnerable backend and is the main exploit target; public/index.html is a themed fake login page with a hint about POST / and RSC headers; Dockerfile and docker-compose.yml package and expose the challenge on port 5555; package.json defines a minimal Express/multer app; README.md explains the challenge and vulnerability concept; WALKTHROUGH_EN.md and WALKTHROUGH_ES.md provide detailed exploitation steps and payload examples. This is not a detection script and not merely documentation—the repository contains runnable vulnerable code intended for exploitation practice.

Repository is a Python-based post-exploitation toolkit centered on CVE-2025-55182 ('React2Shell'), targeting vulnerable React Server Components / Next.js Server Actions deployments. The core exploit logic appears in exploit.py and hosts_scanner.py: both craft a multipart/form-data POST request with a malicious serialized object whose _response._prefix executes JavaScript on the server via process.mainModule.require('child_process').execSync(). Command output is base64-encoded and exfiltrated through redirect metadata, primarily /login?a=<data>, then decoded client-side. exploit.py provides single-target validation plus an interactive command shell; hosts_scanner.py performs concurrent bulk detection using only echo VULN_TEST and tracks results in files/vulnerable.txt and files/trash.txt. Repository structure: shodan_parser.py uses Playwright and Shodan credentials from .env to collect candidate HTTP(S) origins into files/targets.txt. universal_scanner.py is a broad enumeration utility that, once RCE is confirmed, gathers system, container, network, filesystem, credential, privilege-escalation, and process information and saves results to scan_results.json. The infrastructure/ directory contains helper scripts that extend the RCE channel into operational post-exploitation capabilities: universal_download.py downloads arbitrary remote files in resumable base64 chunks; mongo_proxy.py runs Node.js MongoDB queries through the compromised host; mongo_dump.py writes MongoDB dumps to /tmp and can expose them via python3 -m http.server on TCP/8000; aws_dump.py writes a Node.js script to /tmp and uses ECS credentials from 169.254.170.2 to inventory AWS resources; install_ssh_key.py appends a public key to ~/.ssh/authorized_keys for persistence; trace_cleaner.py removes /tmp artifacts, SSH keys, histories, caches, and attempts log cleanup. Notable operational characteristics: TLS verification is explicitly disabled (ssl=False) across HTTP requests; the exploit assumes Linux-like shell tooling and often Node.js/python3 on the target; helper scripts are clearly post-exploitation oriented rather than mere validation. This is not just a detector: it is a functional RCE toolkit with persistence, data access, cloud enumeration, and cleanup features.

This repository is a small standalone Python proof-of-concept exploit for CVE-2025-55182, containing one executable script (CVE-2025-55182.py), a README with vulnerability background and affected versions, and a minimal requirements.txt listing requests. The script is not part of a larger exploitation framework. The exploit targets pre-authentication remote code execution in React Server Components / Server Function handling. It sends crafted multipart/form-data POST requests to a user-supplied target URL. First, check_vulnerable() performs a non-RCE probe using specially structured React Flight payload fields intended to resolve Function through __proto__; a vulnerable target is inferred when the server returns HTTP 500 with Content-Type containing text/x-component and a React digest marker in the body. If the target appears vulnerable, or if --force is used, run_exploit() sends a second crafted payload that abuses deserialization/prototype resolution to reach JavaScript Function construction and execute Node.js code. The embedded JavaScript payload uses process.mainModule.require('child_process').execSync(...) to run an operator-supplied command with a timeout. The command output is converted to a string and deliberately thrown inside an Error object with a digest field so the script can recover the output from the HTTP response body using a regex and JSON parsing. This gives the operator direct command execution and output retrieval over HTTP. Repository structure is simple: the Python script handles CLI parsing, optional proxy/header/cookie support, vulnerability checking, exploitation, and output parsing. Logging helpers provide status messages. There is no persistence, lateral movement, or post-exploitation automation beyond arbitrary command execution. Overall, this is an operational RCE PoC with customizable command input but limited scope beyond single-command execution and response parsing.

Small standalone Python exploit repository with 2 files: a README and one executable script, react2Shell.py. The script is the main entry point and uses Python requests to send a crafted multipart/form-data POST request to a user-supplied target URL. The payload abuses a React Server Components / Next-Action deserialization/prototype-pollution style primitive to reach JavaScript's Function constructor and invoke process.mainModule.require('child_process').execSync(...), yielding remote command execution on the server. The exploit is operational rather than just a PoC because it accepts arbitrary operator-supplied commands and the README includes a working reverse-shell example. Notable implementation details: a hardcoded Host header of http://reactor.htb:3000, custom Next-Action header set to x, a fixed multipart boundary, and a JSON structure embedding the malicious _prefix expression. Repository purpose is straightforward: deliver unauthenticated RCE against an allegedly vulnerable Next.js 15.0.3 target associated with CVE-2025-55182, with example usage against reactor.htb and optional reverse shell callback to port 4444.

