React2Shell - CVE-2025-55182 & CVE-2025-66478

Author: LAKSHMIKANTHAN K (letchupkt)
Instagram: @letchu_pkt
Version: 2.0.0 (Obfuscated)
Date: 2025-12-07

🚀 Quick Start

Run the Scanner

python react2shell.py

That's it! The scanner will:

Verify its integrity
Decompress the code
Execute normally

All Features Work Exactly the Same!

[1] Scan Single URL
[2] Scan Multiple URLs from File
[3] Exploit Single URL
[4] Exploit Multiple URLs from File
[5] Interactive Shell (Exploit Mode)
[6] Settings
[7] View Previous Results
[0] Exit

🎯 Usage

Interactive Mode (Recommended)

python react2shell.py

Command-Line Mode

# Scan single URL
python react2shell.py -u https://target.com

# Scan multiple URLs
python react2shell.py -f targets.txt

# Exploit with command
python react2shell.py -u https://target.com --exploit -c "whoami"

# Bulk scan with threads
python react2shell.py -f targets.txt -t 20 -o results.json

🔒 Protection Features

Integrity Verification

Every time you run the scanner, it automatically:

Decompresses the encoded source code
Calculates SHA256 hash of the code
Compares with expected hash
Blocks execution if hash doesn't match

What Happens if Modified?

If someone tries to modify the obfuscated code:

[ERROR] Scanner integrity check FAILED!
[!] The scanner code has been tampered with.
[!] This is a protected tool by LAKSHMIKANTHAN K (letchupkt)
Instagram: @letchu_pkt

The scanner will refuse to run if it detects any tampering.

✨ Features

All original features are 100% preserved:

Dual CVE Detection

✅ CVE-2025-55182 (React Server Functions RCE)
✅ CVE-2025-66478 (Next.js RSC RCE)
✅ Automatic version detection
✅ Vulnerability assessment

Scanning Capabilities

✅ Single URL scanning
✅ Bulk scanning from file
✅ Multi-threaded (up to unlimited threads)
✅ Timeout configuration
✅ Retry logic

Exploitation Features

✅ Command execution
✅ Interactive shell mode
✅ Output extraction
✅ Custom commands
✅ Bulk exploitation

User Interface

✅ Interactive menu
✅ CLI mode
✅ Color-coded output
✅ Progress tracking
✅ Live logging

📖 Examples

Example 1: Scan Single URL

python react2shell.py -u https://example.com

Output:

=================================================================
 CVE Scanner - CVE-2025-55182 & CVE-2025-66478
Author: LAKSHMIKANTHAN K (letchupkt)
Instagram: @letchu_pkt
=================================================================

[*] Scanning: https://example.com
[+] VULNERABLE: https://example.com
    Version: 15.0.1
    CVE-2025-55182: VULNERABLE
    CVE-2025-66478: VULNERABLE

Example 2: Interactive Shell

python react2shell.py
# Select option 5
# Enter target URL

Shell Session:

shell> whoami
root

shell> pwd
/app

shell> ls -la
total 120
drwxr-xr-x    1 root     root          4096 Dec  6 10:30 .
...

shell> exit

Example 3: Bulk Scanning

python react2shell.py -f targets.txt -t 20 -o results.json

🚨 Legal & Ethical Use

⚠️ CRITICAL WARNING

This tool is for AUTHORIZED SECURITY TESTING ONLY!

Legal Usage

✅ Your own applications
✅ Authorized penetration tests
✅ Bug bounty programs (in scope)
✅ Security research (authorized)

Illegal Usage

❌ Unauthorized scanning
❌ Unauthorized exploitation
❌ Any illegal activity
❌ Violating terms of service

Disclaimer

The author (LAKSHMIKANTHAN K) is not responsible for misuse of this tool. Users are solely responsible for their actions and must comply with all applicable laws.

🔧 Troubleshooting

"Failed to decompress scanner code"

Cause: File is corrupted
Solution: Download a fresh copy

"Scanner integrity check FAILED"

Cause: File has been modified
Solution: Download a fresh copy (do not modify the file)

"Module not found" Error

Cause: Missing dependencies
Solution:

pip install requests urllib3

Scanner Runs Slowly

Cause: Decompression overhead (minimal)
Note: Only happens once at startup, then runs at full speed

💡 FAQ

Q: Can I see the source code?

A: The code is obfuscated and compressed. You can use the original unobfuscated version if you need to read the code.

Q: Does obfuscation affect performance?

A: Minimal impact. There's a tiny delay at startup for decompression (~0.1 seconds), then it runs at full speed.

Q: Can I modify the obfuscated code?

A: No. Any modification will break the integrity check and the scanner will refuse to run.

Q: Is this secure?

A: Obfuscation is not encryption. Determined attackers can still reverse engineer it, but it's very difficult and time-consuming.

Q: Can I get the original code?

A: Contact the author on Instagram: @letchu_pkt

📞 Support & Contact

Author Information

Name: LAKSHMIKANTHAN K (letchupkt)
Instagram: @letchu_pkt

Getting Help

Read this README
Check that dependencies are installed
Ensure you haven't modified the file
Contact author on Instagram

Reporting Issues

If you encounter issues:

Describe the problem
Include error messages
Mention your OS and Python version
Contact via Instagram: @letchu_pkt

🎓 How to Use

Step 1: Install Dependencies

pip install requests urllib3

Step 2: Run Scanner

python react2shell.py

Step 3: Select Option

Choose from the interactive menu or use CLI mode.

Step 4: Scan/Exploit

Follow the prompts or provide command-line arguments.

⚡ Quick Commands

# Interactive mode
python react2shell.py

# Scan single URL
python react2shell.py -u https://target.com

# Bulk scan
python react2shell.py -f targets.txt -t 20

# Exploit
python react2shell.py -u https://target.com --exploit -c "whoami"

# Help
python react2shell.py --help

🛡️ Final Notes

Remember

This is an obfuscated version - modifications will break it
All functionality is preserved
Integrity checks ensure authenticity
Use responsibly and ethically
Only on authorized systems

Author

LAKSHMIKANTHAN K (letchupkt)
Instagram: @letchu_pkt

Thank you for using the CVE Scanner! 🚀

Version: 2.0.0 (Obfuscated)
Date: 2025-12-07
License: For authorized security testing only

React2Shell

Most Popular