React2Shell

The supplied repository contains README.md (7,421 bytes) and react2shell_poc.py (4,185 bytes), totaling 11,606 listed file bytes. No repository URL, Git reference, or archive size was provided; repo.size_bytes=0 denotes unavailable archive metadata. This is a standalone Python exploit, not a framework module or detection-only script. The README describes CVE-2025-55182, claimed affected package ranges, remediation, raw HTTP examples, and command/reverse-shell usage. Its embedded images and badge URLs are documentation resources, not endpoints called by the exploit. The Python entry point uses argparse and requests. build_multipart_body constructs a three-part React Flight payload using prototype and constructor references to reach attacker-controlled JavaScript execution during deserialization. exploit sends it to the supplied URL with Next-Action: x, Next-Router-State-Tree: b5dce965, and a fixed multipart boundary. Command mode executes a configurable command with a five-second execution timeout and exposes stdout through an error digest. Reverse-shell mode uses Node.js net and child_process modules to connect /bin/sh to a configurable TCP listener. Static inspection supports a genuine exploitation attempt, but successful execution was not verified. Important limitations include direct, unescaped interpolation into JavaScript and JSON, which can break commands containing quotes, backslashes, or newlines; reliance on process.mainModule.require; and no HTTP request timeout. The output parser expects a complete JSON response even though the README demonstrates line-oriented React Flight responses, so successful command output may only appear in the printed raw response. Reverse-shell mode prints that the payload was sent without verifying execution or callback establishment. README version and remediation claims should be checked against authoritative advisories rather than treated as validated by this code.

The repository contains a standalone Python exploit script, a short README documenting its command-line options, and a GPLv3 LICENSE. The script uses requests and standard-library argparse/sys; it is not integrated with an exploit framework. Its stated target is CVE-2025-55182. The exploit sends a multipart POST to the supplied URL with Next-Action: ArcaneFrog and the fixed boundary ----WebKitFormBoundaryabcdef123456. Form field 0 contains a crafted React Flight object using __proto__:then and constructor:constructor references; field 1 contains "$@0". The embedded JavaScript attempts to invoke child_process.execSync with the operator's command. These headers, boundary, and model strings provide useful request-level fingerprints. There is no hardcoded remote infrastructure. The --test option only checks the X-Powered-By header for Next.js and is not a CVE-specific detection test. Both request modes disable TLS certificate verification and use a ten-second timeout. The exploit ignores HTTP status and response content, printing 'Done' whenever the request completes, so that message does not demonstrate successful execution. Reliability limitations include unescaped command interpolation, an optional --cmd argument that becomes the literal command 'None' when omitted, and a multipart body lacking the conventional terminating boundary. The program also exits with status 1 after either mode. Static inspection supports a genuine exploitation attempt, but successful execution has not been validated. No dependency manifest or automated tests are provided. The repository URL, git reference, and archive size were not supplied; empty strings and zero represent unavailable metadata.

The supplied repository contains three files: README.md (22,909 bytes), poc.py (8,901 bytes), and requirements.txt (8 bytes). The README documents React2Shell/CVE-2025-55182, affected RSC packages, impact, and security references; its supplied contents are partially truncated. requirements.txt declares only requests. poc.py is a standalone Python 3 CLI, with embedded JavaScript, organized into configuration, terminal presentation, payload generation, HTTP execution, and response parsing classes. It is not a recognized exploit-framework module. The script constructs a three-part multipart/form-data body containing forged RSC chunk references and prototype/constructor traversal properties. The embedded JavaScript calls child_process.execSync with a configurable command, then throws a NEXT_REDIRECT error whose digest includes command output in /login?a=. It posts to the configured target with Next-Action: x, generated X-Nextjs-Request-Id and X-Nextjs-Html-Request-Id headers, and the fixed multipart boundary ----TnVsbABoundary. It parses X-Action-Redirect for output, URL-decodes the captured value, and reports success or HTTP/connection failures. The request has a 15-second timeout, disables TLS certificate verification, suppresses TLS warnings, and does not follow redirects. This is an execution attempt rather than passive detection: even the default id command runs on the target if exploitation succeeds. Although the README discusses multiple RSC integrations, the implemented output channel is specifically Next.js-oriented. There is no separate exfiltration server, payload download, persistence mechanism, or evidence of malicious local execution against the operator. Reliability limitations include manual JSON construction rather than proper serialization: some commands containing quotes or control characters can invalidate the payload. Output is inserted into the redirect digest without URL encoding, and semicolons truncate the client's extraction, so arbitrary output may not be recovered faithfully. The server-side runtime assumptions and redirect behavior also limit applicability. Static inspection supports an exploit classification, but successful execution is unverified. The original repository URL, git reference, and archive size were not provided; empty strings and zero represent unavailable metadata, not measured archive values.

This is a standalone Python proof-of-concept exploit repository for CVE-2025-55182 (React2Shell), an unsafe React Server Components deserialization issue affecting specified react-server-dom-webpack, react-server-dom-turbopack, and react-server-dom-parcel releases. Its primary executable, exploit/exploit.py, uses requests and a randomized multipart/form-data body to submit a crafted RSC object to a user-supplied target URL. The object reaches Node.js child_process APIs: command mode uses execSync, Base64-encodes stdout, and extracts it from X-Action-Redirect; reverse mode launches a detached reverse shell and includes nc, mkfifo/nc, sh, bash, and Perl payload variants. The exploit disables TLS certificate verification and randomizes multipart boundaries, user agents, object identifiers, and references. The repository also provides a Docker-based comparison lab under docs/: a vulnerable Next.js/React 19.2.0 application exposed on localhost:3011 and a patched React 19.2.1 application on localhost:3012. The vulnerable application includes a server action, while both example applications fetch data from jsonplaceholder.typicode.com. Supporting files include Dockerfiles, Next.js configuration, TypeScript layouts/pages, package manifests, Python dependency declarations, screenshots/examples, and documentation describing affected and patched packages. This is exploit code rather than a detection-only script; its command and reverse-shell functionality makes it operational, although targets and callback addresses are operator supplied.

