ryanhafid/scan_cve-2025-55182Mass RCE exploit script for CVE-2025-55182 (React2Shell) targeting Next.js applications. Automates payload injection, command execution, and output parsing across multiple hosts for efficient vulnerability assessment.
A modified Mass RCE Exploit script for CVE-2025-55182 (React2Shell) targeting Next.js applications.
This tool is a modification of the original PoC script by pax-k. While the original script targets a single host, this version is enhanced to support mass scanning from a list of URLs, automating payload injection, command execution, and output parsing for efficient vulnerability assessment.
list.txt).curl, openssl, and standard bash utilities.Big appreciation to the security researchers and teams who uncovered this vulnerability:
Ensure you have a Linux environment (Kali Linux, Ubuntu, etc.) with the following installed:
bashcurlopensslgrep & cutClone or download the script.
Make the script executable:
chmod +x mass-pwn.sh
Create a text file (e.g., list.txt) and add your target URLs line by line. Ensure you include the protocol (http:// or https://).
nano list.txt
Format:
Plaintext
[https://target-one.com](https://target-one.com)
[http://vulnerable-site.net](http://vulnerable-site.net)
[https://testing.corp.local:3000](https://testing.corp.local:3000)
2. Run the Exploit
Run the script by providing the target list file and the command you want to execute.
Syntax:
Bash
./mass-pwn.sh <list_file> "<command>"
Examples:
Check current user on all targets:
Bash
./mass-pwn.sh list.txt "whoami"
Check hostname:
Bash
./mass-pwn.sh list.txt "hostname"
Attempt to read system files (if vulnerable):
Bash
./mass-pwn.sh list.txt "cat /etc/passwd"
⚠️ Legal Disclaimer
FOR EDUCATIONAL PURPOSES ONLY.
This tool is developed and distributed solely for security research, authorized penetration testing, and educational purposes.
No Liability: The author and contributors are NOT responsible for any damage, data loss, server compromise, or legal issues caused by the misuse of this tool.
No Unauthorized Use: Do not use this tool against systems, networks, or applications that you do not own or do not have explicit, written permission to test.
Legal Consequences: Unauthorized access to computer systems is illegal and punishable by law. You are solely responsible for your actions and any legal consequences that may arise.
By using this script, you agree that you understand these terms and will not use this tool for malicious purposes.