This repository is a compact standalone Python proof-of-concept exploit for unauthenticated remote code execution in React Server Components / Next.js Flight protocol handling, targeting CVE-2025-55182 and the downstream Next.js issue CVE-2025-66478. The repository contains four files: a README with vulnerability description and usage examples, a single executable exploit script (react2shell.py), a minimal requirements.txt listing requests, and a .gitignore. The main logic is in react2shell.py. It is a CLI tool that accepts a target URL and supports multiple modes: check, exec, shell, file, and revshell. The exploit constructs a malicious multipart/form-data request intended for a vulnerable React Flight endpoint. Based on the visible code and README, it abuses prototype-chain access during deserialization to reach the JavaScript Function constructor through crafted references such as $1:__proto__:then and $1:constructor:constructor. The payload is JavaScript executed in the target Node.js process. Capabilities include: (1) checking whether the target appears exploitable, (2) executing arbitrary shell commands via child_process.execSync, (3) reading arbitrary files via fs.readFileSync, (4) providing an interactive shell-like loop by repeatedly sending commands, and (5) launching a reverse shell using net.Socket and child_process.spawn with either /bin/sh or cmd.exe depending on platform. Output exfiltration is notable: instead of returning command output directly in the body, the script wraps the payload so it throws a NEXT_REDIRECT-style error whose digest causes Next.js to emit an x-action-redirect header containing a base64-encoded result in a query parameter. Fingerprintable indicators are limited because the exploit is operator-driven rather than hardcoded to a specific victim. The main network target is the user-supplied HTTP(S) base URL. The code defaults to adding http:// if no scheme is provided. It uses a default redirect path of /login for exfiltration, and reverse shell mode connects back to an operator-supplied <lhost>:<lport>. The exploit also references Next-Action and x-action-redirect headers and relies on multipart/form-data requests, all of which are useful behavioral indicators for detection. Overall, this is a real exploit rather than a detector. It is more than a basic PoC because it includes multiple post-exploitation actions and reusable operator modes, but it is still a standalone script rather than a framework module, so OPERATIONAL is the best fit.

This repository is a small standalone Ruby exploit tool named react2rubyshell (r2rs). It contains one substantive code file, r2rs.rb, plus a README, license, and gitignore. The script is not a framework module; it is a direct operator-facing exploit that targets a web-accessible vulnerable endpoint associated with CVE-2025-55182 / react2shell. The exploit’s core purpose is to turn a vulnerable HTTP endpoint into an interactive remote shell. The operator supplies a target host, hostname, or full URL, optionally with a port. The script normalizes the target, opens a persistent Net::HTTP connection, and repeatedly sends crafted multipart/form-data POST requests to the target URI. The malicious request body contains a JSON structure designed to abuse a server-side action flow: it injects JavaScript into a field named _prefix and uses process.mainModule.require('child_process').execSync(..., {shell:'/bin/sh', timeout:10000}) to run arbitrary shell commands on the remote host. Output handling is more than a simple one-shot PoC. For each command, the exploit generates a random marker, wraps the shell command so the marker appears before and after command output, and then parses the HTTP response for a "digest" field containing the exfiltrated result. This allows the tool to reliably extract command output from the server response. Before starting the interactive loop, it performs a validation step by echoing a random probe token and confirming that the token is returned. Once validated, the script provides an interactive Readline-based shell experience. It tracks remote context by querying user, hostname, current working directory, and HOME, then updates the prompt after each command. It also preserves a pseudo-session by prepending future commands with a cd into the last known remote working directory. This is not a true PTY, but it is an operational remote shell over HTTP suitable for arbitrary command execution and basic post-exploitation tasks. Repository structure is minimal: - README.md: usage, requirements, examples, and limitations. - r2rs.rb: full exploit implementation and CLI entry point. - LICENSE and .gitignore: ancillary files. Notable exploit characteristics: - Attack surface: web/network. - Transport: HTTP or HTTPS to an operator-specified target path. - Exploit primitive: server-side JavaScript injection leading to Node.js child_process command execution. - Result: interactive command execution with stdout/stderr capture and lightweight session context. - Limitations: no true PTY; TTY-sensitive programs may not work well. Overall, this is a real, functional exploit rather than a detector. It is best classified as OPERATIONAL because it delivers a working remote shell with a hardcoded exploitation method and interactive command loop, but it is not packaged as a larger reusable exploitation framework.