This 29-file repository is an intentionally vulnerable Docker-based Next.js laboratory and a standalone Python exploit for CVE-2025-55182, described as React2Shell. The main exploit, exploitReact2Shell/exploit.py, uses requests to submit a specially structured multipart React Server Components/Next Action request. The serialized payload reaches a JavaScript gadget that calls Node.js child_process.execSync with an operator-controlled command. It disables TLS certificate verification, does not follow redirects, and recovers output from a /login?a= value in X-Action-Redirect. It is a functional command-execution exploit rather than a scanner, and supports arbitrary targets and commands, with id as its default command. The vulnerable-app directory contains a minimal TypeScript/React Next.js corporate-portal interface pinned to Next.js 15.0.3 and a React 19 RC. Dockerfile and docker-compose.yml build the application, publish it on 3001, and map host TCP/3022 to container SSH port 22. The backdoor directory contains Bash and Windows batch automation that repeatedly invoke the exploit against localhost:3001 to install OpenSSH, create account a with UID/GID 0 and password ciao, enable password SSH authentication, alter PAM, and start sshd. The remaining roba_utile files are project notes, source aggregation material, and reference links; they do not provide additional exploitation logic.

This 36-file repository is a self-contained React2Shell lab for CVE-2025-55182. The main exploit is exploit-poc.py, a Python requests-based proof of concept that sends a crafted multipart POST with Next-Action: x and a malicious React Flight object to a caller-supplied target URL. The object uses prototype/constructor gadget fields and injects server-side JavaScript, causing Node.js child_process.execSync to run a hard-coded cat /etc/passwd command. It parses a returned error digest to display command output, demonstrating unauthenticated RCE rather than merely detecting a vulnerable version. The repository also includes parallel minimal Next.js applications: vulnerable-app pins Next.js 15.5.6 with React/React DOM 19.1.0, while patched-app uses Next.js 15.5.7 with React/React DOM 19.1.2. Both expose a simple Server Action, echoAction, through a form. Docker Compose builds and runs these apps as react2shell-vulnerable and react2shell-patched, binding them only to loopback ports 3000 and 3001 respectively. Dockerfiles use Node 20 Alpine multi-stage builds and standalone Next.js output. The remaining files are standard Next.js/Tailwind configuration, static assets, lockfiles, and basic UI sources. No external command-and-control, callback listener, persistence mechanism, or non-local network destination is present.

This three-file repository is an operational DockerLabs attack chain rather than a detection-only proof of concept. README.md is a Spanish walkthrough documenting reconnaissance of an exposed Node.js Inspector on TCP/9229 and a root-run Next.js 15.0.0-rc.1 portal bound to localhost:3000. node_rce.py is a Python command-execution utility: it retrieves the Inspector's debugger WebSocket from /json/list, submits a Chrome DevTools Protocol Runtime.evaluate request, and causes Node's child_process.execSync to execute an attacker-provided Bash command. Commands are Base64-wrapped and their output is returned to the operator. react2shell.py embeds the same Inspector access as an initial foothold, creates two malicious serialized RSC payload files in /tmp, and uses curl running through the compromised Node process to POST them to the local Next.js application with Next-Action: x. The payload is intended to exploit the stated React2Shell/CVE-2025-55182 deserialization/prototype-pollution path, execute JavaScript via a Function-constructor chain in the Next.js process, and exfiltrate execSync output through an x-action-redirect header. The documented chain yields webuser-level RCE first and root-level RCE second.

edu-recon is a Python 3.10+ reconnaissance, vulnerability-triage, and active assessment orchestrator aimed at education-sector engagements. It has 38 files, primarily Python modules, with `recon.py` as the CLI entry point and `run.sh` as a one-command launcher. Its stdlib web UI (`edurecon/webui.py`) exposes scan submission, live logs, findings, report/reproduction generation, and dump functions; it defaults to localhost but can be bound to all interfaces without authentication. The engine expands CIDRs through nmap ping sweeps and domains through subdomain enumeration, then concurrently runs Shodan enrichment, nmap service/version scanning, dirsearch web discovery, exposure checks, secret/API-key scanning, Moodle auditing, reflected-XSS and SQLi checks, Hydra credential attacks, and WordPress wp2shell processing. Full intensity actively invokes sqlmap and Hydra; recon mode lists those candidates instead. It uses external repositories installed by `setup` for PHP-CGI, React2Shell, WordPress, and directory-scanning capabilities. Built-in CVE probes target PHPUnit eval-stdin RCE (CVE-2017-9841), Apache traversal/LFI (CVE-2021-41773), Struts S2-045 (CVE-2017-5638), Confluence OGNL RCE (CVE-2022-26134), Drupalgeddon2 (CVE-2018-7600), Next.js middleware bypass (CVE-2025-29927), PHP-CGI (CVE-2024-4577/CVE-2024-8926), and React Server Components RCE (CVE-2025-55182). Several internal checks use benign confirmation markers/arithmetic oracles, but the overall repository is an active exploitation platform: full mode can perform credential guessing and injection, external wp2shell can pursue SQLi-to-shell, and React2Shell can be configured away from safe-check mode to run a command. Notable collection functionality includes downloading exposed files and backups, scanning their contents for cloud/VCS/payment/API credentials, and `gitdump.py`, which mirrors an exposed `.git` directory, retrieves reachable loose Git objects, and reconstructs source files. Artifacts, reports, findings, and potentially sensitive material are stored under `runs/<run-id>/`; report code serializes evidence and can therefore retain sensitive values. ScopeGuard supports target/CIDR and subdomain allowlisting, but supplied documentation/configuration describe scope enforcement as disabled by default, materially increasing operator-supplied target risk.

This six-file standalone Python repository combines two related but independent offensive utilities. Its principal component, react2shell-poc.py (approximately 23.6 KB and described as vendored unchanged), is a CVE-2025-55182 proof of concept targeting purported prototype-pollution-based React Server Components Flight deserialization leading to child_process.execSync execution in vulnerable Next.js App Router applications. It accepts an operator-provided HTTP(S) target and command, supports vulnerability checking, blind command execution, error-based command-output extraction, callback-based output exfiltration with an embedded threaded HTTP server, interactive operation, and a configurable reverse shell. The target URL and callback URL/port are operator supplied rather than hardcoded. cdp_privesc.py is a separate local post-exploitation helper, explicitly CVE-agnostic. It accesses a Node.js Inspector exposed on localhost port 9229, retrieves its dynamic target ID from /json, performs a manual WebSocket handshake, and sends Chrome DevTools Protocol Runtime.evaluate requests. The evaluated expression escapes through process.mainModule.require('child_process') and executes a supplied shell command in the inspector process context. Its default command makes /bin/bash SUID and runs id, which is impactful if that Node process is root-owned. cdp_privesc_note.txt documents forwarding the otherwise loopback-only inspector over SSH and using bash -p afterward. README.md provides installation and usage examples; LICENSE and .gitignore are ancillary. No common exploit framework is used.

This is a small standalone Bash proof-of-concept repository, not a Metasploit, Nuclei, or other framework module. It contains a README describing the alleged React Server Components/Next.js Server Actions deserialization RCE tracked as CVE-2025-55182 and CVE-2025-66478, a `.gitignore`, and `exploit.sh`, the sole executable entry point. The script parses target, callback, port, interface, timeout, verbosity, and custom-command options; validates curl; optionally discovers a non-loopback local IPv4 address with `ip` or `ifconfig`; and creates a temporary working directory that is removed on exit. It generates two files used as multipart form fields and sends them in one HTTP POST to `http://<target>:<port>` with `Next-Action: dontcare`. The crafted RSC references attempt to traverse `__proto__ -> constructor -> constructor` and inject an `execSync` expression through `_response._prefix`. Successful exploitation runs a supplied command as the Next.js process. Its operational default is a BusyBox netcat reverse shell back to the operator, while `-c` supports command substitution. The script suppresses curl errors unless verbose mode is enabled and does not independently verify successful exploitation; it instructs the operator to inspect their listener.

This is a small standalone Python proof-of-concept repository containing README.md and exploit.py. The Python script accepts a target URL, attacker IP, and optional listener port, then submits a crafted multipart POST request to the target root path with a Next-Action: x header. Its multipart fields contain a serialized React Server Components/Flight object designed to traverse __proto__, constructor, and constructor properties and inject a process.mainModule.require('child_process').exec(...) expression. The injected command launches a background FIFO/netcat reverse shell using /bin/sh and connects to the supplied attacker address. The script reports the HTTP result and treats a 10-second request timeout as a possible indication that execution occurred. It is an active unauthenticated RCE exploit attempt rather than a scanner or detection-only script, with a basic configurable reverse-shell payload.

This repository is a standalone Python exploit for CVE-2025-55182, described as a Next.js/React Server Components remote code execution issue via prototype pollution. The main exploit logic is entirely in exploit.py; the rest of the repository provides documentation and a Dockerized lab with vulnerable and patched sample applications for validation. The exploit works by sending a crafted multipart/form-data POST request to the target root path (/). The body contains a malicious serialized React Server Components structure that abuses __proto__ and constructor references to influence server-side processing and inject JavaScript into the Node.js runtime. In command mode, it executes arbitrary shell commands through child_process.execSync(), base64-encodes stdout, and forces a NEXT_REDIRECT error whose digest causes the output to appear in the X-Action-Redirect response header as /login?a=<encoded>. In reverse-shell mode, it uses child_process.exec() with detached execution and supports several hardcoded payload templates: nc, nc-mkfifo, sh, bash, and perl. Operational capabilities include URL normalization, randomized multipart boundaries and request headers, command execution, output parsing from redirect headers, reverse-shell listener creation, and interactive shell I/O over TCP. SSL verification is disabled by default. The exploit is operational rather than a simple PoC because it includes working payload delivery, output recovery, and reverse-shell automation, though payloads are still basic and hardcoded. Repository structure: - exploit.py: primary exploit entry point and all offensive logic. - README.md: usage instructions, examples, and lab setup. - pyproject.toml / requirements.txt: Python dependencies (requests, rich, rich-click, fake-useragent). - lab/docker-compose.yml: launches vulnerable and patched test environments. - lab/vulnerable/: vulnerable Next.js app using React 19.2.0 / Next 15.4.0 with a server action form. - lab/patched/: patched comparison app using React 19.2.1 / Next 15.4.8. - lab/packages/README.md: documents vulnerable and patched react-server-dom package versions. The lab confirms intended targeting: vulnerable React Server Components package lines include react-server-dom-webpack 19.0.0, 19.1.0, 19.1.1, and 19.2.0, plus corresponding parcel/turbopack variants listed in the package README. The vulnerable demo app exposes a server action and a root page suitable for testing the crafted request, while the patched app serves as a negative control.

This repository is a small standalone Python exploit for CVE-2025-55182 targeting vulnerable Next.js Flight / Server Actions deserialization behavior. The repo contains only two files: a README describing the vulnerability and usage, and a single executable script, exploit.py, which is the main entry point. The exploit works by sending a crafted multipart POST request to a user-supplied target URL. In build_exploit(), it constructs a malicious Flight chunk designed to abuse prototype-chain properties (notably then and constructor) so that server-side JavaScript reaches process.mainModule.require('child_process').execSync(). The supplied command is executed on the target with an 8-second timeout. Output is converted to string and embedded into a thrown NEXT_REDIRECT error's digest field, which the client then parses from the HTTP response body. Core capabilities include: single arbitrary command execution, an interactive stateless semi-shell where each command triggers a fresh exploit request, and a reverse shell mode. The reverse shell mode cycles through five hardcoded payload variants for resilience: python3, legacy python, bash /dev/tcp, nc -e, and busybox nc. The fire() function performs the HTTP POST, sets a random Next-Action header, handles read timeouts, and extracts command output from lines containing digest:`...`. There are no framework dependencies beyond the requests library, and no detection-only logic; this is direct exploitation code. The exploit is operational rather than merely demonstrative because it includes working payload delivery, output parsing, and multiple post-exploitation shell options. Fingerprintable artifacts include the target URL supplied by the operator, the Next-Action header, the use of NEXT_REDIRECT as an output channel, and reverse-shell-related endpoints such as attacker IP/port values and /bin/sh.