This repository is a small standalone Python exploit project centered on exploit.py, with a README and a minimal requirements.txt. The code is not part of a major exploitation framework. Its stated purpose is exploitation of CVE-2025-55182, described as a prototype-pollution-to-RCE issue affecting Next.js applications using React Server Components. The main capability implemented in the visible code is remote command execution over HTTP against a user-supplied target URL. The script accepts a target URL and either executes a single command (--cmd, default id) or launches a local browser-accessible interface (--web-cli). The local interface is served with Python's http.server/socketserver stack and presents a terminal-like HTML/JavaScript page. Commands entered in the browser are sent to a local endpoint (/run_cmd), which then invokes the exploit's core RCE routine against the remote target and returns the output for display. Based on the README and visible code/comments, the exploit works by sending a crafted payload to a vulnerable Next.js endpoint, abusing prototype pollution to influence internal server-side behavior and trigger Node.js child_process execution. Output is reportedly recovered from an error response field (digest). The exact remote vulnerable path and full request body are not visible in the provided truncated code, so no definitive remote application endpoint can be extracted from the snippet. Repository structure is simple: README.md documents usage and theory, exploit.py contains all exploit logic plus the local web UI server, and requirements.txt lists requests and dependencies. The exploit is operational rather than just a PoC because it includes usable command-execution functionality and an operator interface, but it does not appear weaponized or framework-integrated from the provided material.

This repository is a small standalone exploit repo containing one Python exploit script and a minimal README. The main file, CVE-2025-55182.py, is a command-line RCE exploit for CVE-2025-55182. It is not part of a larger exploitation framework. The exploit is structured around an ExploitConfig dataclass and an Exploit class. The class handles URL normalization, payload generation, vulnerability checking, command execution, interactive shell behavior, and batch scanning with threading. It uses requests for HTTP(S) communication, disables TLS warnings, rotates User-Agent strings, and supports configurable timeout, SSL verification disabling, and thread count. Core capability: the script builds a malicious JavaScript payload that is intended to execute on a vulnerable Node.js-backed web application. The payload calls child_process.execSync() with an operator-supplied command, captures stdout, base64-encodes it, and forces the application into a crafted NEXT_REDIRECT error/redirect flow. The encoded command output is embedded in a redirect to /login with query parameter a, which the exploit can recover and decode. This makes the exploit a true remote command execution tool rather than a detector. Operational modes visible in the script include: check-only mode using the test command 'id'; direct single-command execution; interactive shell mode; and batch scanning of targets from a file using a thread pool. The script prints status messages and can be used to validate vulnerability or repeatedly run arbitrary commands. Fingerprintable observables are limited because the target endpoint path appears to be dynamically crafted in truncated code, but the payload clearly references /login as the redirect sink for exfiltration. The exploit accepts arbitrary target base URLs over HTTP or HTTPS and defaults to HTTPS when no scheme is provided. No hardcoded IPs, domains, registry keys, or external C2 infrastructure are present. Overall, this is an operational standalone Python web exploit for unauthenticated or low-friction remote command execution against a vulnerable web application implementing the affected server-side JavaScript request handling path.

Repository contains a single Python 2.7 exploit script and a README. The main file, CVE-2025-55182.py, is a standalone exploit for CVE-2025-55182 targeting vulnerable Next.js applications. It supports two modes: (1) single-target interactive command execution and (2) multithreaded mass scanning from a file of targets. The exploit normalizes user input to HTTPS by default, appends /login when no path is provided, and sends a crafted multipart/form-data POST request with specially structured fields intended to trigger prototype pollution and constructor abuse in a Next.js server-side context. The injected JavaScript payload uses process.mainModule.require('child_process').execSync() to run arbitrary OS commands and then forces a redirect whose digest embeds the command output in /login?a=<output>. The script parses the x-action-redirect response header to determine success and recover output. Mass-scan mode uses a Queue with worker threads and writes successful results to a local file. Overall, this is a real exploit rather than a detector: its primary capability is unauthenticated remote command execution with basic output retrieval, packaged as an operator-friendly shell/scanner.

Small standalone PoC repository with two files: a README describing CVE-2025-55182 and affected React/Next.js versions, and a single Python exploit script. The exploit uses argparse to accept a target URL (-u) and arbitrary command (-c), then sends a multipart/form-data POST request with a crafted JSON structure intended to abuse React Server Components / Next.js server action processing. The malicious payload injects JavaScript into the server-side processing path, uses process.mainModule.require('child_process').execSync() to run the supplied command with a 5-second timeout, converts stdout to a string, and throws a manipulated NEXT_REDIRECT error containing the command output in the digest field. The script prints the HTTP status code and response body, allowing the operator to observe execution results. There is no scanning, brute force, persistence, or post-exploitation automation; it is a direct RCE proof-of-concept against a user-specified web endpoint.