Repository is a standalone Python exploit/assessment tool named ReactRCE-Scanner for the claimed CVE-2025-55182 affecting React Server Components. The repo contains one large primary code file (exploit.py), configuration (config.yaml), install scripts for Windows and Unix, dependency manifests, and a detailed README. The main capability set described and partially evidenced in code includes target fingerprinting, multi-stage verification, concurrent scanning, command execution, pseudo-interactive shell access, DNS-based exfiltration/verification, reporting, proxy support, and additional modes for DoS and persistence. The Python file is substantial (~71 KB) and includes CLI parsing, async execution, HTTP request handling via requests/urllib3, rich terminal UI support, configuration loading, fingerprinting models, and operational modes such as exec, shell, dos, and persist. This is not merely a detector: the code paths shown indicate active exploitation routines and post-exploitation-style features. No hardcoded victim URL/IP is embedded in the provided content; targets are operator-supplied at runtime. Notable repository inconsistencies exist (e.g., requirements.txt header references an unrelated LuaStorm/Apache CVE), but the main script and README are aligned around React/Next.js RCE exploitation. Overall, this appears to be an operational standalone exploit framework rather than a simple proof-of-concept.

This repository is a small standalone Python exploit for unauthenticated RCE against vulnerable Cal.com deployments. It contains two files: a README describing the vulnerability, affected versions, usage, and remediation; and a single executable script, exploit.py, which is the main entry point. The exploit targets Cal.com <= 5.9.8 by abusing vulnerable React Server Components / Next.js Flight deserialization behavior described as react2shell. The Python script sends a crafted multipart POST request to the supplied base URL with a Next-Action header and a malicious serialized object. The payload uses prototype-pollution and constructor gadgets (notably __proto__:then and constructor:constructor) to cause server-side evaluation of attacker-controlled JavaScript. That JavaScript imports Node's child_process module and invokes execSync. Capabilities are straightforward but effective: in command mode (-c/--cmd), it executes an arbitrary shell command on the target and extracts the output from the returned response body by regex-matching the digest field. In reverse shell mode (--shell HOST:PORT), it launches a detached bash reverse shell using /dev/tcp to connect back to the attacker. The reverse shell is hardcoded to bash semantics and assumes outbound connectivity from the target. Repository structure is minimal and purpose-built: no framework, no auxiliary modules, and no detection-only logic. The exploit is operational rather than just demonstrative because it includes working payload delivery and post-exploitation options, but payload customization is manual and limited to command strings or callback host:port arguments.

This repository is a small Next.js lab environment built to demonstrate CVE-2025-55182, a React Server Components / Flight deserialization issue leading to server-side JavaScript execution. The codebase itself is minimal: app/actions.js defines a server action, app/page.js exposes a form that triggers that action, and app/layout.js provides standard layout scaffolding. package.json runs the app in development mode on 0.0.0.0:3000, while package-lock.json pins vulnerable-looking dependencies including next 15.0.0 and react/react-dom 19.0.0. The actual exploit logic is not implemented as executable code in the repository; instead, the README contains the exploit analysis and a full proof-of-concept HTTP multipart request. That request targets the root path / with Next.js-specific headers and abuses React Flight serialization markers such as $1:constructor:constructor and $B1337. The described technique forges an internal Chunk-like object, poisons _response fields, and causes deserialization to resolve Function via prototype/property traversal. The payload then invokes process.mainModule.require('child_process').execSync(...) to achieve arbitrary command execution in the Node.js server process. Operationally, this is a proof-of-concept lab rather than a weaponized exploit toolkit. It demonstrates how a remote attacker can send a crafted POST request to a vulnerable Next.js/React Server Action endpoint and obtain RCE. The README also discusses detection ideas such as Snort and OSQuery, but the repository's primary purpose is educational reproduction of the vulnerability, not automated scanning or exploitation at scale.

This repository is a small standalone Python exploit containing one executable script (`exploit.py`) and a descriptive `README.md`. It is not part of a larger exploitation framework. The script targets CVE-2025-55182, described here as a React Server Components deserialization issue affecting vulnerable React/Next.js deployments. Core capability: the exploit sends a crafted multipart/form-data POST request to the target application's root path (`/`). The multipart body contains a malicious serialized structure intended to reach JavaScript constructor access and execute Node.js code via `child_process.execSync('id')`. The payload is hardcoded to run the Unix `id` command with a 5-second timeout. It then throws a `NEXT_REDIRECT` error whose `digest` field contains the command output, allowing the Python client to recover execution results by regex-parsing the HTTP response body. Operational behavior: the script supports single-target mode (`-u`) and bulk mode (`-f`). If a target is provided without a scheme, it automatically generates both `http://` and `https://` variants. It removes duplicates, disables TLS certificate verification, uses a 10-second timeout, and executes requests concurrently with a `ThreadPoolExecutor` using 30 worker threads. On success, it prints the target and extracted command output. It can also append results to a local output file and optionally POST result metadata (`time`, `target`, `status`, `command_output`) to a user-supplied remote log server. Repository structure is minimal and purpose-built: the README documents vulnerable versions, usage examples, and the exact HTTP request format; `exploit.py` implements argument parsing, target normalization, static headers, the exploit body, response parsing, optional logging, and multithreaded execution. Overall, this is an operational proof-of-concept RCE exploit with a fixed payload rather than a generalized framework module.

This repository is a small standalone Python proof-of-concept exploit for the claimed CVE-2025-55182 'React2Shell' issue. It contains two files: a README describing the alleged vulnerability, affected products, and usage, plus a single executable script, exploit.py, which is the only code file and clear entry point. The exploit's core capability is unauthenticated remote command execution against web applications exposing React Server Components / Flight-related endpoints. The script accepts a target URL, port, and arbitrary command, builds a JSON-encoded payload that imitates a React serialized object with a nested react.module.reference pointing at module 'os', and inserts the operator-supplied command into props.command. It then iterates over several hardcoded candidate endpoints (/_rsc/, /_flight/, /__rsc, /server-actions, /api/__rsc) and sends HTTP POST requests with Content-Type text/plain;charset=UTF-8. For each request it prints the HTTP status and the first 500 bytes of the response body. Structurally, the code is simple: craft_payload() creates the serialized body; exploit() constructs the base URL, sets headers, and POSTs to each candidate endpoint; main() parses CLI arguments and launches exploitation. There is no shell listener, staging logic, persistence, or framework integration. The payload is operator-controlled but basic and hardcoded in structure, so the repository is best classified as OPERATIONAL rather than weaponized. Notable limitations: the script does not verify vulnerability beyond observing responses, does not adapt payload format per framework/version, and relies on a speculative deserialization/import-hijack model described in comments and README. Even so, the code is clearly intended as an exploit rather than a detector, because it actively delivers a command-bearing payload to likely target endpoints.

This repository is a small standalone Python proof-of-concept exploit for CVE-2025-55182 ('React2Shell'). The repo contains only four files: a standard .gitignore, MIT LICENSE, README with usage/examples, and the main exploit script react2shell_exploit.py. The exploit is not part of a larger framework. The Python script uses requests to send a crafted multipart/form-data POST request to an operator-supplied target URL. Its core logic is split into two functions: react2shell_prepare_payload(), which base64-encodes the supplied shell command and embeds it into a malicious serialized form-data structure, and react2shell_run_exploit(), which transmits the payload with verify=False. The payload abuses a deserialization / object-manipulation primitive described in the README, setting fields such as __proto__:then and constructor:constructor and injecting a Node.js expression that calls process.mainModule.require('child_process').execSync(...). The command executed on the target is 'echo <base64> | base64 -d | bash', allowing arbitrary shell execution. Primary capability: unauthenticated or low-friction remote code execution against a vulnerable React/Next.js application endpoint, depending on target exposure. The exploit supports arbitrary operator commands, including reverse shells and simple command execution for validation. It does not include persistence, privilege escalation, lateral movement, or automated target discovery. Because it includes a working hardcoded execution primitive but relies on user-supplied commands, it is best classified as OPERATIONAL rather than a mere POC. Fingerprintable observables include the custom HTTP header 'Next-Action: x', multipart boundary '----X', the serialized gadget strings, and the Node.js child_process.execSync execution primitive. The README also includes example target and callback endpoints that are demonstrative rather than hardcoded operational infrastructure.

This repository is a Wails-based desktop exploit application for CVE-2025-55182, described as a Next.js RSC remote code execution issue. It is not just a detector: the Go backend in pkg/core/exploit.go implements the exploit transport and payload generation, while the React/TypeScript frontend provides a GUI for operators. Structure: main.go and app.go initialize the Wails desktop app and expose backend methods to the frontend. The frontend contains tabs for detection, command execution, raw JavaScript execution, and module loading. The core exploit logic lives in pkg/core/exploit.go, with helper code in pkg/utils/crypto.go and pkg/utils/encoding.go. Main exploit behavior: SendComplexPayload() builds crafted multipart/form-data requests intended to abuse the Next.js RSC processing chain. It supports two payload styles: 'Array Map Chain' and 'Prototype Chain'. The injected JavaScript is wrapped so that execution results are converted to strings/JSON and then exfiltrated by throwing a forged NEXT_REDIRECT error whose digest includes '/login?a=' + encodeURIComponent(res). This indicates the exploit expects the target to process the malicious RSC structure and leak output through redirect handling. Capabilities exposed in the GUI: DetectVulnerability() sends arithmetic probe '7*3+1' and expects '22'; on success it collects process.version, process.platform, and process.arch. ExecCommand() supports synchronous or asynchronous command execution. ExecJS() runs arbitrary JavaScript. LoadModule() invokes process.mainModule.require('module')._load(path). The backend code also includes file-system operations such as WriteFile(), and the truncated exploit.go clearly shows directory listing and file handling support using fs and JSON parsing of remote results. Evasion and transport features: the tool can Unicode-escape JSON strings, encode multipart fields as UTF-16LE, and wrap the JavaScript in an AES-256-CBC decrypt-and-eval stub. It also supports configurable HTTP/HTTPS/SOCKS5 proxying and disables TLS verification when verifySSL is false. Assessment: this is a real exploit tool with operational payload delivery and post-exploitation helpers, packaged as a desktop GUI. It targets vulnerable Next.js RSC endpoints over HTTP(S), and its most fingerprintable exploit artifact is the forged NEXT_REDIRECT digest containing the /login path and query parameter a for result exfiltration.

This repository is a real exploit toolkit for CVE-2025-55182, not just a detector. Its primary component is `react2shell.mjs`, a standalone Node.js exploit that crafts malicious multipart React Server Components / Next.js Server Actions requests to achieve unauthenticated RCE. The exploit sends POST requests directly to a supplied target URL with a `Next-Action` header and `multipart/form-data` body, abusing Flight protocol references such as `$1:__proto__:then` and `$1:constructor:constructor` to reach the JavaScript `Function` constructor. It then executes attacker-controlled JavaScript that invokes `child_process.execSync()` for command execution with output capture, or `child_process.spawn()` for detached/background execution. Capabilities in the main exploit include: single command execution (`-c`), blind execution (`--blind`), interactive pseudo-shell (`-i`), and binary deployment (`--deploy`). Deployment mode is more advanced than a simple PoC: it auto-selects or accepts an LHOST, starts a temporary HTTP server on the attacker side, instructs the target to download the binary via `curl`/`wget`, chmod it, and execute it detached so it survives the built-in 5-second synchronous execution timeout. Output is exfiltrated by parsing the RSC error `digest` field from the server response. The repository also contains a separate Bash scanner, `cve-2025-55182-check.sh`, which is a detection utility rather than the exploit itself. It tests one or more URLs using crafted multipart payloads and classifies targets based on HTTP behavior: 500 as vulnerable, 400 as patched, and 404 as not found. Additional detection templates are provided for Nuclei, Burp Suite, and OWASP ZAP under `templates/`. Supporting material includes `TECHNICAL.md`, which documents the exploit chain in detail; `poc/vuln-app/`, a deliberately vulnerable Next.js 15.0.0 / React 19.0.0 demo application exposing a server action; and `test/fixture/` plus `test/exploit.test.mjs`, which provide an automated integration-test environment validating command execution and deployment behavior against a local vulnerable instance. Overall, the repository is structured as a practical offensive toolkit with both exploitation and detection components centered on vulnerable Next.js/React Server Actions deployments.

This repository is a multi-file Python exploitation toolkit for a claimed Next.js Server Actions RCE issue labeled React2Shell / CVE-2025-55182, plus an intentionally vulnerable lab application. It is not just documentation: the repo contains working exploit orchestration, post-exploitation helpers, a reverse-shell listener, and a demo lab. Core structure: - react2shell_exploit.py: main exploit engine. It performs target page retrieval, JavaScript scraping, Action ID discovery, router-state handling, vulnerability checking, command execution, and reverse-shell generation/deployment. - interactive_shell.py: wraps the exploit engine in a cmd-based operator shell with execute/enum/escalate/upload/download/shell/info commands. - demo_exploit.py: scripted end-to-end attack chain from discovery to RCE, enumeration, privilege-escalation attempts, and proof-of-access commands. - reverse_shell_handler.py: TCP listener for incoming shells with PTY upgrade and file transfer helpers. - post_exploit/linux_enum.py: Linux enumeration module for users, groups, SUID/SGID binaries, writable paths, capabilities, kernel info, and Docker/container context. - post_exploit/priv_esc.py: automated privilege-escalation attempts using sudo, GTFOBins/SUID, writable /etc files, capabilities, and Docker socket abuse. - simple_test.py: direct proof-of-concept that extracts an executeCommand action ID from the lab page and invokes it with crafted headers and multipart form data. - lab/: intentionally vulnerable Next.js application and deployment artifacts (Dockerfile, docker-compose, Kubernetes manifest, setup scripts). Main exploit capability: The exploit targets a web application over HTTP, discovers Server Action identifiers from HTML/JS, then sends crafted requests using React/Next-specific headers such as RSC and Next-Action to invoke server-side actions. The intended outcome is arbitrary shell command execution on the Next.js server. The toolkit then expands this into interactive access, reverse shells, file transfer, and Linux post-exploitation. Target/lab details: The included lab is a Next.js 16.0.6 app with React/React DOM/react-server-dom-webpack 19.2.0, exposed on port 3000. Its app/actions.js intentionally exports executeCommand(command) and executeTask(taskData), both of which call child_process.exec on attacker-controlled input. That means the lab itself contains explicit command-execution backdoors, making exploitation straightforward even aside from the claimed framework/parser bug. Notable observables: - Primary target URL throughout docs and scripts: http://127.0.0.1:3000 - Reverse shell listener default: 0.0.0.0:4444 - Next.js-specific request indicators: RSC: 1 and Next-Action headers - Sensitive file targets and escalation paths: /etc/passwd, /etc/shadow, /etc/sudoers, /root, /var/run/docker.sock Assessment: This is a real exploit-oriented repository rather than a detector. It is best classified as OPERATIONAL: it includes hardcoded but functional payloading and post-exploitation logic, though it is not integrated into a major exploitation framework. One caveat is that the repository mixes a claimed Next.js vulnerability exploit with an intentionally vulnerable demo app that directly executes commands, so the lab proves command execution but does not by itself validate the underlying claimed CVE mechanics.

Small standalone Python proof-of-concept repository for CVE-2025-55182 ('React2Shell'). The repo contains only a license, a minimal README, and one executable script: react2shell.py. The script accepts a target URL and arbitrary command, builds a malicious multipart/form-data POST body, and sends it directly to the supplied target using the requests library with TLS verification disabled. The injected payload is JavaScript intended for a vulnerable server-side React/Next.js-like runtime: it abuses object/prototype manipulation fields and a crafted _response/_prefix structure to reach process.mainModule.require('child_process').execSync(), execute the attacker command, and convert stdout to a single-line string. It then throws a NEXT_REDIRECT-style error object so the application places the command output into a redirect destination (/login?a=<output>), which the exploit extracts from the X-Action-Redirect response header and prints. This is a real exploit rather than a detector: its primary capability is unauthenticated remote command execution with output retrieval. The code is concise, single-file, and operational, but not heavily weaponized or generalized beyond basic command execution.

Small standalone Go exploit repository with 3 files: MIT LICENSE, minimal README, and a single executable source file cve-2025-55182.go. The Go program is the sole entry point and implements an interactive RCE client for CVE-2025-55182, branded in the banner as 'React2Shell RCE'. It prompts the operator for a target URL, normalizes it to HTTP(S), performs a vulnerability check by sending a crafted multipart/form-data POST request, and then enters a loop that accepts arbitrary commands. Core exploit logic is split across four functions: payload() builds a malicious multipart body containing JavaScript intended for server-side evaluation; exploit() sends the POST request with TLS verification disabled and redirects suppressed; isVuln() tests exploitation using 'echo test' and checks whether the response contains an X-Action-Redirect header matching /login?a=; exec() sends operator-supplied commands and extracts command output from the redirect value. The payload abuses a JavaScript constructor/prototype chain and invokes process.mainModule.require('child_process').execSync(...) to run shell commands on the remote host. Output is encoded into a forced NEXT_REDIRECT digest targeting /login?a=<output>, then recovered from the response header. This is a real exploit rather than a detector-only script because it provides post-check command execution capability. It is operational but not heavily weaponized: payloads are hardcoded, target path is simply the supplied base URL, and there is no automation for mass scanning, persistence, or lateral movement. The main fingerprintable behaviors are POST requests to the target root URL, use of Next-Action and X-Nextjs-Request-Id headers, multipart form submission, and reliance on the X-Action-Redirect header containing /login?a= data.

Single-file Python exploit targeting CVE-2025-55182 in Next.js React Server Components. The repository contains one async script, CVE-2025-55182.py, which uses httpx to send a crafted multipart/form-data POST request to a user-supplied target URL with the Next-Action header set. The payload abuses server-side object/prototype manipulation fields and injects a Node.js expression into the _response._prefix field, ultimately invoking child_process.execSync on the server. The hardcoded command creates a FIFO at /tmp/f and launches a netcat-based reverse shell to attacker-supplied lhost/lport values. The exploit is not a scanner or detector; it is an operational unauthenticated RCE proof-of-concept with a built-in payload. Repository structure is minimal: one Python entry-point script, no framework integration, no auxiliary files, and no defensive checks or target validation logic.

Small standalone PoC repository with 2 files: one Python exploit script and one README. The main exploit file, CVE-2025-55182-React2Shell.py, uses Python requests to send a single crafted multipart/form-data POST request to a user-supplied target URL. The payload is structured as JSON fields intended to abuse React Server Components / Next.js Flight deserialization, including prototype-chain manipulation markers such as __proto__ and constructor references. The malicious object injects a JavaScript snippet into the _response._prefix field that calls process.mainModule.require('child_process').execSync(...) on the server. The hardcoded command launches a reverse shell using busybox netcat to the attacker-controlled LHOST on port 4444. The exploit is operational but basic: it has a fixed payload and no target validation, reliability checks, or alternate shell options beyond manual code editing. The README documents the claimed target as CVE-2025-55182 affecting React Server Components versions 19.0, 19.1.0, 19.1.1, and 19.2.0, with Next.js mentioned as an affected deployment context. Overall purpose: unauthenticated remote code execution against vulnerable Node.js/React server endpoints by sending one crafted HTTP request that triggers server-side command execution and a reverse shell callback.

This repository is a minimal proof-of-concept exploit consisting of two files: a short README naming 'React2Shell' and CVE-2025-55182, and a single raw HTTP request file named `react2shell`. The exploit is not source code in a traditional language but a crafted multipart/form-data POST request intended for replay through Burp Suite or a similar HTTP testing tool. The main capability is remote code execution against a vulnerable Next.js / React Server Components request handler. The request abuses specially structured form fields and object properties such as `__proto__` and `constructor:constructor`, indicating prototype/deserialization-style manipulation of server-side JavaScript objects. The injected JavaScript payload uses `process.mainModule.require('child_process').execSync('id', {'timeout':5000})` to execute a shell command on the server. It then throws a `NEXT_REDIRECT` error with the command output embedded in the `digest` field, which appears intended to leak execution results back in the HTTP response. Repository structure is extremely small and operational: there is no automation, scanner, or exploit framework integration. The `react2shell` file is the sole entry point and contains a complete replayable exploit request. The sample target is `localhost:3000` at path `/`, suggesting testing against a local development server, but the request can likely be adapted to any reachable vulnerable deployment. Because the payload is hardcoded to run `id` yet clearly demonstrates command execution and output retrieval, this is best classified as an operational exploit rather than a mere detection script.

Repository contains a Python-based scanner/exploit (`scanner.py`), dependency file, README, and a Dockerfile for building/running a vulnerable Next.js demo application. The core capability is exploitation of the claimed React2Shell / CVE-2025-55182 issue in React Server Components / Next.js Flight handling. The Python script is not just a passive detector: it builds multipart/form-data payloads intended to reach vulnerable server-side React/Next.js parsing logic and trigger JavaScript execution through crafted model fields (`__proto__`, `constructor:constructor`) and a `_prefix` snippet that calls Node.js `child_process.execSync`. The hardcoded commands are benign arithmetic checks for Unix-like and Windows targets, making this an operational PoC rather than a fully weaponized framework. Notable exploit features visible in the code include: host normalization, custom header parsing, multithreaded scanning with progress display, optional safe-check mode, optional Windows mode, optional WAF-bypass padding, and a dedicated Vercel WAF-bypass payload variant. The payload attempts to force a `NEXT_REDIRECT` and embed command output into `/login?a=${res}` so the scanner can infer successful code execution from HTTP behavior (README examples show 303 responses). This indicates the exploit relies on application-layer response side effects rather than an interactive shell. The README describes scanning single hosts or host lists, saving results, using custom headers/cookies, and targeting Windows. It also references a separate shell script (`datscan.sh` / `scanner.sh`) and a Nuclei template, but those files are not present in the repository, so the actionable code here is the Python scanner only. The Dockerfile appears unrelated to the Python scanner itself and is meant to containerize a vulnerable Next.js app for lab testing. Overall, the repository’s purpose is to validate and demonstrate pre-auth RCE against vulnerable React/Next.js deployments over HTTP(S), with both detection-oriented and active command-execution checks.

This repository is a small standalone proof-of-concept exploit for CVE-2025-55182, branded 'React2Shell'. It contains two files: a README with usage examples and one Python script, hehe.py, which is the actual exploit entry point. The script uses requests to send a crafted multipart/form-data POST request to a user-supplied target URL, disables TLS verification warnings, and parses the HTTP response for command output. The exploit’s core capability is remote command execution against a vulnerable Next.js/React Server Components server. It builds a malicious JSON structure embedded in multipart form fields that injects JavaScript into the server-side processing flow. The injected code calls process.mainModule.require('child_process').execSync(...) with an operator-controlled command and a 5-second timeout, converts the output to a string, and places that output into an error digest field by throwing a crafted NEXT_REDIRECT error object. The client then extracts the digest value from the response body using regex patterns and prints the recovered command output. Operationally, the script supports both one-shot execution and an interactive shell-like loop. In interactive mode it repeatedly accepts commands, sends them to the target, and prints returned output. It also includes convenience text showing reverse shell command examples, but it does not automatically deploy a reverse shell payload itself. Because the payload is operator-controlled but basic and hardcoded into the exploit logic, the maturity is best classified as OPERATIONAL rather than framework-grade weaponized. Notable request characteristics useful for fingerprinting include the custom Next.js-related headers Next-Action, X-Nextjs-Request-Id, and X-Nextjs-Html-Request-Id; a fixed multipart boundary string; and a browser-like User-Agent ending with Assetnote/1.0.0. The exploit targets a web/network attack surface and is clearly an exploit rather than a detector, README-only artifact, or fake sample.

This repository is a self-contained Dockerized CTF challenge that intentionally implements a Node.js/Express remote code execution flaw simulating CVE-2025-55182 in a React/Next.js-style server action flow. The core logic is in server.js, which starts an Express app on port 5555, parses multipart form data with multer, and on POST / reads form field "0" as JSON. It then extracts payload._response._prefix and passes it directly to eval(), creating a deliberate arbitrary JavaScript execution sink. The exploit capability is real within the challenge environment: an attacker can send a crafted multipart/form-data POST request to / containing a JSON object with _response._prefix set to malicious JavaScript. The walkthroughs demonstrate two main payload classes: (1) command execution using process.mainModule.require('child_process').execSync(...) and (2) a reverse shell using Node's net module plus child_process.spawn('/bin/sh', []). The server is designed to catch a thrown NEXT_REDIRECT error and reflect attacker-controlled data into X-Action-Redirect and Location headers, which serves as an exfiltration channel for command output. Repository structure: server.js contains the vulnerable backend and is the main exploit target; public/index.html is a themed fake login page with a hint about POST / and RSC headers; Dockerfile and docker-compose.yml package and expose the challenge on port 5555; package.json defines a minimal Express/multer app; README.md explains the challenge and vulnerability concept; WALKTHROUGH_EN.md and WALKTHROUGH_ES.md provide detailed exploitation steps and payload examples. This is not a detection script and not merely documentation—the repository contains runnable vulnerable code intended for exploitation practice.

Repository is a Python-based post-exploitation toolkit centered on CVE-2025-55182 ('React2Shell'), targeting vulnerable React Server Components / Next.js Server Actions deployments. The core exploit logic appears in exploit.py and hosts_scanner.py: both craft a multipart/form-data POST request with a malicious serialized object whose _response._prefix executes JavaScript on the server via process.mainModule.require('child_process').execSync(). Command output is base64-encoded and exfiltrated through redirect metadata, primarily /login?a=<data>, then decoded client-side. exploit.py provides single-target validation plus an interactive command shell; hosts_scanner.py performs concurrent bulk detection using only echo VULN_TEST and tracks results in files/vulnerable.txt and files/trash.txt. Repository structure: shodan_parser.py uses Playwright and Shodan credentials from .env to collect candidate HTTP(S) origins into files/targets.txt. universal_scanner.py is a broad enumeration utility that, once RCE is confirmed, gathers system, container, network, filesystem, credential, privilege-escalation, and process information and saves results to scan_results.json. The infrastructure/ directory contains helper scripts that extend the RCE channel into operational post-exploitation capabilities: universal_download.py downloads arbitrary remote files in resumable base64 chunks; mongo_proxy.py runs Node.js MongoDB queries through the compromised host; mongo_dump.py writes MongoDB dumps to /tmp and can expose them via python3 -m http.server on TCP/8000; aws_dump.py writes a Node.js script to /tmp and uses ECS credentials from 169.254.170.2 to inventory AWS resources; install_ssh_key.py appends a public key to ~/.ssh/authorized_keys for persistence; trace_cleaner.py removes /tmp artifacts, SSH keys, histories, caches, and attempts log cleanup. Notable operational characteristics: TLS verification is explicitly disabled (ssl=False) across HTTP requests; the exploit assumes Linux-like shell tooling and often Node.js/python3 on the target; helper scripts are clearly post-exploitation oriented rather than mere validation. This is not just a detector: it is a functional RCE toolkit with persistence, data access, cloud enumeration, and cleanup features.

This repository is a small standalone Python proof-of-concept exploit for CVE-2025-55182, containing one executable script (CVE-2025-55182.py), a README with vulnerability background and affected versions, and a minimal requirements.txt listing requests. The script is not part of a larger exploitation framework. The exploit targets pre-authentication remote code execution in React Server Components / Server Function handling. It sends crafted multipart/form-data POST requests to a user-supplied target URL. First, check_vulnerable() performs a non-RCE probe using specially structured React Flight payload fields intended to resolve Function through __proto__; a vulnerable target is inferred when the server returns HTTP 500 with Content-Type containing text/x-component and a React digest marker in the body. If the target appears vulnerable, or if --force is used, run_exploit() sends a second crafted payload that abuses deserialization/prototype resolution to reach JavaScript Function construction and execute Node.js code. The embedded JavaScript payload uses process.mainModule.require('child_process').execSync(...) to run an operator-supplied command with a timeout. The command output is converted to a string and deliberately thrown inside an Error object with a digest field so the script can recover the output from the HTTP response body using a regex and JSON parsing. This gives the operator direct command execution and output retrieval over HTTP. Repository structure is simple: the Python script handles CLI parsing, optional proxy/header/cookie support, vulnerability checking, exploitation, and output parsing. Logging helpers provide status messages. There is no persistence, lateral movement, or post-exploitation automation beyond arbitrary command execution. Overall, this is an operational RCE PoC with customizable command input but limited scope beyond single-command execution and response parsing.

Small standalone Python exploit repository with 2 files: a README and one executable script, react2Shell.py. The script is the main entry point and uses Python requests to send a crafted multipart/form-data POST request to a user-supplied target URL. The payload abuses a React Server Components / Next-Action deserialization/prototype-pollution style primitive to reach JavaScript's Function constructor and invoke process.mainModule.require('child_process').execSync(...), yielding remote command execution on the server. The exploit is operational rather than just a PoC because it accepts arbitrary operator-supplied commands and the README includes a working reverse-shell example. Notable implementation details: a hardcoded Host header of http://reactor.htb:3000, custom Next-Action header set to x, a fixed multipart boundary, and a JSON structure embedding the malicious _prefix expression. Repository purpose is straightforward: deliver unauthenticated RCE against an allegedly vulnerable Next.js 15.0.3 target associated with CVE-2025-55182, with example usage against reactor.htb and optional reverse shell callback to port 4444.

This repository is a compact standalone Python proof-of-concept exploit for unauthenticated remote code execution in React Server Components / Next.js Flight protocol handling, targeting CVE-2025-55182 and the downstream Next.js issue CVE-2025-66478. The repository contains four files: a README with vulnerability description and usage examples, a single executable exploit script (react2shell.py), a minimal requirements.txt listing requests, and a .gitignore. The main logic is in react2shell.py. It is a CLI tool that accepts a target URL and supports multiple modes: check, exec, shell, file, and revshell. The exploit constructs a malicious multipart/form-data request intended for a vulnerable React Flight endpoint. Based on the visible code and README, it abuses prototype-chain access during deserialization to reach the JavaScript Function constructor through crafted references such as $1:__proto__:then and $1:constructor:constructor. The payload is JavaScript executed in the target Node.js process. Capabilities include: (1) checking whether the target appears exploitable, (2) executing arbitrary shell commands via child_process.execSync, (3) reading arbitrary files via fs.readFileSync, (4) providing an interactive shell-like loop by repeatedly sending commands, and (5) launching a reverse shell using net.Socket and child_process.spawn with either /bin/sh or cmd.exe depending on platform. Output exfiltration is notable: instead of returning command output directly in the body, the script wraps the payload so it throws a NEXT_REDIRECT-style error whose digest causes Next.js to emit an x-action-redirect header containing a base64-encoded result in a query parameter. Fingerprintable indicators are limited because the exploit is operator-driven rather than hardcoded to a specific victim. The main network target is the user-supplied HTTP(S) base URL. The code defaults to adding http:// if no scheme is provided. It uses a default redirect path of /login for exfiltration, and reverse shell mode connects back to an operator-supplied <lhost>:<lport>. The exploit also references Next-Action and x-action-redirect headers and relies on multipart/form-data requests, all of which are useful behavioral indicators for detection. Overall, this is a real exploit rather than a detector. It is more than a basic PoC because it includes multiple post-exploitation actions and reusable operator modes, but it is still a standalone script rather than a framework module, so OPERATIONAL is the best fit.